Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
Okami.mpsl.elf

Overview

General Information

Sample name:Okami.mpsl.elf
Analysis ID:1650699
MD5:b18d098764a334e33000e726fa49b9b0
SHA1:3e70186ce4ac6fe49284b7ca6b8f212ae2514e31
SHA256:c1d642ae7a7d9f7c3c39ced48b2eeb68ab453d1143984a8f302cb2bebd1f15e0
Tags:elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score:88
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Gafgyt
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1650699
Start date and time:2025-03-27 23:04:30 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 16s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Okami.mpsl.elf
Detection:MAL
Classification:mal88.troj.linELF@0/0@2/0
  • VT rate limit hit for: 94.154.34.47:23

Runtime Messages

Command:/tmp/Okami.mpsl.elf
PID:5512
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 5528, Parent: 3672)
  • rm (PID: 5528, Parent: 3672, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.hl0c5kYX4l /tmp/tmp.53jKYi0g2M /tmp/tmp.vE0zVRMHTB
  • dash New Fork (PID: 5529, Parent: 3672)
  • cat (PID: 5529, Parent: 3672, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.hl0c5kYX4l
  • dash New Fork (PID: 5530, Parent: 3672)
  • head (PID: 5530, Parent: 3672, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5531, Parent: 3672)
  • tr (PID: 5531, Parent: 3672, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5532, Parent: 3672)
  • cut (PID: 5532, Parent: 3672, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5533, Parent: 3672)
  • cat (PID: 5533, Parent: 3672, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.hl0c5kYX4l
  • dash New Fork (PID: 5534, Parent: 3672)
  • head (PID: 5534, Parent: 3672, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5535, Parent: 3672)
  • tr (PID: 5535, Parent: 3672, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5536, Parent: 3672)
  • cut (PID: 5536, Parent: 3672, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5537, Parent: 3672)
  • rm (PID: 5537, Parent: 3672, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.hl0c5kYX4l /tmp/tmp.53jKYi0g2M /tmp/tmp.vE0zVRMHTB
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
Okami.mpsl.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    Okami.mpsl.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      Okami.mpsl.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x133a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x133f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1341c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1346c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x134f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1350c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x13534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      5676.1.00007f1164400000.00007f1164416000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5676.1.00007f1164400000.00007f1164416000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x133a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x133b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x133cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x133e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x133f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1341c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1346c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x134a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x134bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x134d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x134e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x134f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1350c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x13534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        5516.1.00007f1164400000.00007f1164416000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5516.1.00007f1164400000.00007f1164416000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x133a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x133f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1341c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1346c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x134f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1350c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x13534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          5615.1.00007f1164400000.00007f1164416000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
            Click to see the 31 entries

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            • • AV Detection
            • • Compliance
            • • Networking
            • • System Summary
            • • Persistence and Installation Behavior
            • • Malware Analysis System Evasion
            • • Stealing of Sensitive Information
            • • Remote Access Functionality

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: Okami.mpsl.elfAvira: detected
            Source: Okami.mpsl.elfMalware Configuration Extractor: Gafgyt {"C2 url": "94.154.34.47:23"}
            Source: Okami.mpsl.elfVirustotal: Detection: 62%Perma Link
            Source: Okami.mpsl.elfReversingLabs: Detection: 58%
            Source: unknownHTTPS traffic detected: 34.254.182.186:443 -> 192.168.2.15:44524 version: TLS 1.2
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 34.254.182.186
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: unknownTCP traffic detected without corresponding DNS query: 94.154.34.47
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
            Source: Okami.mpsl.elfString found in binary or memory: http://fast.no/support/crawler.asp)
            Source: Okami.mpsl.elfString found in binary or memory: http://feedback.redkolibri.com/
            Source: Okami.mpsl.elfString found in binary or memory: http://www.baidu.com/search/spider.htm)
            Source: Okami.mpsl.elfString found in binary or memory: http://www.baidu.com/search/spider.html)
            Source: Okami.mpsl.elfString found in binary or memory: http://www.billybobbot.com/crawler/)
            Source: unknownNetwork traffic detected: HTTP traffic on port 44524 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 44524
            Source: unknownHTTPS traffic detected: 34.254.182.186:443 -> 192.168.2.15:44524 version: TLS 1.2

            System Summary

            barindex
            Source: Okami.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5676.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5516.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5615.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5632.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5651.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5596.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5512.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5518.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5514.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5512, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5514, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5516, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5518, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5596, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5615, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5632, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5651, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: Okami.mpsl.elf PID: 5676, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Initial sampleString containing 'busybox' found: pkill -9 busybox
            Source: Initial sampleString containing 'busybox' found: rm -rf /tmp/* /var/* /var/run/* /var/tmp/*rm -rf /var/log/wtmprm -rf /tmp/*rm -rf /bin/netstatiptables -Fpkill -9 busyboxpkill -9 perlpkill -9 pythonservice iptables stop/sbin/iptables -F; /sbin/iptables -Xservice firewalld stoprm -rf ~/.bash_historyhistory -c;history -wBIG_ENDIANLITTLE_ENDIANBIG_ENDIAN_WLITTLE_ENDIAN_WUNKNOWN/[ INFECTED ] Arch: %s || Type: %s]DUP
            Source: Okami.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5676.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5516.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5615.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5632.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5651.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5596.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5512.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5518.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5514.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5512, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5514, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5516, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5518, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5596, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5615, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5632, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5651, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: Okami.mpsl.elf PID: 5676, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: classification engineClassification label: mal88.troj.linELF@0/0@2/0
            Source: Okami.mpsl.elfELF static info symbol of initial sample: libc/string/mips/memcpy.S
            Source: Okami.mpsl.elfELF static info symbol of initial sample: libc/string/mips/memset.S
            Source: Okami.mpsl.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
            Source: Okami.mpsl.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
            Source: Okami.mpsl.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
            Source: /usr/bin/dash (PID: 5528)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hl0c5kYX4l /tmp/tmp.53jKYi0g2M /tmp/tmp.vE0zVRMHTBJump to behavior
            Source: /usr/bin/dash (PID: 5537)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.hl0c5kYX4l /tmp/tmp.53jKYi0g2M /tmp/tmp.vE0zVRMHTBJump to behavior
            Source: /tmp/Okami.mpsl.elf (PID: 5512)Queries kernel information via 'uname': Jump to behavior
            Source: Okami.mpsl.elf, 5512.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5514.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5516.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5518.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5596.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5615.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5632.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5651.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5676.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
            Source: Okami.mpsl.elf, 5512.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5514.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5516.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5518.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5596.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5615.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5632.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5651.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5676.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Okami.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Okami.mpsl.elf
            Source: Okami.mpsl.elf, 5512.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5514.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5516.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5518.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5596.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5615.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5632.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5651.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmp, Okami.mpsl.elf, 5676.1.000055a1ab0d4000.000055a1ab15b000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
            Source: Okami.mpsl.elf, 5512.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5514.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5516.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5518.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5596.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5615.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5632.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5651.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmp, Okami.mpsl.elf, 5676.1.00007fffc9f08000.00007fffc9f29000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: Okami.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: Okami.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: 5676.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5516.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5615.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5632.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5651.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5596.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5512.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5518.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5514.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5512, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5514, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5516, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5518, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5596, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5615, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5632, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5651, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5676, type: MEMORYSTR
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
            Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
            Source: Initial sampleUser agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
            Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: Okami.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: Okami.mpsl.elf, type: SAMPLE
            Source: Yara matchFile source: 5676.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5516.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5615.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5632.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5651.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5596.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5512.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5518.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5514.1.00007f1164400000.00007f1164416000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5512, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5514, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5516, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5518, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5596, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5615, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5632, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5651, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: Okami.mpsl.elf PID: 5676, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
            File Deletion            		OS Credential Dumping11
            Security Software Discovery            		Remote ServicesData from Local System1
            Data Obfuscation            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
            Application Layer Protocol            		Traffic DuplicationData Destruction

            Malware Configuration

            Threatname: Gafgyt

            {
  "C2 url": "94.154.34.47:23"
}

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1650699 Sample: Okami.mpsl.elf Startdate: 27/03/2025 Architecture: LINUX Score: 88 41 94.154.34.47, 23 SELECTELRU Ukraine 2->41 43 34.254.182.186, 443, 44524 AMAZON-02US United States 2->43 45 daisy.ubuntu.com 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 3 other signatures 2->53 15 Okami.mpsl.elf 2->15         started        17 dash rm 2->17         started        19 dash cat 2->19         started        21 8 other processes 2->21 signatures3 process4 process5 23 Okami.mpsl.elf 15->23         started        process6 25 Okami.mpsl.elf 23->25         started        process7 27 Okami.mpsl.elf 25->27         started        process8 29 Okami.mpsl.elf 27->29         started        process9 31 Okami.mpsl.elf 29->31         started        process10 33 Okami.mpsl.elf 31->33         started        process11 35 Okami.mpsl.elf 33->35         started        process12 37 Okami.mpsl.elf 35->37         started        process13 39 Okami.mpsl.elf 37->39         started       

