Loading ...

Play interactive tourEdit tour

Linux Analysis Report n2HkxWex4Y

Overview

General Information

Sample Name:n2HkxWex4Y
Analysis ID:1708418
MD5:5e11432c30783b184dc2bf27aa1728b4
SHA1:23c56da0cdddc664980705c4d14cb2579a970eed
SHA256:bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed
Infos:

Detection

SysJoker
Score:88
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected SysJoker
Antivirus detection for dropped file
Found detection on Joe Sandbox Cloud Basic
Executes the "crontab" command typically for achieving persistence
Writes ELF files to hidden directories
Executes the "ifconfig" command used to gather network information
Sample tries to persist itself using cron
Writes ELF files to disk
Creates hidden files and/or directories
Executes the "id" command, possibly to determine if the user is root or not
Executes the "grep" command used to find patterns in files or piped streams
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "uname" command used to read OS and architecture name
Executes commands using a shell command-line interpreter
Executes the "nohup" (no hangup) command used to avoid background terminal process from being killed
Executes the "rm" command used to delete files or directories

Classification

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:1708418
Start date:12.01.2022
Start time:09:28:16
Joe Sandbox Product:Cloud
Overall analysis duration:0h 5m 9s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:n2HkxWex4Y
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 88.0.1, Atril Document Viewer 1.24.0, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal88.troj.spyw.evad.lin@0/2@10/0

Process Tree

  • system is lnxubuntu20
  • n2HkxWex4Y (PID: 4665, Parent: 4577, MD5: 5e11432c30783b184dc2bf27aa1728b4) Arguments: /tmp/n2HkxWex4Y
    • sh (PID: 4666, Parent: 4665, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "id -u"
      • sh New Fork (PID: 4667, Parent: 4666)
      • id (PID: 4667, Parent: 4666, MD5: 36f29256a85dfd77d931750f1335b7ab) Arguments: id -u
    • sh (PID: 4668, Parent: 4665, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c whoami
      • sh New Fork (PID: 4669, Parent: 4668)
      • whoami (PID: 4669, Parent: 4668, MD5: dbc1888ae50bb5d4d9a7a210d51be710) Arguments: whoami
    • sh (PID: 4670, Parent: 4665, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab -l | egrep -v \"^(#|$)\" | grep -e \"@reboot (/.Library/SystemServices/updateSystem)\""
      • sh New Fork (PID: 4671, Parent: 4670)
      • crontab (PID: 4671, Parent: 4670, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
      • sh New Fork (PID: 4672, Parent: 4670)
      • egrep (PID: 4672, Parent: 4670, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: egrep -v ^(#|$)
      • grep (PID: 4672, Parent: 4670, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -E -v ^(#|$)
      • sh New Fork (PID: 4673, Parent: 4670)
      • grep (PID: 4673, Parent: 4670, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -e "@reboot (/.Library/SystemServices/updateSystem)"
    • sh (PID: 4674, Parent: 4665, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "(crontab -l; echo \"@reboot (/.Library/SystemServices/updateSystem)\") | crontab -"
      • sh New Fork (PID: 4675, Parent: 4674)
        • sh New Fork (PID: 4677, Parent: 4675)
        • crontab (PID: 4677, Parent: 4675, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
      • sh New Fork (PID: 4676, Parent: 4674)
      • crontab (PID: 4676, Parent: 4674, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -
    • sh (PID: 4678, Parent: 4665, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp -rf '/tmp/n2HkxWex4Y' '/.Library/SystemServices/updateSystem'"
      • sh New Fork (PID: 4679, Parent: 4678)
      • cp (PID: 4679, Parent: 4678, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -rf /tmp/n2HkxWex4Y /.Library/SystemServices/updateSystem
    • sh (PID: 4680, Parent: 4665, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "nohup '/.Library/SystemServices/updateSystem' >/dev/null 2>&1 &"
      • sh New Fork (PID: 4681, Parent: 4680)
      • nohup (PID: 4681, Parent: 1243, MD5: d8d3ce4d7f4b1e3ac3c3e7c9790f22ca) Arguments: nohup /.Library/SystemServices/updateSystem
      • updateSystem (PID: 4681, Parent: 1243, MD5: 5e11432c30783b184dc2bf27aa1728b4) Arguments: /.Library/SystemServices/updateSystem
        • sh (PID: 4682, Parent: 4681, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "id -u"
          • sh New Fork (PID: 4683, Parent: 4682)
          • id (PID: 4683, Parent: 4682, MD5: 36f29256a85dfd77d931750f1335b7ab) Arguments: id -u
        • sh (PID: 4684, Parent: 4681, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c whoami
          • sh New Fork (PID: 4685, Parent: 4684)
          • whoami (PID: 4685, Parent: 4684, MD5: dbc1888ae50bb5d4d9a7a210d51be710) Arguments: whoami
        • sh (PID: 4686, Parent: 4681, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab -l | egrep -v \"^(#|$)\" | grep -e \"@reboot (/.Library/SystemServices/updateSystem)\""
          • sh New Fork (PID: 4687, Parent: 4686)
          • crontab (PID: 4687, Parent: 4686, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
          • sh New Fork (PID: 4688, Parent: 4686)
          • egrep (PID: 4688, Parent: 4686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: egrep -v ^(#|$)
          • grep (PID: 4688, Parent: 4686, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -E -v ^(#|$)
          • sh New Fork (PID: 4689, Parent: 4686)
          • grep (PID: 4689, Parent: 4686, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -e "@reboot (/.Library/SystemServices/updateSystem)"
        • sh (PID: 4692, Parent: 4681, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ifconfig | grep -v 127.0.0.1 | grep -E \"inet ([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})\" | awk '{print $2}'"
          • sh New Fork (PID: 4693, Parent: 4692)
          • ifconfig (PID: 4693, Parent: 4692, MD5: 78235087bb226bccf9669e7ea95c0846) Arguments: ifconfig
          • sh New Fork (PID: 4694, Parent: 4692)
          • grep (PID: 4694, Parent: 4692, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v 127.0.0.1
          • sh New Fork (PID: 4695, Parent: 4692)
          • grep (PID: 4695, Parent: 4692, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -E "inet ([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})"
          • sh New Fork (PID: 4696, Parent: 4692)
          • awk (PID: 4696, Parent: 4692, MD5: 7e9b2ed1272331cfbd2aac2e5eb3f84b) Arguments: awk "{print $2}"
        • sh (PID: 4697, Parent: 4681, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ip address | awk '/ether/{print $2}'"
          • sh New Fork (PID: 4698, Parent: 4697)
          • ip (PID: 4698, Parent: 4697, MD5: cd92bd28c8337a4dc4e8b3433befe7e2) Arguments: ip address
          • sh New Fork (PID: 4699, Parent: 4697)
          • awk (PID: 4699, Parent: 4697, MD5: 7e9b2ed1272331cfbd2aac2e5eb3f84b) Arguments: awk "/ether/{print $2}"
        • sh (PID: 4700, Parent: 4681, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "uname -mrs"
          • sh New Fork (PID: 4701, Parent: 4700)
          • uname (PID: 4701, Parent: 4700, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -mrs
  • dash New Fork (PID: 4704, Parent: 3848)
  • rm (PID: 4704, Parent: 3848, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.tmCQ8aAViM /tmp/tmp.0iT0gDOrdn /tmp/tmp.MDmc3F197B
  • cleanup

