Edit tour

Linux Analysis Report
sMmzRMu1P6.elf

Overview

General Information

Sample name:	sMmzRMu1P6.elf renamed because original name is a hash value
Original sample name:	38e8a7ad78afc948164bae1f1cbbcd26.elf
Analysis ID:	1427653
MD5:	38e8a7ad78afc948164bae1f1cbbcd26
SHA1:	b363ce25f3cf549544252cc51122d8bbbcc9b8f0
SHA256:	cba079fbaa1ebedbb75d9c0dc4e013c63c7ff0a62aac7dde7cb605a4324b5d56
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Performs DNS queries to domains with low reputation

Queries the IP of a very long domain name

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427653
Start date and time:	2024-04-17 23:12:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sMmzRMu1P6.elf renamed because original name is a hash value
Original Sample Name:	38e8a7ad78afc948164bae1f1cbbcd26.elf
Detection:	MAL
Classification:	mal88.troj.evad.linELF@0/1@26/0

Warnings

VT rate limit hit for: sMmzRMu1P6.elf

Runtime Messages

Command:	/tmp/sMmzRMu1P6.elf
PID:	5513
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

sMmzRMu1P6.elf (PID: 5513, Parent: 5432, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sMmzRMu1P6.elf

sMmzRMu1P6.elf New Fork (PID: 5516, Parent: 5513)

sMmzRMu1P6.elf New Fork (PID: 5518, Parent: 5516)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sMmzRMu1P6.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
sMmzRMu1P6.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x169e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5513.1.00007f5730017000.00007f5730031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5513.1.00007f5730017000.00007f5730031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x169e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: sMmzRMu1P6.elf PID: 5513	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeb35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebe9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebfd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sMmzRMu1P6.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: sMmzRMu1P6.elf

ReversingLabs: Detection: 55%

Source: sMmzRMu1P6.elf

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: kovey.mezo-api.xyz

Queries the IP of a very long domain name

Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.Y; f66a0PV!E(Yj%5AY; fOOPV!a0EAuH@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.Y; fxP66a0PV!E(^:5Y.AY; fQOOPV!a0EAuP@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.Y; f66a0PV!E(:5AY; f]OOPV!a0EAud@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.Y; f66a0PV!E(7:vU52UAY; fOOPV!a0EAuy@@l
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.Y; f66a0PV!E(:5b(%AY; fJJPV!a0E<n@@k
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.v; f+66a0PV!E(:5A@v; f,OOPV!a0EA}@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.v; f266a0PV!E(^:5..Z@v; fOOPV!a0EA~@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.v; f]66a0PV!E(E-:h5,@v; fT_OOPV!a0EA~@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.v; f~66a0PV!E(X?9V5vF@v; fOOPV!a0EA~@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.v; f66a0PV!E(k:BU5G[A@v; fJJPV!a0E<@@+
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; fB66a0PV!E(95B; f%DOOPV!a0EA?@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(9]5B; fOOPV!a0EAJ@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; ft66a0PV!E(I9e75B; fSuOOPV!a0EAO@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(-9-5yB; f>OOPV!a0EAS@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; fc66a0PV!E(H*j5U5B; fdJJPV!a0E<@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f}66a0PV!E(:c59; fOOPV!a0EA@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; fx66a0PV!E(:5"; fOOPV!a0EA@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(?mj>5t; fOOPV!a0EA@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; fL66a0PV!E(Z&:S5; fMOOPV!a0EA)@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(`:Ml5D; fxJJPV!a0E<@@
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; fv66a0PV!E(:-52V; fwOOPV!a0EA{@@j
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(_:N}52V; f}OOPV!a0EA@@[
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; fe66a0PV!E(:5e2V; fgOOPV!a0EA@@H
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(4jH5\|2V; fOOPV!a0EA@@=
Source: unknown	DNS traffic detected: query: kovey.mezo-api.xyz.; f66a0PV!E(:j5y2V; fJJPV!a0E<w@@/

Source: global traffic	TCP traffic: 192.168.2.14:40928 -> 45.131.111.219:33966
Source: global traffic	TCP traffic: 192.168.2.14:57248 -> 89.190.156.145:7733

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: unknown

DNS traffic detected: queries for: kovey.mezo-api.xyz

System Summary

Malicious sample detected (through community Yara rule)

Source: sMmzRMu1P6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5513.1.00007f5730017000.00007f5730031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sMmzRMu1P6.elf PID: 5513, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_eth
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init