            Screenshots

            Download Video

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Okami.mpsl.elf62%VirustotalBrowse
            Okami.mpsl.elf58%ReversingLabsLinux.Backdoor.Gafgyt
            Okami.mpsl.elf100%AviraEXP/ELF.Mirai.Z.A

            Dropped Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Download Network PCAP: filtered – full

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            		162.213.35.25
            		truefalse
              		high

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              94.154.34.47:23true
                		unknown
                NameSourceMaliciousAntivirus DetectionReputation
                http://www.baidu.com/search/spider.html)Okami.mpsl.elffalse
                  		high
                  http://www.billybobbot.com/crawler/)Okami.mpsl.elffalse
                    		high
                    http://fast.no/support/crawler.asp)Okami.mpsl.elffalse
                      		high
                      http://feedback.redkolibri.com/Okami.mpsl.elffalse
                        		high
                        http://www.baidu.com/search/spider.htm)Okami.mpsl.elffalse
                          		high

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          34.254.182.186
                          		unknownUnited States
                          		16509AMAZON-02USfalse
                          94.154.34.47
                          		unknownUkraine
                          		49505SELECTELRUtrue

                          Joe Sandbox View / Context

                          IPs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          34.254.182.186sshd.elfGet hashmaliciousGafgyt, MiraiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              SecuriteInfo.com.Linux.Mirai.4306.30063.19032.elfGet hashmaliciousUnknownBrowse
                                hanoi.arm.elfGet hashmaliciousUnknownBrowse
                                  arm6.elfGet hashmaliciousUnknownBrowse
                                    na.elfGet hashmaliciousPrometeiBrowse
                                      GoldAge3ATOmpsl.elfGet hashmaliciousUnknownBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          x86_64.elfGet hashmaliciousUnknownBrowse
                                            morte.arm5.elfGet hashmaliciousUnknownBrowse

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              daisy.ubuntu.comsshd.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.25
                                              apache2.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.25
                                              bejv86.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.25
                                              rrrdsl.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.25
                                              efea6.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.25
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.25
                                              sshd.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.24
                                              sshd.elfGet hashmaliciousGafgytBrowse
                                              • 162.213.35.24
                                              cron.elfGet hashmaliciousGafgytBrowse
                                              • 162.213.35.25
                                              SecuriteInfo.com.ELF.Mirai-AXV.27459.929.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.24

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              AMAZON-02UShttps://mipscenter.comGet hashmaliciousUnknownBrowse
                                              • 13.33.252.15
                                              sh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.249.145.219
                                              openssh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.249.145.219
                                              wget.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.249.145.219
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 54.170.242.139
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 54.170.242.139
                                              sshd.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.254.182.186
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 54.170.242.139
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 54.170.242.139
                                              https://mahoganydevelopment.knack.com/untitled-appGet hashmaliciousHTMLPhisherBrowse
                                              • 13.216.201.204
                                              SELECTELRUAf3hqfTjFh.exeGet hashmaliciousAmadey, Babadeda, LummaC StealerBrowse
                                              • 176.113.115.6
                                              k03ldc.m68k.elfGet hashmaliciousUnknownBrowse
                                              • 91.220.90.33
                                              WeJUMzwLs1.exeGet hashmaliciousNetSupport RAT, Amadey, LummaC StealerBrowse
                                              • 176.113.115.6
                                              rRYQiGZ4K3.exeGet hashmaliciousAmadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, Stealc, VidarBrowse
                                              • 176.113.115.6
                                              a69aiSX97n.exeGet hashmaliciousAmadey, DarkVision Rat, LummaC StealerBrowse
                                              • 176.113.115.6
                                              ATitERlY7I.exeGet hashmaliciousScreenConnect Tool, Amadey, DarkVision Rat, LummaC StealerBrowse
                                              • 176.113.115.6
                                              FRCe39S0oE.exeGet hashmaliciousAmadeyBrowse
                                              • 176.113.115.6
                                              Order0324fpubh-10-994125-1,pdf.batGet hashmaliciousGuLoaderBrowse
                                              • 45.8.124.12
                                              pBYl2fOFZX.exeGet hashmaliciousSocks5SystemzBrowse
                                              • 176.113.115.96
                                              pBYl2fOFZX.exeGet hashmaliciousSocks5SystemzBrowse
                                              • 176.113.115.96

                                              JA3 Fingerprints

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              fb4726d465c5f28b84cd6d14cedd13a7sshd.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.254.182.186
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.254.182.186
                                              wget.elfGet hashmaliciousGafgytBrowse
                                              • 34.254.182.186
                                              apache2.elfGet hashmaliciousGafgytBrowse
                                              • 34.254.182.186
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.254.182.186
                                              SecuriteInfo.com.Linux.Mirai.2522.5402.17083.elfGet hashmaliciousUnknownBrowse
                                              • 34.254.182.186
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.254.182.186
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 34.254.182.186
                                              m68k.elfGet hashmaliciousUnknownBrowse
                                              • 34.254.182.186
                                              vjwe68k.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.254.182.186

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              ⊘No created / dropped files found

                                              Static File Info

                                              General

                                              File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                                              Entropy (8bit):5.29869045615169
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:Okami.mpsl.elf
                                              File size:123'181 bytes
                                              MD5:b18d098764a334e33000e726fa49b9b0
                                              SHA1:3e70186ce4ac6fe49284b7ca6b8f212ae2514e31
                                              SHA256:c1d642ae7a7d9f7c3c39ced48b2eeb68ab453d1143984a8f302cb2bebd1f15e0
                                              SHA512:fa205de22439df0b1d83acf83c30cd94f17436520c5f9e79162f76c9a07d3709c496f513c1709b54e0622c545becaa6402e41021f4e1cbbca1e355215ce871c7
                                              SSDEEP:3072:lWYQ5Y/cz+o25hr647BAzRPRx9Fq51uUOypn:lWu/cCo25hms2zRPRx9Fq51uUOypn
                                              TLSH:AAC3E917BB518EB3C81FCD3306AA460120CEE59616E56B6BB2B4DA6CF74784F09D3D84
                                              File Content Preview:.ELF......................@.4...........4. ...(........p......@...@...........................@...@.(T..(T...............`...`E..`E......m..........Q.td..................................................E....<...'!......'.......................<...'!... ..

                                              Static ELF Info

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:MIPS R3000
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:UNIX - System V
                                              ABI Version:0
                                              Entry Point Address:0x4002a0
                                              Flags:0x1007
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:4
                                              Section Header Offset:102872
                                              Section Header Size:40
                                              Number of Section Headers:21
                                              Header String Table Index:18

                                              Sections

                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                              NULL0x00x00x00x00x0000
                                              .reginfoMIPS_REGINFO0x4000b40xb40x180x180x2A004
                                              .initPROGBITS0x4000cc0xcc0x8c0x00x6AX004
                                              .textPROGBITS0x4001600x1600x11d900x00x6AX0016
                                              .finiPROGBITS0x411ef00x11ef00x5c0x00x6AX004
                                              .rodataPROGBITS0x411f500x11f500x34d40x00x2A0016
                                              .eh_framePROGBITS0x4154240x154240x40x00x2A004
                                              .ctorsPROGBITS0x4560000x160000x80x00x3WA004
                                              .dtorsPROGBITS0x4560080x160080x80x00x3WA004
                                              .jcrPROGBITS0x4560100x160100x40x00x3WA004
                                              .data.rel.roPROGBITS0x4560140x160140x680x00x3WA004
                                              .dataPROGBITS0x4560800x160800x5100x00x3WA0016
                                              .gotPROGBITS0x4565900x165900x4800x40x10000003WAp0016
                                              .sbssNOBITS0x456a100x16a100x1c0x00x10000003WAp004
                                              .bssNOBITS0x456a300x16a100x63a40x00x3WA0016
                                              .commentPROGBITS0x00x16a100xb0a0x00x0001
                                              .mdebug.abi32PROGBITS0xb0a0x1751a0x00x00x0001
                                              .pdrPROGBITS0x00x1751c0x1c200x00x0004
                                              .shstrtabSTRTAB0x00x1913c0x9a0x00x0001
                                              .symtabSYMTAB0x00x195200x2b800x100x0202924
                                              .strtabSTRTAB0x00x1c0a00x208d0x00x0001

                                              Program Segments

                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              <unknown>0xb40x4000b40x4000b40x180x180.98340x4R 0x4.reginfo
                                              LOAD0x00x4000000x4000000x154280x154285.42940x5R E0x10000.reginfo .init .text .fini .rodata .eh_frame
                                              LOAD0x160000x4560000x4560000xa100x6dd44.17760x6RW 0x10000.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                              Symbols