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
n2HkxWex4YJoeSecurity_SysJokerYara detected SysJokerJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    /.Library/SystemServices/updateSystemJoeSecurity_SysJokerYara detected SysJokerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      4665.1.00000000b134ad28.0000000024a37c80.r-x.sdmpJoeSecurity_SysJokerYara detected SysJokerJoe Security
        Process Memory Space: n2HkxWex4Y PID: 4665JoeSecurity_SysJokerYara detected SysJokerJoe Security

          Jbx Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Antivirus / Scanner detection for submitted sampleShow sources
          Source: n2HkxWex4YAvira: detected
          Antivirus detection for dropped fileShow sources
          Source: /.Library/SystemServices/updateSystemAvira: detection malicious, Label: LINUX/Agent.roatu
          Source: unknownDNS traffic detected: queries for: drive.google.com
          Source: unknownNetwork traffic detected: HTTP traffic on port 56660 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 56658 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 51448
          Source: unknownNetwork traffic detected: HTTP traffic on port 56664 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 56662 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56658
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 53960
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56664
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 36204
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56660
          Source: unknownNetwork traffic detected: HTTP traffic on port 53960 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 56662
          Source: unknownNetwork traffic detected: HTTP traffic on port 51448 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 36204 -> 443
          Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
          Source: n2HkxWex4Y, updateSystem.38.drString found in binary or memory: https://drive.google.com/uc?export=download&id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu
          Source: n2HkxWex4Y, 4665.1.00000000490222b7.00000000d24e0c62.rw-.sdmpString found in binary or memory: https://drive.google.com/uc?export=download&id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu1
          Source: updateSystem.38.drString found in binary or memory: https://gcc.gnu.org/bugs

          System Summary:

          barindex
          Found detection on Joe Sandbox Cloud BasicShow sources
          Source: n2HkxWex4YJoe Sandbox Cloud Basic: Detection: malicious Score: 64Perma Link
          Source: classification engineClassification label: mal88.troj.spyw.evad.lin@0/2@10/0

          Persistence and Installation Behavior:

          barindex
          Executes the "crontab" command typically for achieving persistenceShow sources
          Source: /bin/sh (PID: 4671)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
          Source: /bin/sh (PID: 4677)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
          Source: /bin/sh (PID: 4676)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
          Source: /bin/sh (PID: 4687)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
          Writes ELF files to hidden directoriesShow sources
          Source: /usr/bin/cp (PID: 4679)File written to hidden directory: /.Library/SystemServices/updateSystemJump to dropped file
          Sample tries to persist itself using cronShow sources
          Source: /usr/bin/crontab (PID: 4676)File: /var/spool/cron/crontabs/tmp.hLiC8LJump to behavior
          Source: /usr/bin/crontab (PID: 4676)File: /var/spool/cron/crontabs/rootJump to behavior
          Source: /usr/bin/cp (PID: 4679)File written: /.Library/SystemServices/updateSystemJump to dropped file
          Source: /tmp/n2HkxWex4Y (PID: 4665)Directory: /.LibraryJump to behavior
          Source: /bin/sh (PID: 4667)Executable: /usr/bin/id -> id -uJump to behavior
          Source: /bin/sh (PID: 4683)Executable: /usr/bin/id -> id -uJump to behavior
          Source: /usr/bin/egrep (PID: 4672)Grep executable: /usr/bin/grep -> grep -E -v ^(#|$)Jump to behavior
          Source: /bin/sh (PID: 4673)Grep executable: /usr/bin/grep -> grep -e "@reboot (/.Library/SystemServices/updateSystem)"Jump to behavior
          Source: /usr/bin/egrep (PID: 4688)Grep executable: /usr/bin/grep -> grep -E -v ^(#|$)Jump to behavior
          Source: /bin/sh (PID: 4689)Grep executable: /usr/bin/grep -> grep -e "@reboot (/.Library/SystemServices/updateSystem)"Jump to behavior
          Source: /bin/sh (PID: 4694)Grep executable: /usr/bin/grep -> grep -v 127.0.0.1Jump to behavior
          Source: /bin/sh (PID: 4695)Grep executable: /usr/bin/grep -> grep -E "inet ([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})"Jump to behavior
          Source: /tmp/n2HkxWex4Y (PID: 4666)Shell command executed: sh -c "id -u"Jump to behavior
          Source: /tmp/n2HkxWex4Y (PID: 4668)Shell command executed: sh -c whoamiJump to behavior
          Source: /tmp/n2HkxWex4Y (PID: 4670)Shell command executed: sh -c "crontab -l | egrep -v \"^(#|$)\" | grep -e \"@reboot (/.Library/SystemServices/updateSystem)\""Jump to behavior
          Source: /tmp/n2HkxWex4Y (PID: 4674)Shell command executed: sh -c "(crontab -l; echo \"@reboot (/.Library/SystemServices/updateSystem)\") | crontab -"Jump to behavior
          Source: /tmp/n2HkxWex4Y (PID: 4678)Shell command executed: sh -c "cp -rf '/tmp/n2HkxWex4Y' '/.Library/SystemServices/updateSystem'"Jump to behavior
          Source: /tmp/n2HkxWex4Y (PID: 4680)Shell command executed: sh -c "nohup '/.Library/SystemServices/updateSystem' >/dev/null 2>&1 &"Jump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4682)Shell command executed: sh -c "id -u"Jump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4684)Shell command executed: sh -c whoamiJump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4686)Shell command executed: sh -c "crontab -l | egrep -v \"^(#|$)\" | grep -e \"@reboot (/.Library/SystemServices/updateSystem)\""Jump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4692)Shell command executed: sh -c "ifconfig | grep -v 127.0.0.1 | grep -E \"inet ([0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})\" | awk '{print $2}'"Jump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4697)Shell command executed: sh -c "ip address | awk '/ether/{print $2}'"Jump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4700)Shell command executed: sh -c "uname -mrs"Jump to behavior
          Source: /bin/sh (PID: 4681)Nohup executable: /usr/bin/nohup -> nohup /.Library/SystemServices/updateSystemJump to behavior
          Source: /usr/bin/dash (PID: 4704)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.tmCQ8aAViM /tmp/tmp.0iT0gDOrdn /tmp/tmp.MDmc3F197BJump to behavior
          Source: /bin/sh (PID: 4696)Awk executable: /usr/bin/awk -> awk "{print $2}"Jump to behavior
          Source: /bin/sh (PID: 4699)Awk executable: /usr/bin/awk -> awk "/ether/{print $2}"Jump to behavior
          Source: submitted sampleStderr: no crontab for rootno crontab for root: exit code = 0
          Source: /bin/sh (PID: 4667)Executable: /usr/bin/id -> id -uJump to behavior
          Source: /bin/sh (PID: 4683)Executable: /usr/bin/id -> id -uJump to behavior
          Source: /.Library/SystemServices/updateSystem (PID: 4681)Queries kernel information via 'uname': Jump to behavior
          Source: /usr/sbin/ifconfig (PID: 4693)Queries kernel information via 'uname': Jump to behavior
          Source: /usr/bin/uname (PID: 4701)Queries kernel information via 'uname': Jump to behavior