Source: sMmzRMu1P6.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: /tmp/sMmzRMu1P6.elf (PID: 5518)

SIGKILL sent: pid: 888, result: successful

Jump to behavior

Source: sMmzRMu1P6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5513.1.00007f5730017000.00007f5730031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sMmzRMu1P6.elf PID: 5513, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.troj.evad.linELF@0/1@26/0

Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/55/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/66/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/88/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/99/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/33333/\xab/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/sMmzRMu1P6.elf (PID: 5518)	File opened: /proc/999/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/sMmzRMu1P6.elf (PID: 5516)

File: /tmp/sMmzRMu1P6.elf

Jump to behavior

Source: /tmp/sMmzRMu1P6.elf (PID: 5513)

Queries kernel information via 'uname':

Jump to behavior

Source: sMmzRMu1P6.elf, 5513.1.00007ffc12fe1000.00007ffc13002000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.uOrfn6:e
Source: sMmzRMu1P6.elf, 5513.1.00007ffc12fe1000.00007ffc13002000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.uOrfn6
Source: sMmzRMu1P6.elf, 5513.1.000055ef5599e000.000055ef55aef000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: sMmzRMu1P6.elf, 5513.1.000055ef5599e000.000055ef55aef000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: sMmzRMu1P6.elf, 5513.1.00007ffc12fe1000.00007ffc13002000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: sMmzRMu1P6.elf, 5513.1.00007ffc12fe1000.00007ffc13002000.rw-.sdmp	Binary or memory string: J7x86_64/usr/bin/qemu-arm/tmp/sMmzRMu1P6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sMmzRMu1P6.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: sMmzRMu1P6.elf, type: SAMPLE
Source: Yara match	File source: 5513.1.00007f5730017000.00007f5730031000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: sMmzRMu1P6.elf, type: SAMPLE
Source: Yara match	File source: 5513.1.00007f5730017000.00007f5730031000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sMmzRMu1P6.elf	55%	ReversingLabs	Linux.Trojan.Mirai
sMmzRMu1P6.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kovey.mezo-api.xyz	45.131.111.219	true	true	unknown
kovey.mezo-api.xyz.v; f+66a0PV!E(:5A@v; f,OOPV!a0EA}@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; fx66a0PV!E(:5"; fOOPV!a0EA@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f66a0PV!E(4jH5\|2V; fOOPV!a0EA@@=	unknown	unknown	true	unknown
kovey.mezo-api.xyz.v; f~66a0PV!E(X?9V5vF@v; fOOPV!a0EA~@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; ft66a0PV!E(I9e75B; fSuOOPV!a0EAO@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; fc66a0PV!E(H*j5U5B; fdJJPV!a0E<@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; fB66a0PV!E(95B; f%DOOPV!a0EA?@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.Y; f66a0PV!E(:5b(%AY; fJJPV!a0E<n@@k	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; fL66a0PV!E(Z&:S5; fMOOPV!a0EA)@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f66a0PV!E(9]5B; fOOPV!a0EAJ@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f66a0PV!E(-9-5yB; f>OOPV!a0EAS@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.Y; f66a0PV!E(7:vU52UAY; fOOPV!a0EAuy@@l	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; fe66a0PV!E(:5e2V; fgOOPV!a0EA@@H	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f66a0PV!E(`:Ml5D; fxJJPV!a0E<@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.v; f66a0PV!E(k:BU5G[A@v; fJJPV!a0E<@@+	unknown	unknown	true	unknown
kovey.mezo-api.xyz.v; f266a0PV!E(^:5..Z@v; fOOPV!a0EA~@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; fv66a0PV!E(:-52V; fwOOPV!a0EA{@@j	unknown	unknown	true	unknown
kovey.mezo-api.xyz.Y; fxP66a0PV!E(^:5Y.AY; fQOOPV!a0EAuP@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f}66a0PV!E(:c59; fOOPV!a0EA@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f66a0PV!E(:j5y2V; fJJPV!a0E<w@@/	unknown	unknown	true	low
kovey.mezo-api.xyz.; f66a0PV!E(?mj>5t; fOOPV!a0EA@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.Y; f66a0PV!E(:5AY; f]OOPV!a0EAud@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.Y; f66a0PV!E(Yj%5AY; fOOPV!a0EAuH@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.v; f]66a0PV!E(E-:h5,@v; fT_OOPV!a0EA~@@	unknown	unknown	true	unknown
kovey.mezo-api.xyz.; f66a0PV!E(_:N}52V; f}OOPV!a0EA@@[	unknown	unknown	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.131.111.219	kovey.mezo-api.xyz	Germany		398373	SERVERDESTROYERSUS	true
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.131.111.219	AkV7DALWTe.elf	Get hash	malicious	Mirai	Browse
	6pZSqZEAa2.elf	Get hash	malicious	Mirai	Browse
	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse
	LPXP6wFUyX.elf	Get hash	malicious	Mirai	Browse
	dvxuxG34sk.elf	Get hash	malicious	Mirai	Browse
	aNeRrtorRm.elf	Get hash	malicious	Mirai	Browse
	KxTpfpJzPK.elf	Get hash	malicious	Mirai	Browse
	MhV593RNl7.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	aNeRrtorRm.elf	Get hash	malicious	Mirai	Browse
	LiZXGg7fyH.elf	Get hash	malicious	Unknown	Browse
	hW73Zv5QP8.elf	Get hash	malicious	Unknown	Browse
	kb66uL4J4v.elf	Get hash	malicious	Unknown	Browse
	8g1ZsLnPkT.elf	Get hash	malicious	Unknown	Browse
	3kpdYyPMQ1.elf	Get hash	malicious	Mirai	Browse
	4kubb9wtoo.elf	Get hash	malicious	Unknown	Browse
	YpYCMrKWmt.elf	Get hash	malicious	Unknown	Browse
	rC1NOq2tlX.elf	Get hash	malicious	Unknown	Browse
	QvzaVBRGMX.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
kovey.mezo-api.xyz	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	dvxuxG34sk.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	aNeRrtorRm.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	MhV593RNl7.elf	Get hash	malicious	Mirai	Browse	45.131.111.219