                                              NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                              .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                              .symtab0x4000b40SECTION<unknown>DEFAULT1
                                              .symtab0x4000cc0SECTION<unknown>DEFAULT2
                                              .symtab0x4001600SECTION<unknown>DEFAULT3
                                              .symtab0x411ef00SECTION<unknown>DEFAULT4
                                              .symtab0x411f500SECTION<unknown>DEFAULT5
                                              .symtab0x4154240SECTION<unknown>DEFAULT6
                                              .symtab0x4560000SECTION<unknown>DEFAULT7
                                              .symtab0x4560080SECTION<unknown>DEFAULT8
                                              .symtab0x4560100SECTION<unknown>DEFAULT9
                                              .symtab0x4560140SECTION<unknown>DEFAULT10
                                              .symtab0x4560800SECTION<unknown>DEFAULT11
                                              .symtab0x4565900SECTION<unknown>DEFAULT12
                                              .symtab0x456a100SECTION<unknown>DEFAULT13
                                              .symtab0x456a300SECTION<unknown>DEFAULT14
                                              .symtab0x00SECTION<unknown>DEFAULT15
                                              .symtab0xb0a0SECTION<unknown>DEFAULT16
                                              .symtab0x00SECTION<unknown>DEFAULT17
                                              .symtab0x00SECTION<unknown>DEFAULT18
                                              .symtab0x00SECTION<unknown>DEFAULT19
                                              .symtab0x00SECTION<unknown>DEFAULT20
                                              C.104.5150.symtab0x456014104OBJECT<unknown>DEFAULT10
                                              Okami.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              Q.symtab0x456a6816384OBJECT<unknown>DEFAULT14
                                              RemoveTempDirs.symtab0x406088520FUNC<unknown>DEFAULT3
                                              SendHTTP.symtab0x404814644FUNC<unknown>DEFAULT3
                                              SendSTD.symtab0x4033ec680FUNC<unknown>DEFAULT3
                                              SendSTDHEX.symtab0x4031dc528FUNC<unknown>DEFAULT3
                                              SendTCP.symtab0x403d442324FUNC<unknown>DEFAULT3
                                              SendUDP.symtab0x4036941712FUNC<unknown>DEFAULT3
                                              UpdateNameSrvs.symtab0x405f80264FUNC<unknown>DEFAULT3
                                              _GLOBAL_OFFSET_TABLE_.symtab0x4565900OBJECT<unknown>DEFAULT12
                                              _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                              _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __CTOR_END__.symtab0x4560040OBJECT<unknown>DEFAULT7
                                              __CTOR_LIST__.symtab0x4560000OBJECT<unknown>DEFAULT7
                                              __C_ctype_b.symtab0x4561b04OBJECT<unknown>DEFAULT11
                                              __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __C_ctype_b_data.symtab0x413c80768OBJECT<unknown>DEFAULT5
                                              __C_ctype_tolower.symtab0x4565304OBJECT<unknown>DEFAULT11
                                              __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __C_ctype_tolower_data.symtab0x414fc0768OBJECT<unknown>DEFAULT5
                                              __C_ctype_toupper.symtab0x4561c04OBJECT<unknown>DEFAULT11
                                              __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __C_ctype_toupper_data.symtab0x413f80768OBJECT<unknown>DEFAULT5
                                              __DTOR_END__.symtab0x45600c0OBJECT<unknown>DEFAULT8
                                              __DTOR_LIST__.symtab0x4560080OBJECT<unknown>DEFAULT8
                                              __EH_FRAME_BEGIN__.symtab0x4154240OBJECT<unknown>DEFAULT6
                                              __FRAME_END__.symtab0x4154240OBJECT<unknown>DEFAULT6
                                              __GI___C_ctype_b.symtab0x4561b04OBJECT<unknown>HIDDEN11
                                              __GI___C_ctype_b_data.symtab0x413c80768OBJECT<unknown>HIDDEN5
                                              __GI___C_ctype_tolower.symtab0x4565304OBJECT<unknown>HIDDEN11
                                              __GI___C_ctype_tolower_data.symtab0x414fc0768OBJECT<unknown>HIDDEN5
                                              __GI___C_ctype_toupper.symtab0x4561c04OBJECT<unknown>HIDDEN11
                                              __GI___C_ctype_toupper_data.symtab0x413f80768OBJECT<unknown>HIDDEN5
                                              __GI___ctype_b.symtab0x4561b44OBJECT<unknown>HIDDEN11
                                              __GI___ctype_tolower.symtab0x4565344OBJECT<unknown>HIDDEN11
                                              __GI___ctype_toupper.symtab0x4561c44OBJECT<unknown>HIDDEN11
                                              __GI___errno_location.symtab0x407a3024FUNC<unknown>HIDDEN3
                                              __GI___fgetc_unlocked.symtab0x4117d0388FUNC<unknown>HIDDEN3
                                              __GI___glibc_strerror_r.symtab0x40995068FUNC<unknown>HIDDEN3
                                              __GI___h_errno_location.symtab0x40c99024FUNC<unknown>HIDDEN3
                                              __GI___libc_fcntl.symtab0x407120136FUNC<unknown>HIDDEN3
                                              __GI___libc_fcntl64.symtab0x4071b0104FUNC<unknown>HIDDEN3
                                              __GI___libc_open.symtab0x4074b0124FUNC<unknown>HIDDEN3
                                              __GI___uClibc_fini.symtab0x40beb0196FUNC<unknown>HIDDEN3
                                              __GI___uClibc_init.symtab0x40c00c140FUNC<unknown>HIDDEN3
                                              __GI___xpg_strerror_r.symtab0x4099a0392FUNC<unknown>HIDDEN3
                                              __GI__exit.symtab0x40722080FUNC<unknown>HIDDEN3
                                              __GI_abort.symtab0x40f050428FUNC<unknown>HIDDEN3
                                              __GI_atoi.symtab0x40b82028FUNC<unknown>HIDDEN3
                                              __GI_atol.symtab0x40b82028FUNC<unknown>HIDDEN3
                                              __GI_brk.symtab0x40f230112FUNC<unknown>HIDDEN3
                                              __GI_chdir.symtab0x4072d088FUNC<unknown>HIDDEN3
                                              __GI_close.symtab0x40733084FUNC<unknown>HIDDEN3
                                              __GI_connect.symtab0x40a3b084FUNC<unknown>HIDDEN3
                                              __GI_errno.symtab0x45ccd04OBJECT<unknown>HIDDEN14
                                              __GI_execl.symtab0x40bba0204FUNC<unknown>HIDDEN3
                                              __GI_execve.symtab0x40c55084FUNC<unknown>HIDDEN3
                                              __GI_exit.symtab0x40bab0236FUNC<unknown>HIDDEN3
                                              __GI_fclose.symtab0x40f300512FUNC<unknown>HIDDEN3
                                              __GI_fcntl.symtab0x407120136FUNC<unknown>HIDDEN3
                                              __GI_fcntl64.symtab0x4071b0104FUNC<unknown>HIDDEN3
                                              __GI_fflush_unlocked.symtab0x40fe90628FUNC<unknown>HIDDEN3
                                              __GI_fgetc_unlocked.symtab0x4117d0388FUNC<unknown>HIDDEN3
                                              __GI_fgets.symtab0x40fc20216FUNC<unknown>HIDDEN3
                                              __GI_fgets_unlocked.symtab0x410110268FUNC<unknown>HIDDEN3
                                              __GI_fopen.symtab0x40f50028FUNC<unknown>HIDDEN3
                                              __GI_fork.symtab0x40739084FUNC<unknown>HIDDEN3
                                              __GI_fputs_unlocked.symtab0x409100128FUNC<unknown>HIDDEN3
                                              __GI_fseek.symtab0x40f52068FUNC<unknown>HIDDEN3
                                              __GI_fseeko64.symtab0x40f570388FUNC<unknown>HIDDEN3
                                              __GI_fwrite_unlocked.symtab0x409180280FUNC<unknown>HIDDEN3
                                              __GI_getc_unlocked.symtab0x4117d0388FUNC<unknown>HIDDEN3
                                              __GI_getegid.symtab0x40c5b088FUNC<unknown>HIDDEN3
                                              __GI_geteuid.symtab0x40c61088FUNC<unknown>HIDDEN3
                                              __GI_getgid.symtab0x40c67084FUNC<unknown>HIDDEN3
                                              __GI_gethostbyname.symtab0x409ed0116FUNC<unknown>HIDDEN3
                                              __GI_gethostbyname_r.symtab0x409f501108FUNC<unknown>HIDDEN3
                                              __GI_getpid.symtab0x4073f084FUNC<unknown>HIDDEN3
                                              __GI_getuid.symtab0x40c6d084FUNC<unknown>HIDDEN3
                                              __GI_h_errno.symtab0x45ccd44OBJECT<unknown>HIDDEN14
                                              __GI_inet_addr.symtab0x409e8072FUNC<unknown>HIDDEN3
                                              __GI_inet_aton.symtab0x40e0d0280FUNC<unknown>HIDDEN3
                                              __GI_inet_ntoa.symtab0x409e5c32FUNC<unknown>HIDDEN3
                                              __GI_inet_ntoa_r.symtab0x409da0188FUNC<unknown>HIDDEN3
                                              __GI_inet_ntop.symtab0x410a30852FUNC<unknown>HIDDEN3
                                              __GI_inet_pton.symtab0x410580700FUNC<unknown>HIDDEN3
                                              __GI_initstate_r.symtab0x40b490328FUNC<unknown>HIDDEN3
                                              __GI_ioctl.symtab0x40c730104FUNC<unknown>HIDDEN3
                                              __GI_isatty.symtab0x409c3060FUNC<unknown>HIDDEN3
                                              __GI_kill.symtab0x40745088FUNC<unknown>HIDDEN3
                                              __GI_lseek64.symtab0x4116e0164FUNC<unknown>HIDDEN3
                                              __GI_memchr.symtab0x40da20264FUNC<unknown>HIDDEN3
                                              __GI_memcpy.symtab0x4092a0308FUNC<unknown>HIDDEN3
                                              __GI_memmove.symtab0x40db30816FUNC<unknown>HIDDEN3
                                              __GI_mempcpy.symtab0x40de6076FUNC<unknown>HIDDEN3
                                              __GI_memrchr.symtab0x40deb0272FUNC<unknown>HIDDEN3
                                              __GI_memset.symtab0x4093e0144FUNC<unknown>HIDDEN3
                                              __GI_nanosleep.symtab0x40c7a084FUNC<unknown>HIDDEN3
                                              __GI_open.symtab0x4074b0124FUNC<unknown>HIDDEN3
                                              __GI_poll.symtab0x40f2a084FUNC<unknown>HIDDEN3
                                              __GI_raise.symtab0x41169076FUNC<unknown>HIDDEN3
                                              __GI_random.symtab0x40ae60164FUNC<unknown>HIDDEN3
                                              __GI_random_r.symtab0x40b26c176FUNC<unknown>HIDDEN3
                                              __GI_rawmemchr.symtab0x410220200FUNC<unknown>HIDDEN3
                                              __GI_read.symtab0x4075d084FUNC<unknown>HIDDEN3