          Stealing of Sensitive Information:

          barindex
          Yara detected SysJokerShow sources
          Source: Yara matchFile source: n2HkxWex4Y, type: SAMPLE
          Source: Yara matchFile source: 4665.1.00000000b134ad28.0000000024a37c80.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: n2HkxWex4Y PID: 4665, type: MEMORYSTR
          Source: Yara matchFile source: /.Library/SystemServices/updateSystem, type: DROPPED
          Executes the "ifconfig" command used to gather network informationShow sources
          Source: /bin/sh (PID: 4693)Ifconfig executable: /usr/sbin/ifconfig -> ifconfigJump to behavior
          Source: /bin/sh (PID: 4701)Uname executable: /usr/bin/uname -> uname -mrsJump to behavior

          Remote Access Functionality:

          barindex
          Yara detected SysJokerShow sources
          Source: Yara matchFile source: n2HkxWex4Y, type: SAMPLE
          Source: Yara matchFile source: 4665.1.00000000b134ad28.0000000024a37c80.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: n2HkxWex4Y PID: 4665, type: MEMORYSTR
          Source: Yara matchFile source: /.Library/SystemServices/updateSystem, type: DROPPED

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsCommand and Scripting Interpreter1Scheduled Task/Job1Scheduled Task/Job1Scripting1OS Credential DumpingSecurity Software Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/Job1At (Linux)1At (Linux)1Hidden Files and Directories11LSASS MemorySystem Information Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsScripting1Logon Script (Windows)Logon Script (Windows)File Deletion1Security Account ManagerSystem Network Configuration Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Linux)1Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

          Malware Configuration

          No configs have been found

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1708418 Sample: n2HkxWex4Y Startdate: 12/01/2022 Architecture: LINUX Score: 88 74 graphic-updater.com 23.254.131.176, 443, 56658, 56660 HOSTWINDSUS United States 2->74 76 googlehosted.l.googleusercontent.com 142.250.185.161, 443, 51448 GOOGLEUS United States 2->76 78 3 other IPs or domains 2->78 80 Antivirus detection for dropped file 2->80 82 Antivirus / Scanner detection for submitted sample 2->82 84 Yara detected SysJoker 2->84 86 Found detection on Joe Sandbox Cloud Basic 2->86 10 n2HkxWex4Y 2->10         started        12 dash rm 2->12         started        signatures3 process4 process5 14 n2HkxWex4Y sh 10->14         started        16 n2HkxWex4Y sh 10->16         started        18 n2HkxWex4Y sh 10->18         started        20 3 other processes 10->20 process6 22 sh crontab 14->22         started        26 sh 14->26         started        28 sh nohup updateSystem 16->28         started        30 sh cp 18->30         started        32 sh crontab 20->32         started        34 sh egrep grep 20->34         started        36 sh id 20->36         started        38 2 other processes 20->38 file7 70 /var/spool/cron/crontabs/tmp.hLiC8L, ASCII 22->70 dropped 92 Sample tries to persist itself using cron 22->92 94 Executes the "crontab" command typically for achieving persistence 22->94 40 sh crontab 26->40         started        43 updateSystem sh 28->43         started        45 updateSystem sh 28->45         started        47 updateSystem sh 28->47         started        49 3 other processes 28->49 72 /.Library/SystemServices/updateSystem, ELF 30->72 dropped 96 Writes ELF files to hidden directories 30->96 signatures8 process9 signatures10 98 Executes the "crontab" command typically for achieving persistence 40->98 51 sh crontab 43->51         started        54 sh egrep grep 43->54         started        56 sh grep 43->56         started        58 sh ifconfig 45->58         started        66 3 other processes 45->66 68 2 other processes 47->68 60 sh id 49->60         started        62 sh whoami 49->62         started        64 sh uname 49->64         started        process11 signatures12 88 Executes the "crontab" command typically for achieving persistence 51->88 90 Executes the "ifconfig" command used to gather network information 58->90

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          n2HkxWex4Y100%AviraLINUX/Agent.roatu

          Dropped Files

          SourceDetectionScannerLabelLink
          /.Library/SystemServices/updateSystem100%AviraLINUX/Agent.roatu

          Domains

          No Antivirus matches

          URLs

          No Antivirus matches

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          graphic-updater.com
          23.254.131.176
          truefalse
            unknown
            drive.google.com
            172.217.16.142
            truefalse
              high
              googlehosted.l.googleusercontent.com
              142.250.185.161
              truefalse
                high
                doc-0k-2o-docs.googleusercontent.com
                unknown
                unknownfalse
                  high

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  https://gcc.gnu.org/bugsupdateSystem.38.drfalse
                    high

                    Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public

                    IPDomainCountryFlagASNASN NameMalicious
                    23.254.131.176
                    graphic-updater.comUnited States
                    54290HOSTWINDSUSfalse
                    142.250.185.161
                    googlehosted.l.googleusercontent.comUnited States
                    15169GOOGLEUSfalse
                    34.243.160.129
                    unknownUnited States
                    16509AMAZON-02USfalse
                    172.217.16.142
                    drive.google.comUnited States
                    15169GOOGLEUSfalse


                    Runtime Messages

                    Command:/tmp/n2HkxWex4Y
                    Exit Code:0
                    Exit Code Info:
                    Killed:False
                    Standard Output:
                    (crontab -l; echo '@reboot (/.Library/SystemServices/updateSystem)') | crontab -
                    Standard Error:no crontab for root
                    no crontab for root

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    23.254.131.176JGJ5oOtOKbGet hashmaliciousBrowse
                      psO5Q4nOUGGet hashmaliciousBrowse
                        IGFXCUISERVICE.exeGet hashmaliciousBrowse
                          #SysJoker_n2.exeGet hashmaliciousBrowse
                            IGFXCUISERVICE.EXEGet hashmaliciousBrowse
                              867SzVr2XaGet hashmaliciousBrowse

                                Domains

                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                graphic-updater.comJGJ5oOtOKbGet hashmaliciousBrowse
                                • 23.254.131.176
                                psO5Q4nOUGGet hashmaliciousBrowse
                                • 23.254.131.176
                                IGFXCUISERVICE.exeGet hashmaliciousBrowse
                                • 23.254.131.176
                                #SysJoker_n2.exeGet hashmaliciousBrowse
                                • 23.254.131.176
                                IGFXCUISERVICE.EXEGet hashmaliciousBrowse
                                • 23.254.131.176
                                867SzVr2XaGet hashmaliciousBrowse
                                • 23.254.131.176

                                ASN

                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                AMAZON-02USn3at.x86Get hashmaliciousBrowse
                                • 34.249.145.219
                                jerusalem.x86Get hashmaliciousBrowse
                                • 44.241.179.162
                                SecuriteInfo.com.Heur.23002.xlsmGet hashmaliciousBrowse
                                • 13.58.205.142
                                SecuriteInfo.com.Heur.11449.xlsmGet hashmaliciousBrowse
                                • 13.58.205.142
                                SecuriteInfo.com.Heur.21286.xlsmGet hashmaliciousBrowse
                                • 13.58.205.142
                                BANK DETAILS AND INVOICE TO RECONFIRM.exeGet hashmaliciousBrowse
                                • 3.130.204.160
                                SecuriteInfo.com.Heur.31523.xlsmGet hashmaliciousBrowse
                                • 13.58.205.142
                                gx86Get hashmaliciousBrowse
                                • 13.121.76.6
                                garm7Get hashmaliciousBrowse
                                • 54.171.230.55
                                6E52D162BAF265E070EC1A3147AD651D8BD8481D96B33.exeGet hashmaliciousBrowse
                                • 52.218.25.40
                                https://cluodm.us/login/#BARBARA.MORGAN@AIRCANADA.CAGet hashmaliciousBrowse
                                • 13.32.121.17
                                psO5Q4nOUGGet hashmaliciousBrowse
                                • 54.171.230.55
                                7zip.exeGet hashmaliciousBrowse
                                • 3.140.13.188
                                SecuriteInfo.com.Heur.18407.xlsmGet hashmaliciousBrowse
                                • 13.58.205.142
                                SecuriteInfo.com.Heur.7584.xlsmGet hashmaliciousBrowse
                                • 13.58.205.142
                                https://app.evalandgo.com/s/index.php?id=JTk5bCU5QW4lOUUlQTk=&a=JTk4aSU5OW4lOTklQUQ=Get hashmaliciousBrowse
                                • 13.224.96.114
                                wbFIuLI8b7Get hashmaliciousBrowse
                                • 34.249.145.219
                                Sj3sjFWRJa.msiGet hashmaliciousBrowse
                                • 52.67.194.250
                                klveP0L6XDGet hashmaliciousBrowse
                                • 34.249.145.219
                                ZbIfBGPTv5Get hashmaliciousBrowse
                                • 54.171.230.55
                                HOSTWINDSUSJGJ5oOtOKbGet hashmaliciousBrowse
                                • 23.254.131.176
                                psO5Q4nOUGGet hashmaliciousBrowse
                                • 23.254.131.176
                                #U266c secured VM.5647.htmlGet hashmaliciousBrowse
                                • 142.11.222.100
                                IGFXCUISERVICE.exeGet hashmaliciousBrowse
                                • 23.254.131.176
                                #SysJoker_n2.exeGet hashmaliciousBrowse
                                • 23.254.131.176
                                IGFXCUISERVICE.EXEGet hashmaliciousBrowse
                                • 23.254.131.176
                                867SzVr2XaGet hashmaliciousBrowse
                                • 23.254.131.176
                                g6GVx95dFk.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                8ILODCNOM4.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                YjC8YtL5mm.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                AbT54oXloS.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                Pxo6lJ3ixn.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                a5yyNUUUOO.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                1ZXtQq89bt.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                QBPQKYk3Ky.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                drjueN3vt8.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                gxMhx1QlJK.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                G7R312DEIB.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                ZGuKtur9Jp.xlsGet hashmaliciousBrowse
                                • 104.168.155.129
                                lZR3iVCFtP.xlsGet hashmaliciousBrowse
                                • 104.168.155.129

                                JA3 Fingerprints

                                No context

                                Dropped Files

                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                /.Library/SystemServices/updateSystempsO5Q4nOUGGet hashmaliciousBrowse
                                  867SzVr2XaGet hashmaliciousBrowse

                                    Created / dropped Files

                                    /.Library/SystemServices/updateSystem
                                    Process:/usr/bin/cp
                                    File Type:ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=dfbc50eadb8baef274f11c0276302be5ad2347eb, not stripped
                                    Category:dropped
                                    Size (bytes):865144
                                    Entropy (8bit):6.310586919040449
                                    Encrypted:false
                                    SSDEEP:24576:170drUZ5Z48iZVdjajDA0KNZmHEW4qNJt:176sZ48iZVdjajDA0KNZmHEW4q3t
                                    MD5:5E11432C30783B184DC2BF27AA1728B4
                                    SHA1:23C56DA0CDDDC664980705C4D14CB2579A970EED
                                    SHA-256:BD0141E88A0D56B508BC52DB4DAB68A49B6027A486E4D9514EC0DB006FE71EED
                                    SHA-512:E0F434B1515F92C9E57A623C634E1D8A6AE99D1174285FD1FD796634778D02F0F7AD9A19F85BA280BF7C20263EAD868D606430AA7270CC4E53C497C3A468B16E
                                    Malicious:true
                                    Yara Hits:
                                    • Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: /.Library/SystemServices/updateSystem, Author: Joe Security
                                    Antivirus:
                                    • Antivirus: Avira, Detection: 100%
                                    Joe Sandbox View:
                                    • Filename: psO5Q4nOUG, Detection: malicious, Browse
                                    • Filename: 867SzVr2Xa, Detection: malicious, Browse
                                    Reputation:low
                                    Preview: .ELF..............>.....\.@.....@........+..........@.8...@.............@.......@.@.....@.@.....................................8.......8.@.....8.@...............................................@.......@....................... .......................h.......h.............p......... .......................h.......h.....................................T.......T.@.....T.@.....D.......D...............P.td.....b.......bF......bF......C.......C..............Q.td....................................................R.td..............h.......h..... ....... .............../lib64/ld-linux-x86-64.so.2.............GNU............. ...............GNU..P....t...v0+.#G.a...................b... ...A0.. @...@...H.......GR.)c......H...$"`.......n1.. .PD...J...P..d.UH..A.P.....0.....*.U.......$.B........t!..%_S.'P.................................................................................................................................................................................................
                                    /var/spool/cron/crontabs/tmp.hLiC8L
                                    Process:/usr/bin/crontab
                                    File Type:ASCII text
                                    Category:dropped
                                    Size (bytes):223
                                    Entropy (8bit):5.163291250470382
                                    Encrypted:false
                                    SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQ5pVcpSGMQ5UYLtCFt3HY+AyBEv:8QjHig8r2KeHLUHY+ARv
                                    MD5:70CA6D11E21328C285E303733FE324BB
                                    SHA1:E15200A138A1EED02A59859D4044C93C782557DE
                                    SHA-256:127AECFB7C75E7DD0CE81BB2E931D1906991AAB708C93D07E4DFA337763B5C05
                                    SHA-512:8F80DA7482A67999E1228A2BBA4AC35E3D6AFB133409C26A60F1F58BA3E21D93226C5763640A3996723FE042E41110E64CF07692377B76296D0EDF153C8387ED
                                    Malicious:true
                                    Reputation:low
                                    Preview: # DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Wed Jan 12 09:29:34 2022).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@reboot (/.Library/SystemServices/updateSystem).