                                              __GI_recv.symtab0x40a49084FUNC<unknown>HIDDEN3
                                              __GI_sbrk.symtab0x40c800144FUNC<unknown>HIDDEN3
                                              __GI_select.symtab0x407630120FUNC<unknown>HIDDEN3
                                              __GI_send.symtab0x40a4f084FUNC<unknown>HIDDEN3
                                              __GI_sendto.symtab0x40a550128FUNC<unknown>HIDDEN3
                                              __GI_seteuid.symtab0x4076b0220FUNC<unknown>HIDDEN3
                                              __GI_setresuid.symtab0x40779088FUNC<unknown>HIDDEN3
                                              __GI_setreuid.symtab0x4077f088FUNC<unknown>HIDDEN3
                                              __GI_setsockopt.symtab0x40a5d0120FUNC<unknown>HIDDEN3
                                              __GI_setstate_r.symtab0x40b130316FUNC<unknown>HIDDEN3
                                              __GI_sigaction.symtab0x40c400232FUNC<unknown>HIDDEN3
                                              __GI_signal.symtab0x40a6b0252FUNC<unknown>HIDDEN3
                                              __GI_sigprocmask.symtab0x40c890148FUNC<unknown>HIDDEN3
                                              __GI_sleep.symtab0x40bc70564FUNC<unknown>HIDDEN3
                                              __GI_socket.symtab0x40a65084FUNC<unknown>HIDDEN3
                                              __GI_sprintf.symtab0x407a5080FUNC<unknown>HIDDEN3
                                              __GI_srandom_r.symtab0x40b31c372FUNC<unknown>HIDDEN3
                                              __GI_strcasecmp.symtab0x411960108FUNC<unknown>HIDDEN3
                                              __GI_strcasestr.symtab0x409b70152FUNC<unknown>HIDDEN3
                                              __GI_strchr.symtab0x409470256FUNC<unknown>HIDDEN3
                                              __GI_strcmp.symtab0x40957044FUNC<unknown>HIDDEN3
                                              __GI_strcoll.symtab0x40957044FUNC<unknown>HIDDEN3
                                              __GI_strcpy.symtab0x4095a036FUNC<unknown>HIDDEN3
                                              __GI_strdup.symtab0x410400144FUNC<unknown>HIDDEN3
                                              __GI_strlen.symtab0x4095d0184FUNC<unknown>HIDDEN3
                                              __GI_strncat.symtab0x4102f0180FUNC<unknown>HIDDEN3
                                              __GI_strncpy.symtab0x409690188FUNC<unknown>HIDDEN3
                                              __GI_strnlen.symtab0x409750256FUNC<unknown>HIDDEN3
                                              __GI_strpbrk.symtab0x40e09064FUNC<unknown>HIDDEN3
                                              __GI_strspn.symtab0x4103b076FUNC<unknown>HIDDEN3
                                              __GI_strstr.symtab0x409850256FUNC<unknown>HIDDEN3
                                              __GI_strtok.symtab0x409c1032FUNC<unknown>HIDDEN3
                                              __GI_strtok_r.symtab0x40dfc0204FUNC<unknown>HIDDEN3
                                              __GI_strtol.symtab0x40b84028FUNC<unknown>HIDDEN3
                                              __GI_tcgetattr.symtab0x409c70176FUNC<unknown>HIDDEN3
                                              __GI_time.symtab0x4078e084FUNC<unknown>HIDDEN3
                                              __GI_tolower.symtab0x41179060FUNC<unknown>HIDDEN3
                                              __GI_toupper.symtab0x4079f060FUNC<unknown>HIDDEN3
                                              __GI_vsnprintf.symtab0x407aa0260FUNC<unknown>HIDDEN3
                                              __GI_wait4.symtab0x40c93088FUNC<unknown>HIDDEN3
                                              __GI_waitpid.symtab0x40794028FUNC<unknown>HIDDEN3
                                              __GI_wcrtomb.symtab0x40c9b0112FUNC<unknown>HIDDEN3
                                              __GI_wcsnrtombs.symtab0x40ca60228FUNC<unknown>HIDDEN3
                                              __GI_wcsrtombs.symtab0x40ca2064FUNC<unknown>HIDDEN3
                                              __GI_write.symtab0x40796084FUNC<unknown>HIDDEN3
                                              __JCR_END__.symtab0x4560100OBJECT<unknown>DEFAULT9
                                              __JCR_LIST__.symtab0x4560100OBJECT<unknown>DEFAULT9
                                              __app_fini.symtab0x45ccbc4OBJECT<unknown>HIDDEN14
                                              __atexit_lock.symtab0x45650024OBJECT<unknown>DEFAULT11
                                              __bsd_signal.symtab0x40a6b0252FUNC<unknown>HIDDEN3
                                              __bss_start.symtab0x456a100NOTYPE<unknown>DEFAULTSHN_ABS
                                              __check_one_fd.symtab0x40bf84136FUNC<unknown>DEFAULT3
                                              __ctype_b.symtab0x4561b44OBJECT<unknown>DEFAULT11
                                              __ctype_tolower.symtab0x4565344OBJECT<unknown>DEFAULT11
                                              __ctype_toupper.symtab0x4561c44OBJECT<unknown>DEFAULT11
                                              __curbrk.symtab0x45cd104OBJECT<unknown>HIDDEN14
                                              __data_start.symtab0x4560a00OBJECT<unknown>DEFAULT11
                                              __decode_answer.symtab0x411090340FUNC<unknown>HIDDEN3
                                              __decode_dotted.symtab0x411af0340FUNC<unknown>HIDDEN3
                                              __decode_header.symtab0x410ea0228FUNC<unknown>HIDDEN3
                                              __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                              __dns_lookup.symtab0x40e1f02568FUNC<unknown>HIDDEN3
                                              __do_global_ctors_aux.symtab0x411e800FUNC<unknown>DEFAULT3
                                              __do_global_dtors_aux.symtab0x4001600FUNC<unknown>DEFAULT3
                                              __dso_handle.symtab0x4560800OBJECT<unknown>HIDDEN11
                                              __encode_dotted.symtab0x4119d0280FUNC<unknown>HIDDEN3
                                              __encode_header.symtab0x410d90272FUNC<unknown>HIDDEN3
                                              __encode_question.symtab0x410f90172FUNC<unknown>HIDDEN3
                                              __environ.symtab0x45ccb44OBJECT<unknown>DEFAULT14
                                              __errno_location.symtab0x407a3024FUNC<unknown>DEFAULT3
                                              __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __exit_cleanup.symtab0x45cca04OBJECT<unknown>HIDDEN14
                                              __fgetc_unlocked.symtab0x4117d0388FUNC<unknown>DEFAULT3
                                              __fini_array_end.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                              __fini_array_start.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                              __get_hosts_byname_r.symtab0x40efe0104FUNC<unknown>HIDDEN3
                                              __glibc_strerror_r.symtab0x40995068FUNC<unknown>DEFAULT3
                                              __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __h_errno_location.symtab0x40c99024FUNC<unknown>DEFAULT3
                                              __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __heap_alloc.symtab0x40abc0188FUNC<unknown>DEFAULT3
                                              __heap_free.symtab0x40acc8364FUNC<unknown>DEFAULT3
                                              __heap_link_free_area.symtab0x40ac8044FUNC<unknown>DEFAULT3
                                              __heap_link_free_area_after.symtab0x40acac28FUNC<unknown>DEFAULT3
                                              __init_array_end.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                              __init_array_start.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                              __length_dotted.symtab0x411c5072FUNC<unknown>HIDDEN3
                                              __length_question.symtab0x41104072FUNC<unknown>HIDDEN3
                                              __libc_close.symtab0x40733084FUNC<unknown>DEFAULT3
                                              __libc_connect.symtab0x40a3b084FUNC<unknown>DEFAULT3
                                              __libc_creat.symtab0x40752c28FUNC<unknown>DEFAULT3
                                              __libc_fcntl.symtab0x407120136FUNC<unknown>DEFAULT3
                                              __libc_fcntl64.symtab0x4071b0104FUNC<unknown>DEFAULT3
                                              __libc_fork.symtab0x40739084FUNC<unknown>DEFAULT3
                                              __libc_getpid.symtab0x4073f084FUNC<unknown>DEFAULT3
                                              __libc_lseek64.symtab0x4116e0164FUNC<unknown>DEFAULT3
                                              __libc_nanosleep.symtab0x40c7a084FUNC<unknown>DEFAULT3
                                              __libc_open.symtab0x4074b0124FUNC<unknown>DEFAULT3
                                              __libc_poll.symtab0x40f2a084FUNC<unknown>DEFAULT3
                                              __libc_read.symtab0x4075d084FUNC<unknown>DEFAULT3
                                              __libc_recv.symtab0x40a49084FUNC<unknown>DEFAULT3
                                              __libc_select.symtab0x407630120FUNC<unknown>DEFAULT3
                                              __libc_send.symtab0x40a4f084FUNC<unknown>DEFAULT3
                                              __libc_sendto.symtab0x40a550128FUNC<unknown>DEFAULT3
                                              __libc_sigaction.symtab0x40c400232FUNC<unknown>DEFAULT3
                                              __libc_stack_end.symtab0x45ccb04OBJECT<unknown>DEFAULT14
                                              __libc_system.symtab0x40b5e0568FUNC<unknown>DEFAULT3
                                              __libc_waitpid.symtab0x40794028FUNC<unknown>DEFAULT3
                                              __libc_write.symtab0x40796084FUNC<unknown>DEFAULT3
                                              __malloc_heap.symtab0x4564304OBJECT<unknown>DEFAULT11
                                              __malloc_heap_lock.symtab0x45cc8024OBJECT<unknown>DEFAULT14
                                              __malloc_sbrk_lock.symtab0x45cda024OBJECT<unknown>DEFAULT14
                                              __nameserver.symtab0x45cdc812OBJECT<unknown>HIDDEN14
                                              __nameservers.symtab0x456a1c4OBJECT<unknown>HIDDEN13
                                              __open_etc_hosts.symtab0x4111f0108FUNC<unknown>HIDDEN3
                                              __open_nameservers.symtab0x40ec00984FUNC<unknown>HIDDEN3
                                              __pagesize.symtab0x45ccb84OBJECT<unknown>DEFAULT14
                                              __preinit_array_end.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                              __preinit_array_start.symtab0x4560000NOTYPE<unknown>HIDDENSHN_ABS
                                              __pthread_initialize_minimal.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                              __pthread_mutex_init.symtab0x40bf748FUNC<unknown>DEFAULT3
                                              __pthread_mutex_lock.symtab0x40bf748FUNC<unknown>DEFAULT3
                                              __pthread_mutex_trylock.symtab0x40bf748FUNC<unknown>DEFAULT3
                                              __pthread_mutex_unlock.symtab0x40bf748FUNC<unknown>DEFAULT3