                                    Static File Info

                                    General

                                    File type:ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=dfbc50eadb8baef274f11c0276302be5ad2347eb, not stripped
                                    Entropy (8bit):6.310586919040449
                                    TrID:
                                    • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                    • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                    File name:n2HkxWex4Y
                                    File size:865144
                                    MD5:5e11432c30783b184dc2bf27aa1728b4
                                    SHA1:23c56da0cdddc664980705c4d14cb2579a970eed
                                    SHA256:bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed
                                    SHA512:e0f434b1515f92c9e57a623c634e1d8a6ae99d1174285fd1fd796634778d02f0f7ad9a19f85ba280bf7c20263ead868d606430aa7270cc4e53c497c3a468b16e
                                    SSDEEP:24576:170drUZ5Z48iZVdjajDA0KNZmHEW4qNJt:176sZ48iZVdjajDA0KNZmHEW4q3t
                                    File Content Preview:.ELF..............>.....\.@.....@........+..........@.8...@.............@.......@.@.....@.@.....................................8.......8.@.....8.@...............................................@.......@....................... .......................h....

                                    Static ELF Info

                                    ELF header

                                    Class:ELF64
                                    Data:2's complement, little endian
                                    Version:1 (current)
                                    Machine:Advanced Micro Devices X86-64
                                    Version Number:0x1
                                    Type:EXEC (Executable file)
                                    OS/ABI:UNIX - Linux
                                    ABI Version:0
                                    Entry Point Address:0x40835c
                                    Flags:0x0
                                    ELF Header Size:64
                                    Program Header Offset:64
                                    Program Header Size:56
                                    Number of Program Headers:9
                                    Section Header Offset:863160
                                    Section Header Size:64
                                    Number of Section Headers:31
                                    Header String Table Index:30

                                    Sections

                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                    NULL0x00x00x00x00x0000
                                    .interpPROGBITS0x4002380x2380x1c0x00x2A001
                                    .note.ABI-tagNOTE0x4002540x2540x200x00x2A004
                                    .note.gnu.build-idNOTE0x4002740x2740x240x00x2A004
                                    .gnu.hashGNU_HASH0x4002980x2980x40c0x00x2A508
                                    .dynsymDYNSYM0x4006a80x6a80x1b600x180x2A618
                                    .dynstrSTRTAB0x4022080x22080x1c110x00x2A001
                                    .gnu.versionVERSYM0x403e1a0x3e1a0x2480x20x2A502
                                    .gnu.version_rVERNEED0x4040680x40680x1000x00x2A638
                                    .rela.dynRELA0x4041680x41680x6f00x180x2A508
                                    .rela.pltRELA0x4048580x48580xca80x180x42AI5248
                                    .initPROGBITS0x4055000x55000x1a0x00x6AX004
                                    .pltPROGBITS0x4055200x55200x8800x100x6AX0016
                                    .textPROGBITS0x405da00x5da00x588120x00x6AX0016
                                    .finiPROGBITS0x45e5b40x5e5b40x90x00x6AX004
                                    .rodataPROGBITS0x45e5c00x5e5c00x7cc00x00x2A0032
                                    .eh_frame_hdrPROGBITS0x4662800x662800x43040x00x2A004
                                    .eh_framePROGBITS0x46a5880x6a5880x13a600x00x2A008
                                    .gcc_except_tablePROGBITS0x47dfe80x7dfe80x30b10x00x2A004
                                    .init_arrayINIT_ARRAY0x6811e00x811e00x180x80x3WA008
                                    .fini_arrayFINI_ARRAY0x6811f80x811f80x80x80x3WA008
                                    .data.rel.roPROGBITS0x6812000x812000xb180x00x3WA0032
                                    .dynamicDYNAMIC0x681d180x81d180x2100x100x3WA608
                                    .gotPROGBITS0x681f280x81f280xd80x80x3WA008
                                    .got.pltPROGBITS0x6820000x820000x4500x80x3WA008
                                    .dataPROGBITS0x6824500x824500x300x00x3WA008
                                    .bssNOBITS0x6824800x824800x2d00x00x3WA0032
                                    .commentPROGBITS0x00x824800x590x10x30MS001
                                    .symtabSYMTAB0x00x824e00x11b200x180x0293568
                                    .strtabSTRTAB0x00x940000x3ea910x00x0001
                                    .shstrtabSTRTAB0x00xd2a910x1220x00x0001

                                    Program Segments

                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                    PHDR0x400x4000400x4000400x1f80x1f81.75580x4R 0x8
                                    INTERP0x2380x4002380x4002380x1c0x1c3.94080x4R 0x1/lib64/ld-linux-x86-64.so.2.interp
                                    LOAD0x00x4000000x4000000x810990x810993.68240x5R E0x200000.interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame .gcc_except_table
                                    LOAD0x811e00x6811e00x6811e00x12a00x15701.68330x6RW 0x200000.init_array .fini_array .data.rel.ro .dynamic .got .got.plt .data .bss
                                    DYNAMIC0x81d180x681d180x681d180x2100x2101.28630x6RW 0x8.dynamic
                                    NOTE0x2540x4002540x4002540x440x442.46710x4R 0x4.note.ABI-tag .note.gnu.build-id
                                    GNU_EH_FRAME0x662800x4662800x4662800x43040x43042.91910x4R 0x4.eh_frame_hdr
                                    GNU_STACK0x00x00x00x00x00.00000x6RW 0x10
                                    GNU_RELRO0x811e00x6811e00x6811e00xe200xe201.39340x4R 0x1.init_array .fini_array .data.rel.ro .dynamic .got