                                              __pthread_return_0.symtab0x40bf748FUNC<unknown>DEFAULT3
                                              __pthread_return_void.symtab0x40bf7c8FUNC<unknown>DEFAULT3
                                              __raise.symtab0x41169076FUNC<unknown>HIDDEN3
                                              __read_etc_hosts_r.symtab0x41125c1076FUNC<unknown>HIDDEN3
                                              __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                              __resolv_lock.symtab0x45655024OBJECT<unknown>DEFAULT11
                                              __rtld_fini.symtab0x45ccc04OBJECT<unknown>HIDDEN14
                                              __searchdomain.symtab0x45cdb816OBJECT<unknown>HIDDEN14
                                              __searchdomains.symtab0x456a204OBJECT<unknown>HIDDEN13
                                              __sigaddset.symtab0x40a7d844FUNC<unknown>DEFAULT3
                                              __sigdelset.symtab0x40a80448FUNC<unknown>DEFAULT3
                                              __sigismember.symtab0x40a7b040FUNC<unknown>DEFAULT3
                                              __start.symtab0x4002a0100FUNC<unknown>DEFAULT3
                                              __stdin.symtab0x45621c4OBJECT<unknown>DEFAULT11
                                              __stdio_READ.symtab0x411ca0140FUNC<unknown>HIDDEN3
                                              __stdio_WRITE.symtab0x40cb50280FUNC<unknown>HIDDEN3
                                              __stdio_adjust_position.symtab0x40f700320FUNC<unknown>HIDDEN3
                                              __stdio_fwrite.symtab0x40cc70472FUNC<unknown>HIDDEN3
                                              __stdio_init_mutex.symtab0x407c6832FUNC<unknown>HIDDEN3
                                              __stdio_mutex_initializer.3833.symtab0x41428024OBJECT<unknown>DEFAULT5
                                              __stdio_rfill.symtab0x411d3088FUNC<unknown>HIDDEN3
                                              __stdio_seek.symtab0x40fbb0112FUNC<unknown>HIDDEN3
                                              __stdio_trans2r_o.symtab0x411d90228FUNC<unknown>HIDDEN3
                                              __stdio_trans2w_o.symtab0x40ce50308FUNC<unknown>HIDDEN3
                                              __stdio_wcommit.symtab0x407db0100FUNC<unknown>HIDDEN3
                                              __stdout.symtab0x4562204OBJECT<unknown>DEFAULT11
                                              __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __syscall_rt_sigaction.symtab0x40c4f084FUNC<unknown>HIDDEN3
                                              __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __uClibc_fini.symtab0x40beb0196FUNC<unknown>DEFAULT3
                                              __uClibc_init.symtab0x40c00c140FUNC<unknown>DEFAULT3
                                              __uClibc_main.symtab0x40c098864FUNC<unknown>DEFAULT3
                                              __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              __uclibc_progname.symtab0x4565204OBJECT<unknown>HIDDEN11
                                              __xpg_strerror_r.symtab0x4099a0392FUNC<unknown>DEFAULT3
                                              __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _charpad.symtab0x407e20128FUNC<unknown>DEFAULT3
                                              _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _dl_aux_init.symtab0x40f20044FUNC<unknown>DEFAULT3
                                              _dl_phdr.symtab0x456a244OBJECT<unknown>DEFAULT13
                                              _dl_phnum.symtab0x456a284OBJECT<unknown>DEFAULT13
                                              _edata.symtab0x456a100NOTYPE<unknown>DEFAULTSHN_ABS
                                              _end.symtab0x45cdd40NOTYPE<unknown>DEFAULTSHN_ABS
                                              _errno.symtab0x45ccd04OBJECT<unknown>DEFAULT14
                                              _exit.symtab0x40722080FUNC<unknown>DEFAULT3
                                              _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _fbss.symtab0x456a100NOTYPE<unknown>DEFAULTSHN_ABS
                                              _fdata.symtab0x4560800NOTYPE<unknown>DEFAULT11
                                              _fini.symtab0x411ef028FUNC<unknown>DEFAULT4
                                              _fixed_buffers.symtab0x45aa788192OBJECT<unknown>DEFAULT14
                                              _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _fp_out_narrow.symtab0x407ea0228FUNC<unknown>DEFAULT3
                                              _fpmaxtostr.symtab0x40d1d02120FUNC<unknown>HIDDEN3
                                              _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _ftext.symtab0x4001600NOTYPE<unknown>DEFAULT3
                                              _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _gp.symtab0x45e5800NOTYPE<unknown>DEFAULTSHN_ABS
                                              _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                              _h_errno.symtab0x45ccd44OBJECT<unknown>DEFAULT14
                                              _init.symtab0x4000cc28FUNC<unknown>DEFAULT2
                                              _load_inttype.symtab0x40cf90136FUNC<unknown>HIDDEN3
                                              _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _ppfs_init.symtab0x408730220FUNC<unknown>HIDDEN3
                                              _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _ppfs_parsespec.symtab0x408b0c1512FUNC<unknown>HIDDEN3
                                              _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _ppfs_prepargs.symtab0x408810100FUNC<unknown>HIDDEN3
                                              _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _ppfs_setargs.symtab0x408880544FUNC<unknown>HIDDEN3
                                              _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _promoted_size.symtab0x408aa0108FUNC<unknown>DEFAULT3
                                              _pthread_cleanup_pop_restore.symtab0x40bf7c8FUNC<unknown>DEFAULT3
                                              _pthread_cleanup_push_defer.symtab0x40bf7c8FUNC<unknown>DEFAULT3
                                              _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _sigintr.symtab0x45cd20128OBJECT<unknown>HIDDEN14
                                              _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _stdio_fopen.symtab0x40f840880FUNC<unknown>HIDDEN3
                                              _stdio_init.symtab0x407bb0184FUNC<unknown>HIDDEN3
                                              _stdio_openlist.symtab0x4562244OBJECT<unknown>DEFAULT11
                                              _stdio_openlist_add_lock.symtab0x4561d024OBJECT<unknown>DEFAULT11
                                              _stdio_openlist_dec_use.symtab0x40fd00400FUNC<unknown>DEFAULT3
                                              _stdio_openlist_del_count.symtab0x45aa744OBJECT<unknown>DEFAULT14
                                              _stdio_openlist_del_lock.symtab0x4561e824OBJECT<unknown>DEFAULT11
                                              _stdio_openlist_use_count.symtab0x45aa704OBJECT<unknown>DEFAULT14
                                              _stdio_streams.symtab0x456228240OBJECT<unknown>DEFAULT11
                                              _stdio_term.symtab0x407c88284FUNC<unknown>HIDDEN3
                                              _stdio_user_locking.symtab0x4562004OBJECT<unknown>DEFAULT11
                                              _stdlib_strto_l.symtab0x40b860592FUNC<unknown>HIDDEN3
                                              _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _store_inttype.symtab0x40d02068FUNC<unknown>HIDDEN3
                                              _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _string_syserrmsgs.symtab0x4143f02934OBJECT<unknown>HIDDEN5
                                              _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _uintmaxtostr.symtab0x40d070340FUNC<unknown>HIDDEN3
                                              _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _vfprintf_internal.symtab0x407f841960FUNC<unknown>HIDDEN3
                                              _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              abort.symtab0x40f050428FUNC<unknown>DEFAULT3
                                              abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              access.symtab0x40727084FUNC<unknown>DEFAULT3
                                              access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              advance_telstate.symtab0x400a04204FUNC<unknown>DEFAULT3
                                              atoi.symtab0x40b82028FUNC<unknown>DEFAULT3
                                              atol.symtab0x40b82028FUNC<unknown>DEFAULT3
                                              atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              bcopy.symtab0x409b3032FUNC<unknown>DEFAULT3
                                              bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              been_there_done_that.symtab0x45cd004OBJECT<unknown>DEFAULT14
                                              been_there_done_that.2792.symtab0x45ccc44OBJECT<unknown>DEFAULT14
                                              brk.symtab0x40f230112FUNC<unknown>DEFAULT3
                                              brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              bsd_signal.symtab0x40a6b0252FUNC<unknown>DEFAULT3
                                              buf.2613.symtab0x45ca9016OBJECT<unknown>DEFAULT14
                                              buf.4833.symtab0x45caa0460OBJECT<unknown>DEFAULT14
                                              bzero.symtab0x409b5028FUNC<unknown>DEFAULT3
                                              bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              c.symtab0x4560b44OBJECT<unknown>DEFAULT11
                                              chdir.symtab0x4072d088FUNC<unknown>DEFAULT3
                                              chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              close.symtab0x40733084FUNC<unknown>DEFAULT3
                                              close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              commServer.symtab0x4560c04OBJECT<unknown>DEFAULT11
                                              completed.2296.symtab0x456a301OBJECT<unknown>DEFAULT14
                                              connect.symtab0x40a3b084FUNC<unknown>DEFAULT3
                                              connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              connectTimeout.symtab0x402254828FUNC<unknown>DEFAULT3
                                              contains_string.symtab0x40064c280FUNC<unknown>DEFAULT3
                                              creat.symtab0x40752c28FUNC<unknown>DEFAULT3
                                              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              csum.symtab0x402d04460FUNC<unknown>DEFAULT3
                                              currentServer.symtab0x4560b04OBJECT<unknown>DEFAULT11
                                              data_start.symtab0x4560a00OBJECT<unknown>DEFAULT11
                                              decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              environ.symtab0x45ccb44OBJECT<unknown>DEFAULT14
                                              errno.symtab0x45ccd04OBJECT<unknown>DEFAULT14
                                              errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              estridx.symtab0x414360126OBJECT<unknown>DEFAULT5
                                              execl.symtab0x40bba0204FUNC<unknown>DEFAULT3
                                              execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              execve.symtab0x40c55084FUNC<unknown>DEFAULT3
                                              execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              exit.symtab0x40bab0236FUNC<unknown>DEFAULT3
                                              exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              exp10_table.symtab0x41531872OBJECT<unknown>DEFAULT5
                                              fclose.symtab0x40f300512FUNC<unknown>DEFAULT3
                                              fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fcntl.symtab0x407120136FUNC<unknown>DEFAULT3
                                              fcntl64.symtab0x4071b0104FUNC<unknown>DEFAULT3
                                              fflush_unlocked.symtab0x40fe90628FUNC<unknown>DEFAULT3
                                              fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fgetc_unlocked.symtab0x4117d0388FUNC<unknown>DEFAULT3
                                              fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fgets.symtab0x40fc20216FUNC<unknown>DEFAULT3
                                              fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fgets_unlocked.symtab0x410110268FUNC<unknown>DEFAULT3
                                              fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fmt.symtab0x41530020OBJECT<unknown>DEFAULT5
                                              fopen.symtab0x40f50028FUNC<unknown>DEFAULT3
                                              fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fork.symtab0x40739084FUNC<unknown>DEFAULT3
                                              fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fputs_unlocked.symtab0x409100128FUNC<unknown>DEFAULT3
                                              fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              frame_dummy.symtab0x40021c0FUNC<unknown>DEFAULT3
                                              free.symtab0x40aa30396FUNC<unknown>DEFAULT3
                                              free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fseek.symtab0x40f52068FUNC<unknown>DEFAULT3
                                              fseeko.symtab0x40f52068FUNC<unknown>DEFAULT3
                                              fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fseeko64.symtab0x40f570388FUNC<unknown>DEFAULT3
                                              fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              fwrite_unlocked.symtab0x409180280FUNC<unknown>DEFAULT3
                                              fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              getBuild.symtab0x40031056FUNC<unknown>DEFAULT3
                                              getEndianness.symtab0x406290340FUNC<unknown>DEFAULT3
                                              getHost.symtab0x401d3c160FUNC<unknown>DEFAULT3
                                              getRandomIP.symtab0x402c58172FUNC<unknown>DEFAULT3
                                              get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              get_telstate_host.symtab0x40099c104FUNC<unknown>DEFAULT3
                                              getc_unlocked.symtab0x4117d0388FUNC<unknown>DEFAULT3
                                              getegid.symtab0x40c5b088FUNC<unknown>DEFAULT3
                                              getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              geteuid.symtab0x40c61088FUNC<unknown>DEFAULT3
                                              geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              getgid.symtab0x40c67084FUNC<unknown>DEFAULT3
                                              getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              gethostbyname.symtab0x409ed0116FUNC<unknown>DEFAULT3
                                              gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              gethostbyname_r.symtab0x409f501108FUNC<unknown>DEFAULT3
                                              gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              getpid.symtab0x4073f084FUNC<unknown>DEFAULT3
                                              getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              getsockopt.symtab0x40a410120FUNC<unknown>DEFAULT3
                                              getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              getuid.symtab0x40c6d084FUNC<unknown>DEFAULT3
                                              getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              h.4832.symtab0x45cc6c20OBJECT<unknown>DEFAULT14
                                              h_errno.symtab0x45ccd44OBJECT<unknown>DEFAULT14
                                              heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              hlt.symtab0x4002fc0NOTYPE<unknown>DEFAULT3
                                              htonl.symtab0x409d6040FUNC<unknown>DEFAULT3
                                              htons.symtab0x409d8824FUNC<unknown>DEFAULT3
                                              i.4268.symtab0x4560b84OBJECT<unknown>DEFAULT11
                                              index.symtab0x409470256FUNC<unknown>DEFAULT3
                                              inet_addr.symtab0x409e8072FUNC<unknown>DEFAULT3
                                              inet_aton.symtab0x40e0d0280FUNC<unknown>DEFAULT3
                                              inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              inet_ntoa.symtab0x409e5c32FUNC<unknown>DEFAULT3
                                              inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              inet_ntoa_r.symtab0x409da0188FUNC<unknown>DEFAULT3
                                              inet_ntop.symtab0x410a30852FUNC<unknown>DEFAULT3
                                              inet_ntop4.symtab0x41083c500FUNC<unknown>DEFAULT3
                                              inet_pton.symtab0x410580700FUNC<unknown>DEFAULT3
                                              inet_pton4.symtab0x410490240FUNC<unknown>DEFAULT3
                                              initConnection.symtab0x405d30592FUNC<unknown>DEFAULT3
                                              init_rand.symtab0x400348300FUNC<unknown>DEFAULT3
                                              initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              initial_fa.symtab0x456320264OBJECT<unknown>DEFAULT11
                                              initstate.symtab0x40afb4208FUNC<unknown>DEFAULT3
                                              initstate_r.symtab0x40b490328FUNC<unknown>DEFAULT3
                                              ioctl.symtab0x40c730104FUNC<unknown>DEFAULT3
                                              ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              isatty.symtab0x409c3060FUNC<unknown>DEFAULT3
                                              isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              isspace.symtab0x4079c044FUNC<unknown>DEFAULT3
                                              isspace.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              kill.symtab0x40745088FUNC<unknown>DEFAULT3
                                              kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              libc/string/mips/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              libc/string/mips/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              libc/sysdeps/linux/mips/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              libc/sysdeps/linux/mips/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              libc/sysdeps/linux/mips/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              listFork.symtab0x402590632FUNC<unknown>DEFAULT3
                                              llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              lseek64.symtab0x4116e0164FUNC<unknown>DEFAULT3
                                              macAddress.symtab0x456a606OBJECT<unknown>DEFAULT14
                                              main.symtab0x4063e43384FUNC<unknown>DEFAULT3
                                              mainCommSock.symtab0x456a504OBJECT<unknown>DEFAULT14
                                              makeIPPacket.symtab0x403034296FUNC<unknown>DEFAULT3
                                              makeRandomStr.symtab0x401ddc268FUNC<unknown>DEFAULT3
                                              malloc.symtab0x40a840492FUNC<unknown>DEFAULT3
                                              malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              matchPrompt.symtab0x402a40536FUNC<unknown>DEFAULT3
                                              memchr.symtab0x40da20264FUNC<unknown>DEFAULT3
                                              memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              memcpy.symtab0x4092a0308FUNC<unknown>DEFAULT3
                                              memmove.symtab0x40db30816FUNC<unknown>DEFAULT3
                                              memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              mempcpy.symtab0x40de6076FUNC<unknown>DEFAULT3
                                              mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              memrchr.symtab0x40deb0272FUNC<unknown>DEFAULT3
                                              memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              memset.symtab0x4093e0144FUNC<unknown>DEFAULT3
                                              mylock.symtab0x45644024OBJECT<unknown>DEFAULT11
                                              mylock.symtab0x45cce024OBJECT<unknown>DEFAULT14
                                              mylock.symtab0x45657024OBJECT<unknown>DEFAULT11
                                              nanosleep.symtab0x40c7a084FUNC<unknown>DEFAULT3
                                              nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              negotiate.symtab0x402808568FUNC<unknown>DEFAULT3
                                              next_start.1065.symtab0x45ca804OBJECT<unknown>DEFAULT14
                                              ntohl.symtab0x409d2040FUNC<unknown>DEFAULT3
                                              ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              ntohs.symtab0x409d4824FUNC<unknown>DEFAULT3
                                              ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              numpids.symtab0x456a588OBJECT<unknown>DEFAULT14
                                              object.2349.symtab0x456a3424OBJECT<unknown>DEFAULT14
                                              open.symtab0x4074b0124FUNC<unknown>DEFAULT3
                                              open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              ourIP.symtab0x456a104OBJECT<unknown>DEFAULT13
                                              p.2294.symtab0x4560900OBJECT<unknown>DEFAULT11
                                              pids.symtab0x456a184OBJECT<unknown>DEFAULT13
                                              poll.symtab0x40f2a084FUNC<unknown>DEFAULT3
                                              poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              prctl.symtab0x407550120FUNC<unknown>DEFAULT3
                                              prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              prefix.4045.symtab0x4142b012OBJECT<unknown>DEFAULT5
                                              print.symtab0x40128c1456FUNC<unknown>DEFAULT3
                                              printchar.symtab0x400d00184FUNC<unknown>DEFAULT3