                                    Dynamic Tags

                                    TypeMetaValueTag
                                    DT_NEEDEDsharedliblibcurl.so.40x1
                                    DT_NEEDEDsharedliblibstdc++.so.60x1
                                    DT_NEEDEDsharedliblibm.so.60x1
                                    DT_NEEDEDsharedliblibgcc_s.so.10x1
                                    DT_NEEDEDsharedliblibc.so.60x1
                                    DT_INITvalue0x4055000xc
                                    DT_FINIvalue0x45e5b40xd
                                    DT_INIT_ARRAYvalue0x6811e00x19
                                    DT_INIT_ARRAYSZbytes240x1b
                                    DT_FINI_ARRAYvalue0x6811f80x1a
                                    DT_FINI_ARRAYSZbytes80x1c
                                    DT_GNU_HASHvalue0x4002980x6ffffef5
                                    DT_STRTABvalue0x4022080x5
                                    DT_SYMTABvalue0x4006a80x6
                                    DT_STRSZbytes71850xa
                                    DT_SYMENTbytes240xb
                                    DT_DEBUGvalue0x00x15
                                    DT_PLTGOTvalue0x6820000x3
                                    DT_PLTRELSZbytes32400x2
                                    DT_PLTRELpltrelDT_RELA0x14
                                    DT_JMPRELvalue0x4048580x17
                                    DT_RELAvalue0x4041680x7
                                    DT_RELASZbytes17760x8
                                    DT_RELAENTbytes240x9
                                    DT_VERNEEDvalue0x4040680x6ffffffe
                                    DT_VERNEEDNUMvalue30x6fffffff
                                    DT_VERSYMvalue0x403e1a0x6ffffff0
                                    DT_NULLvalue0x00x0