                                              printi.symtab0x400ff4664FUNC<unknown>DEFAULT3
                                              prints.symtab0x400db8572FUNC<unknown>DEFAULT3
                                              processCmd.symtab0x404a984760FUNC<unknown>DEFAULT3
                                              qual_chars.4050.symtab0x4142d020OBJECT<unknown>DEFAULT5
                                              raise.symtab0x41169076FUNC<unknown>DEFAULT3
                                              raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              rand.symtab0x40ae4028FUNC<unknown>DEFAULT3
                                              rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              rand_cmwc.symtab0x400474472FUNC<unknown>DEFAULT3
                                              random.symtab0x40ae60164FUNC<unknown>DEFAULT3
                                              random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              random_poly_info.symtab0x414f7040OBJECT<unknown>DEFAULT5
                                              random_r.symtab0x40b26c176FUNC<unknown>DEFAULT3
                                              random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              randtbl.symtab0x456458128OBJECT<unknown>DEFAULT11
                                              rawmemchr.symtab0x410220200FUNC<unknown>DEFAULT3
                                              rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              read.symtab0x4075d084FUNC<unknown>DEFAULT3
                                              read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              read_until_response.symtab0x4008cc208FUNC<unknown>DEFAULT3
                                              read_with_timeout.symtab0x400764360FUNC<unknown>DEFAULT3
                                              recv.symtab0x40a49084FUNC<unknown>DEFAULT3
                                              recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              recvLine.symtab0x401ee8876FUNC<unknown>DEFAULT3
                                              reset_telstate.symtab0x400ad0100FUNC<unknown>DEFAULT3
                                              sbrk.symtab0x40c800144FUNC<unknown>DEFAULT3
                                              sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              scanPid.symtab0x456a144OBJECT<unknown>DEFAULT13
                                              sclose.symtab0x40315c128FUNC<unknown>DEFAULT3
                                              select.symtab0x407630120FUNC<unknown>DEFAULT3
                                              select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              send.symtab0x40a4f084FUNC<unknown>DEFAULT3
                                              send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              sendto.symtab0x40a550128FUNC<unknown>DEFAULT3
                                              sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              seteuid.symtab0x4076b0220FUNC<unknown>DEFAULT3
                                              seteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              setresuid.symtab0x40779088FUNC<unknown>DEFAULT3
                                              setresuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              setreuid.symtab0x4077f088FUNC<unknown>DEFAULT3
                                              setreuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              setsockopt.symtab0x40a5d0120FUNC<unknown>DEFAULT3
                                              setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              setstate.symtab0x40af04176FUNC<unknown>DEFAULT3
                                              setstate_r.symtab0x40b130316FUNC<unknown>DEFAULT3
                                              setuid.symtab0x407850136FUNC<unknown>DEFAULT3
                                              setuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              sigaction.symtab0x40c400232FUNC<unknown>DEFAULT3
                                              sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              signal.symtab0x40a6b0252FUNC<unknown>DEFAULT3
                                              signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              sigprocmask.symtab0x40c890148FUNC<unknown>DEFAULT3
                                              sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              sleep.symtab0x40bc70564FUNC<unknown>DEFAULT3
                                              sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              socket.symtab0x40a65084FUNC<unknown>DEFAULT3
                                              socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              socket_connect.symtab0x404658444FUNC<unknown>DEFAULT3
                                              sockprintf.symtab0x40192c384FUNC<unknown>DEFAULT3
                                              spec_and_mask.4049.symtab0x4142e416OBJECT<unknown>DEFAULT5
                                              spec_base.4044.symtab0x4142bc7OBJECT<unknown>DEFAULT5
                                              spec_chars.4046.symtab0x41431021OBJECT<unknown>DEFAULT5
                                              spec_flags.4045.symtab0x4143288OBJECT<unknown>DEFAULT5
                                              spec_or_mask.4048.symtab0x4142f416OBJECT<unknown>DEFAULT5
                                              spec_ranges.4047.symtab0x4143049OBJECT<unknown>DEFAULT5
                                              sprintf.symtab0x407a5080FUNC<unknown>DEFAULT3
                                              sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              srand.symtab0x40b084172FUNC<unknown>DEFAULT3
                                              srandom.symtab0x40b084172FUNC<unknown>DEFAULT3
                                              srandom_r.symtab0x40b31c372FUNC<unknown>DEFAULT3
                                              static_id.symtab0x4565402OBJECT<unknown>DEFAULT11
                                              static_ns.symtab0x45ccf84OBJECT<unknown>DEFAULT14
                                              stderr.symtab0x4562184OBJECT<unknown>DEFAULT11
                                              stdin.symtab0x4562104OBJECT<unknown>DEFAULT11
                                              stdout.symtab0x4562144OBJECT<unknown>DEFAULT11
                                              strcasecmp.symtab0x411960108FUNC<unknown>DEFAULT3
                                              strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strcasestr.symtab0x409b70152FUNC<unknown>DEFAULT3
                                              strcasestr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strchr.symtab0x409470256FUNC<unknown>DEFAULT3
                                              strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strcmp.symtab0x40957044FUNC<unknown>DEFAULT3
                                              strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strcoll.symtab0x40957044FUNC<unknown>DEFAULT3
                                              strcpy.symtab0x4095a036FUNC<unknown>DEFAULT3
                                              strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strdup.symtab0x410400144FUNC<unknown>DEFAULT3
                                              strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strerror_r.symtab0x4099a0392FUNC<unknown>DEFAULT3
                                              strlen.symtab0x4095d0184FUNC<unknown>DEFAULT3
                                              strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strncat.symtab0x4102f0180FUNC<unknown>DEFAULT3
                                              strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strncpy.symtab0x409690188FUNC<unknown>DEFAULT3
                                              strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strnlen.symtab0x409750256FUNC<unknown>DEFAULT3
                                              strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strpbrk.symtab0x40e09064FUNC<unknown>DEFAULT3
                                              strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strspn.symtab0x4103b076FUNC<unknown>DEFAULT3
                                              strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strstr.symtab0x409850256FUNC<unknown>DEFAULT3
                                              strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strtok.symtab0x409c1032FUNC<unknown>DEFAULT3
                                              strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strtok_r.symtab0x40dfc0204FUNC<unknown>DEFAULT3
                                              strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              strtol.symtab0x40b84028FUNC<unknown>DEFAULT3
                                              strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              system.symtab0x40b5e0568FUNC<unknown>DEFAULT3
                                              system.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              szprintf.symtab0x4018b4120FUNC<unknown>DEFAULT3
                                              tcgetattr.symtab0x409c70176FUNC<unknown>DEFAULT3
                                              tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              tcpcsum.symtab0x402ed0356FUNC<unknown>DEFAULT3
                                              time.symtab0x4078e084FUNC<unknown>DEFAULT3
                                              time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              tolower.symtab0x41179060FUNC<unknown>DEFAULT3
                                              tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              toupper.symtab0x4079f060FUNC<unknown>DEFAULT3
                                              toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              trim.symtab0x400b34460FUNC<unknown>DEFAULT3
                                              type_codes.symtab0x41433024OBJECT<unknown>DEFAULT5
                                              type_sizes.symtab0x41434812OBJECT<unknown>DEFAULT5
                                              unknown.1088.symtab0x4143e014OBJECT<unknown>DEFAULT5
                                              unsafe_state.symtab0x4564e028OBJECT<unknown>DEFAULT11
                                              useragents.symtab0x4560c4236OBJECT<unknown>DEFAULT11
                                              vsnprintf.symtab0x407aa0260FUNC<unknown>DEFAULT3
                                              vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              wait4.symtab0x40c93088FUNC<unknown>DEFAULT3
                                              wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              waitpid.symtab0x40794028FUNC<unknown>DEFAULT3
                                              waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              wcrtomb.symtab0x40c9b0112FUNC<unknown>DEFAULT3
                                              wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              wcsnrtombs.symtab0x40ca60228FUNC<unknown>DEFAULT3
                                              wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              wcsrtombs.symtab0x40ca2064FUNC<unknown>DEFAULT3
                                              wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              wildString.symtab0x401aac656FUNC<unknown>DEFAULT3
                                              write.symtab0x40796084FUNC<unknown>DEFAULT3
                                              write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                              xdigits.3043.symtab0x4153e417OBJECT<unknown>DEFAULT5
                                              zprintf.symtab0x40183c120FUNC<unknown>DEFAULT3