                                    Symbols

                                    NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                    .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ITM_RU1.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ITM_RU8.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ITM_addUserCommitAction.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ITM_memcpyRnWt.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ITM_memcpyRtWn.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _Unwind_ResumeGCC_3.0libgcc_s.so.1.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZGTtdlPv.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ZGTtnam.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _ZNKSs11_M_disjunctEPKc.dynsym0x41152c128FUNC<unknown>DEFAULT13
                                    _ZNKSs13get_allocatorEv.dynsym0x41022c41FUNC<unknown>DEFAULT13
                                    _ZNKSs15_M_check_lengthEmmPKc.dynsym0x4114cc96FUNC<unknown>DEFAULT13
                                    _ZNKSs16find_last_not_ofEPKcm.dynsym0x40f60657FUNC<unknown>DEFAULT13
                                    _ZNKSs16find_last_not_ofEPKcmm.dynsym0x411884165FUNC<unknown>DEFAULT13
                                    _ZNKSs3endEv.dynsym0x41105677FUNC<unknown>DEFAULT13
                                    _ZNKSs4_Rep12_M_is_leakedEv.dynsym0x4115f623FUNC<unknown>DEFAULT13
                                    _ZNKSs4_Rep12_M_is_sharedEv.dynsym0x4113ca25FUNC<unknown>DEFAULT13
                                    _ZNKSs4dataEv.dynsym0x40e80226FUNC<unknown>DEFAULT13
                                    _ZNKSs4sizeEv.dynsym0x40ebf429FUNC<unknown>DEFAULT13
                                    _ZNKSs5beginEv.dynsym0x40ec1253FUNC<unknown>DEFAULT13
                                    _ZNKSs5c_strEv.dynsym0x40e5f626FUNC<unknown>DEFAULT13
                                    _ZNKSs5emptyEv.dynsym0x40ed3e32FUNC<unknown>DEFAULT13
                                    _ZNKSs6_M_repEv.dynsym0x41020e30FUNC<unknown>DEFAULT13
                                    _ZNKSs6lengthEv.dynsym0x40e81c29FUNC<unknown>DEFAULT13
                                    _ZNKSs6rbeginEv.dynsym0x40eccc52FUNC<unknown>DEFAULT13
                                    _ZNKSs7_M_dataEv.dynsym0x4101aa17FUNC<unknown>DEFAULT13
                                    _ZNKSs7_M_iendEv.dynsym0x41166e77FUNC<unknown>DEFAULT13
                                    _ZNKSs7compareEPKc.dynsym0x411bae144FUNC<unknown>DEFAULT13
                                    _ZNKSs7compareERKSs.dynsym0x40fcd4164FUNC<unknown>DEFAULT13
                                    _ZNKSs8_M_checkEmPKc.dynsym0x41178a90FUNC<unknown>DEFAULT13
                                    _ZNKSs8_M_limitEmm.dynsym0x411b6276FUNC<unknown>DEFAULT13
                                    _ZNKSs8capacityEv.dynsym0x41034a30FUNC<unknown>DEFAULT13
                                    _ZNKSs8max_sizeEv.dynsym0x41426c20FUNC<unknown>DEFAULT13
                                    _ZNKSs9_M_ibeginEv.dynsym0x41163853FUNC<unknown>DEFAULT13
                                    _ZNKSt12__basic_fileIcE7is_openEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNKSt13runtime_error4whatEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSaIcEC1ERKS_GLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSaIcEC1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSaIcEC2ERKS_GLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSaIcEC2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSaIcED1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSaIcED2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSbIwSt11char_traitsIwESaIwEE12_M_leak_hardEv.dynsym0x43f13081FUNC<unknown>DEFAULT13
                                    _ZNSbIwSt11char_traitsIwESaIwEE4_Rep20_S_empty_rep_storageEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZNSbIwSt11char_traitsIwESaIwEE4_Rep9_S_createEmmRKS1_.dynsym0x43ee70150FUNC<unknown>DEFAULT13
                                    _ZNSbIwSt11char_traitsIwESaIwEE6appendEmw.dynsym0x43f4c0185FUNC<unknown>DEFAULT13
                                    _ZNSbIwSt11char_traitsIwESaIwEE6resizeEmw.dynsym0x43f58069FUNC<unknown>DEFAULT13
                                    _ZNSbIwSt11char_traitsIwESaIwEE7reserveEm.dynsym0x43f390304FUNC<unknown>DEFAULT13
                                    _ZNSbIwSt11char_traitsIwESaIwEE9_M_mutateEmmm.dynsym0x43ef10537FUNC<unknown>DEFAULT13
                                    _ZNSo5flushEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSo5writeEPKclGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSolsEPSt15basic_streambufIcSt11char_traitsIcEEGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSs10_S_compareEmm.dynsym0x41280664FUNC<unknown>DEFAULT13
                                    _ZNSs12_Alloc_hiderC1EPcRKSaIcE.dynsym0x4102e053FUNC<unknown>DEFAULT13
                                    _ZNSs12_Alloc_hiderC2EPcRKSaIcE.dynsym0x4102e053FUNC<unknown>DEFAULT13
                                    _ZNSs12_M_leak_hardEv.dynsym0x4140ec124FUNC<unknown>DEFAULT13
                                    _ZNSs12_S_constructIN9__gnu_cxx17__normal_iteratorIPcSsEEEES2_T_S4_RKSaIcESt20forward_iterator_tag.dynsym0x4214f6331FUNC<unknown>DEFAULT13
                                    _ZNSs12_S_constructIPKcEEPcT_S3_RKSaIcESt20forward_iterator_tag.dynsym0x418da8305FUNC<unknown>DEFAULT13
                                    _ZNSs12_S_constructIPcEES0_T_S1_RKSaIcESt20forward_iterator_tag.dynsym0x41c532305FUNC<unknown>DEFAULT13
                                    _ZNSs12_S_empty_repEv.dynsym0x41117011FUNC<unknown>DEFAULT13
                                    _ZNSs13_S_copy_charsEPcN9__gnu_cxx17__normal_iteratorIS_SsEES2_.dynsym0x424f4c77FUNC<unknown>DEFAULT13
                                    _ZNSs13_S_copy_charsEPcPKcS1_.dynsym0x41c68b53FUNC<unknown>DEFAULT13
                                    _ZNSs13_S_copy_charsEPcS_S_.dynsym0x4238bc53FUNC<unknown>DEFAULT13
                                    _ZNSs15_M_replace_safeEmmPKcm.dynsym0x418eda107FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep10_M_destroyERKSaIcE.dynsym0x412e4c89FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep10_M_disposeERKSaIcE.dynsym0x41025693FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep10_M_refcopyEv.dynsym0x41421872FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep10_M_refdataEv.dynsym0x41117c18FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep11_S_terminalE.dynsym0x4652fd1OBJECT<unknown>DEFAULT15
                                    _ZNSs4_Rep12_S_empty_repEv.dynsym0x412e3918FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep13_M_set_leakedEv.dynsym0x41acea22FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep15_M_set_sharableEv.dynsym0x41160e22FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep20_S_empty_rep_storageEGLIBCXX_3.4libstdc++.so.6.dynsym0x68248032OBJECT<unknown>DEFAULT26
                                    _ZNSs4_Rep26_M_set_length_and_sharableEm.dynsym0x4113e4102FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep7_M_grabERKSaIcES2_.dynsym0x41144a102FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep8_M_cloneERKSaIcEm.dynsym0x413118175FUNC<unknown>DEFAULT13
                                    _ZNSs4_Rep9_S_createEmmRKSaIcE.dynsym0x4143e4358FUNC<unknown>DEFAULT13
                                    _ZNSs4swapERSs.dynsym0x40f23a580FUNC<unknown>DEFAULT13
                                    _ZNSs5clearEv.dynsym0x40ef02164FUNC<unknown>DEFAULT13
                                    _ZNSs5eraseEmm.dynsym0x40f640105FUNC<unknown>DEFAULT13
                                    _ZNSs6appendEPKc.dynsym0x41031652FUNC<unknown>DEFAULT13
                                    _ZNSs6appendEPKcm.dynsym0x40f0de348FUNC<unknown>DEFAULT13
                                    _ZNSs6appendERKSs.dynsym0x4103aa256FUNC<unknown>DEFAULT13
                                    _ZNSs6appendEmc.dynsym0x413fe8259FUNC<unknown>DEFAULT13
                                    _ZNSs6assignEPKc.dynsym0x4127d252FUNC<unknown>DEFAULT13
                                    _ZNSs6assignEPKcm.dynsym0x417e38322FUNC<unknown>DEFAULT13
                                    _ZNSs6assignERKSs.dynsym0x4111ca258FUNC<unknown>DEFAULT13
                                    _ZNSs6insertEmPKc.dynsym0x4104aa57FUNC<unknown>DEFAULT13
                                    _ZNSs6insertEmPKcm.dynsym0x412f54451FUNC<unknown>DEFAULT13
                                    _ZNSs6insertEmRKSs.dynsym0x41036865FUNC<unknown>DEFAULT13
                                    _ZNSs6insertEmRKSsmm.dynsym0x412ed4128FUNC<unknown>DEFAULT13
                                    _ZNSs6resizeEm.dynsym0x40ebc843FUNC<unknown>DEFAULT13
                                    _ZNSs6resizeEmc.dynsym0x410f72143FUNC<unknown>DEFAULT13
                                    _ZNSs7_M_copyEPcPKcm.dynsym0x4115ac74FUNC<unknown>DEFAULT13
                                    _ZNSs7_M_dataEPc.dynsym0x4111aa32FUNC<unknown>DEFAULT13
                                    _ZNSs7_M_leakEv.dynsym0x41102054FUNC<unknown>DEFAULT13
                                    _ZNSs7_M_moveEPcPKcm.dynsym0x41454a74FUNC<unknown>DEFAULT13
                                    _ZNSs7reserveEm.dynsym0x4104e4293FUNC<unknown>DEFAULT13
                                    _ZNSs9_M_assignEPcmc.dynsym0x41ac9b78FUNC<unknown>DEFAULT13
                                    _ZNSs9_M_mutateEmmm.dynsym0x41192a567FUNC<unknown>DEFAULT13
                                    _ZNSs9push_backEc.dynsym0x411302199FUNC<unknown>DEFAULT13
                                    _ZNSsC1EOSs.dynsym0x40ee4669FUNC<unknown>DEFAULT13
                                    _ZNSsC1EPKcRKSaIcE.dynsym0x40eaaa112FUNC<unknown>DEFAULT13
                                    _ZNSsC1EPKcmRKSaIcEGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSsC1ERKSs.dynsym0x40efa6232FUNC<unknown>DEFAULT13
                                    _ZNSsC1ERKSsmm.dynsym0x43ad00166FUNC<unknown>DEFAULT13
                                    _ZNSsC1Ev.dynsym0x40eda283FUNC<unknown>DEFAULT13
                                    _ZNSsC1IN9__gnu_cxx17__normal_iteratorIPcSsEEEET_S4_RKSaIcE.dynsym0x4116bc81FUNC<unknown>DEFAULT13
                                    _ZNSsC1IPKcEET_S2_RKSaIcE.dynsym0x41adb281FUNC<unknown>DEFAULT13
                                    _ZNSsC1IPcEET_S1_RKSaIcE.dynsym0x4101bc81FUNC<unknown>DEFAULT13
                                    _ZNSsC2EOSs.dynsym0x40ee4669FUNC<unknown>DEFAULT13
                                    _ZNSsC2EPKcRKSaIcE.dynsym0x40eaaa112FUNC<unknown>DEFAULT13
                                    _ZNSsC2ERKSs.dynsym0x40efa6232FUNC<unknown>DEFAULT13
                                    _ZNSsC2ERKSsmm.dynsym0x43ad00166FUNC<unknown>DEFAULT13