                                              Network Behavior

                                              Download Network PCAP: filtered – full

                                              Network Port Distribution

                                              • Total Packets: 56
                                              • • 443 (HTTPS)
                                              • • 53 (DNS)
                                              • • 23 (Telnet)
                                              TimestampSource PortDest PortSource IPDest IP
                                              Mar 27, 2025 23:05:12.741502047 CET4736223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:13.627492905 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.755445957 CET4736223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:13.799583912 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806560040 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806581974 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806613922 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806631088 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806644917 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806663990 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.806771994 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.806772947 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.806772947 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.806772947 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.806772947 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.806772947 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.807454109 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.979772091 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:13.980317116 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:13.980317116 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:14.152789116 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:14.152817011 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:14.152990103 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:14.152991056 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:14.153656006 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:14.325968027 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:14.325992107 CET4434452434.254.182.186192.168.2.15
                                              Mar 27, 2025 23:05:14.326061964 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:14.326061964 CET44524443192.168.2.1534.254.182.186
                                              Mar 27, 2025 23:05:15.771559954 CET4736223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:20.027379036 CET4736223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:28.219345093 CET4736223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:44.346987009 CET4736223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:47.778445005 CET4736423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:48.794840097 CET4736423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:50.810820103 CET4736423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:05:54.842750072 CET4736423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:03.034301043 CET4736423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:19.162188053 CET4736423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:22.814363956 CET4736623192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:23.833951950 CET4736623192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:25.850084066 CET4736623192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:29.913947105 CET4736623192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:38.105812073 CET4736623192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:54.233299971 CET4736623192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:57.855532885 CET4736823192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:06:58.873212099 CET4736823192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:00.889277935 CET4736823192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:04.985059023 CET4736823192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:13.176872015 CET4736823192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:29.304414034 CET4736823192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:32.895287037 CET4737023192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:33.912343979 CET4737023192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:35.928256989 CET4737023192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:40.056099892 CET4737023192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:07:48.247910976 CET4737023192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:04.375592947 CET4737023192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:07.935434103 CET4737223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:08.951515913 CET4737223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:10.967525005 CET4737223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:15.127441883 CET4737223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:23.319010973 CET4737223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:39.446825027 CET4737223192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:42.981980085 CET4737423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:43.990761042 CET4737423192.168.2.1594.154.34.47
                                              Mar 27, 2025 23:08:46.006620884 CET4737423192.168.2.1594.154.34.47
                                              TimestampSource PortDest PortSource IPDest IP
                                              Mar 27, 2025 23:07:58.192725897 CET4296853192.168.2.158.8.8.8
                                              Mar 27, 2025 23:07:58.192775011 CET4878253192.168.2.158.8.8.8
                                              Mar 27, 2025 23:07:58.281311989 CET53487828.8.8.8192.168.2.15
                                              Mar 27, 2025 23:07:58.281371117 CET53429688.8.8.8192.168.2.15

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Mar 27, 2025 23:07:58.192725897 CET192.168.2.158.8.8.80xdfdfStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                              Mar 27, 2025 23:07:58.192775011 CET192.168.2.158.8.8.80x55bStandard query (0)daisy.ubuntu.com28IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Mar 27, 2025 23:07:58.281371117 CET8.8.8.8192.168.2.150xdfdfNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                              Mar 27, 2025 23:07:58.281371117 CET8.8.8.8192.168.2.150xdfdfNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                              HTTPS Connections

                                              TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                              Mar 27, 2025 23:05:13.806663990 CET34.254.182.186443192.168.2.1544524CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=USCN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USSat Mar 22 09:18:05 CET 2025 Wed Mar 13 01:00:00 CET 2024Fri Jun 20 10:18:04 CEST 2025 Sat Mar 13 00:59:59 CET 2027771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2fb4726d465c5f28b84cd6d14cedd13a7
                                              CN=R10, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USWed Mar 13 01:00:00 CET 2024Sat Mar 13 00:59:59 CET 2027

                                              System Behavior

                                              General

                                              Start time (UTC):22:05:11
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:/tmp/Okami.mpsl.elf
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              File Activities

                                              Process Activities

                                              System Activities


                                              General

                                              Start time (UTC):22:05:11
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:11
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:11
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:05:46
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:06:21
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:06:56
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:07:31
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:08:07
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:08:42
                                              Start date (UTC):27/03/2025
                                              Path:/tmp/Okami.mpsl.elf
                                              Arguments:-
                                              File size:5773336 bytes
                                              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                              Process Activities

                                              Network Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.hl0c5kYX4l /tmp/tmp.53jKYi0g2M /tmp/tmp.vE0zVRMHTB
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/cat
                                              Arguments:cat /tmp/tmp.hl0c5kYX4l
                                              File size:43416 bytes
                                              MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/head
                                              Arguments:head -n 10
                                              File size:47480 bytes
                                              MD5 hash:fd96a67145172477dd57131396fc9608

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/tr
                                              Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                              File size:51544 bytes
                                              MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/cut
                                              Arguments:cut -c -80
                                              File size:47480 bytes
                                              MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/cat
                                              Arguments:cat /tmp/tmp.hl0c5kYX4l
                                              File size:43416 bytes
                                              MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/head
                                              Arguments:head -n 10
                                              File size:47480 bytes
                                              MD5 hash:fd96a67145172477dd57131396fc9608

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/tr
                                              Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                              File size:51544 bytes
                                              MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/cut
                                              Arguments:cut -c -80
                                              File size:47480 bytes
                                              MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                              File Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/dash
                                              Arguments:-
                                              File size:129816 bytes
                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                              Process Activities


                                              General

                                              Start time (UTC):22:05:13
                                              Start date (UTC):27/03/2025
                                              Path:/usr/bin/rm
                                              Arguments:rm -f /tmp/tmp.hl0c5kYX4l /tmp/tmp.53jKYi0g2M /tmp/tmp.vE0zVRMHTB
                                              File size:72056 bytes
                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                              File Activities