                                    _ZNSsC2Ev.dynsym0x40eda283FUNC<unknown>DEFAULT13
                                    _ZNSsC2IN9__gnu_cxx17__normal_iteratorIPcSsEEEET_S4_RKSaIcE.dynsym0x4116bc81FUNC<unknown>DEFAULT13
                                    _ZNSsC2IPKcEET_S2_RKSaIcE.dynsym0x41adb281FUNC<unknown>DEFAULT13
                                    _ZNSsC2IPcEET_S1_RKSaIcE.dynsym0x4101bc81FUNC<unknown>DEFAULT13
                                    _ZNSsD1Ev.dynsym0x40e7a494FUNC<unknown>DEFAULT13
                                    _ZNSsD2Ev.dynsym0x40e7a494FUNC<unknown>DEFAULT13
                                    _ZNSsaSEOSs.dynsym0x40f08e41FUNC<unknown>DEFAULT13
                                    _ZNSsaSEPKc.dynsym0x40fcae37FUNC<unknown>DEFAULT13
                                    _ZNSsaSERKSs.dynsym0x40ee8c37FUNC<unknown>DEFAULT13
                                    _ZNSsixEm.dynsym0x40ec9852FUNC<unknown>DEFAULT13
                                    _ZNSspLEPKc.dynsym0x40f0b837FUNC<unknown>DEFAULT13
                                    _ZNSspLERKSs.dynsym0x40eedc37FUNC<unknown>DEFAULT13
                                    _ZNSspLEc.dynsym0x40eeb241FUNC<unknown>DEFAULT13
                                    _ZNSt11logic_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt11range_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12__basic_fileIcE8sys_openEiSt13_Ios_OpenmodeGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12__basic_fileIcED1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12domain_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12length_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12out_of_rangeD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12system_errorD1EvGLIBCXX_3.4.11libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt12system_errorD2EvGLIBCXX_3.4.11libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE27_M_allocate_internal_bufferEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE4syncEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE5closeEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE5imbueERKSt6localeGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE6setbufEPclGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE6xsgetnEPclGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE6xsputnEPKclGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE7seekoffElSt12_Ios_SeekdirSt13_Ios_OpenmodeGLIBCXX_3.4libstdc++.so.6.dynsym0x4057e00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE7seekposESt4fposI11__mbstate_tESt13_Ios_OpenmodeGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE8overflowEiGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE9pbackfailEiGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE9showmanycEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEE9underflowEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEEC2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13basic_filebufIcSt11char_traitsIcEED2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13runtime_errorC2ERKSsGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt13runtime_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x4059d00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1ERKSsSt13_Ios_OpenmodeGLIBCXX_3.4.13libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt14basic_ofstreamIcSt11char_traitsIcEED1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt14overflow_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt15basic_streambufIcSt11char_traitsIcEE5uflowEvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt15underflow_errorD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt16invalid_argumentD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt6locale5facetD2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt6localeD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt7codecvtIwc11__mbstate_tEC2EmGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt7codecvtIwc11__mbstate_tED2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt8ios_base4InitC1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt8ios_base4InitD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x405d900FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt8ios_baseC2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt8ios_baseD2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_EGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt9exceptionD1EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZNSt9exceptionD2EvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt11_Hash_bytesPKvmmCXXABI_1.3.5libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt17__throw_bad_allocvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_baseGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_baseGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt19__throw_logic_errorPKcGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt20__throw_length_errorPKcGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt25__throw_bad_function_callvGLIBCXX_3.4.14libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_GLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_GLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt4cerrGLIBCXX_3.4libstdc++.so.6.dynsym0x6825c0272OBJECT<unknown>DEFAULT26
                                    _ZSt4coutGLIBCXX_3.4libstdc++.so.6.dynsym0x6824a0272OBJECT<unknown>DEFAULT26
                                    _ZSt9terminatevGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZSt9use_facetISt7codecvtIwc11__mbstate_tEERKT_RKSt6localeGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKcGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_cGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKSbIS4_S5_T1_EGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZStplIcSt11char_traitsIcESaIcEESbIT_T0_T1_EPKS3_RKS6_.dynsym0x40e9bc167FUNC<unknown>DEFAULT13
                                    _ZTIN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEE.dynsym0x6813a824OBJECT<unknown>DEFAULT21
                                    _ZTINSt6locale5facetEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTISt11logic_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTISt12out_of_rangeGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTISt12system_errorGLIBCXX_3.4.11libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTISt13basic_filebufIcSt11char_traitsIcEEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTISt13runtime_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x6812e024OBJECT<unknown>DEFAULT21
                                    _ZTISt7codecvtIwc11__mbstate_tEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTISt9exceptionGLIBCXX_3.4libstdc++.so.6.dynsym0x6812d016OBJECT<unknown>DEFAULT21
                                    _ZTSN9__gnu_cxx13stdio_filebufIcSt11char_traitsIcEEE.dynsym0x46584049OBJECT<unknown>DEFAULT15
                                    _ZTVN10__cxxabiv117__class_type_infoECXXABI_1.3libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVN10__cxxabiv120__si_class_type_infoECXXABI_1.3libstdc++.so.6.dynsym0x68124088OBJECT<unknown>DEFAULT21
                                    _ZTVN10__cxxabiv121__vmi_class_type_infoECXXABI_1.3libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSoGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt11logic_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt11range_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt12domain_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt12length_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt12out_of_rangeGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt12system_errorGLIBCXX_3.4.11libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt13basic_filebufIcSt11char_traitsIcEEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt13runtime_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x6812a040OBJECT<unknown>DEFAULT21
                                    _ZTVSt14overflow_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt15basic_streambufIcSt11char_traitsIcEEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt15underflow_errorGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt16invalid_argumentGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt9basic_iosIcSt11char_traitsIcEEGLIBCXX_3.4libstdc++.so.6.dynsym0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _ZTVSt9exceptionGLIBCXX_3.4libstdc++.so.6.dynsym0x68120040OBJECT<unknown>DEFAULT21
                                    _ZdlPvGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _ZnwmGLIBCXX_3.4libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __assert_failGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __bss_start.dynsym0x6824800NOTYPE<unknown>DEFAULT26
                                    __cxa_allocate_exceptionCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_atexitGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_begin_catchCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_end_catchCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_free_exceptionCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_get_exception_ptrCXXABI_1.3.1libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_pure_virtualCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_rethrowCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __cxa_throwCXXABI_1.3libstdc++.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __errno_locationGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __gmon_start__.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    __gxx_personality_v0CXXABI_1.3libstdc++.so.6.dynsym0x405c800FUNC<unknown>DEFAULTSHN_UNDEF
                                    __libc_start_mainGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __lxstatGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __pthread_key_create.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __stack_chk_failGLIBC_2.4libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __xstatGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    _edata.dynsym0x6824800NOTYPE<unknown>DEFAULT25
                                    _end.dynsym0x6827500NOTYPE<unknown>DEFAULT26
                                    _fini.dynsym0x45e5b40FUNC<unknown>DEFAULT14
                                    _init.dynsym0x4055000FUNC<unknown>DEFAULT11
                                    chdirGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    closeGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    closedirGLIBC_2.2.5libc.so.6.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    curl_easy_cleanup.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    curl_easy_getinfo.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    curl_easy_init.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    curl_easy_perform.dynsym0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    curl_easy_setopt</