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	aNeRrtorRm.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	XoJZcyGnfc.elf	Get hash	malicious	Gafgyt	Browse	89.190.156.227
	5Nfro46k6z.elf	Get hash	malicious	Gafgyt	Browse	89.190.156.227
	rWIq0N7gR0.elf	Get hash	malicious	Gafgyt	Browse	89.190.156.227
	xu4uPf2rLF.elf	Get hash	malicious	Gafgyt	Browse	89.190.156.227
	DYQCCl3BLP.elf	Get hash	malicious	Gafgyt	Browse	89.190.156.227
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.190.156.211
	LiZXGg7fyH.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	hW73Zv5QP8.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	kb66uL4J4v.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
SERVERDESTROYERSUS	AkV7DALWTe.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	6pZSqZEAa2.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	LPXP6wFUyX.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	dvxuxG34sk.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	aNeRrtorRm.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	KxTpfpJzPK.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	MhV593RNl7.elf	Get hash	malicious	Mirai	Browse	45.131.111.219
	lzTrp2wJQy.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.131.111.159
	l0fPUtuT9M.elf	Get hash	malicious	Gafgyt, Mirai	Browse	45.131.111.159

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.uOrfn6 (deleted)

Download File

Process:	/tmp/sMmzRMu1P6.elf
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.389898095464288
Encrypted:	false
SSDEEP:	3:TgQf3oBzHJN:TgJBrJN
MD5:	680771976C05521FA400F54900FABA40
SHA1:	40757876A83534F61C81680D9155E2F6F73AF01F
SHA-256:	33CDE6EAC55128C9FA290BA43E40CC517A56CEE41AE867447D03CAB5EF03EA48
SHA-512:	EE133B11655756B4360CDBBA791BD90AD4ACFF4CCDB398E9B72C7BBF465C8BD9F5397DF4A0110139A40EBAF9C71BDDCE036C51FC71EA2D0223DB8F8FADE66ED8
Malicious:	false
Reputation:	low
Preview:	/tmp/sMmzRMu1P6.elf.nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.995440395395691
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sMmzRMu1P6.elf
File size:	166'169 bytes
MD5:	38e8a7ad78afc948164bae1f1cbbcd26
SHA1:	b363ce25f3cf549544252cc51122d8bbbcc9b8f0
SHA256:	cba079fbaa1ebedbb75d9c0dc4e013c63c7ff0a62aac7dde7cb605a4324b5d56
SHA512:	48f4dd33b355633e9202de12dd44d899977044bb602fd6a55ef5fce733274d12241b1d18ff8d8cd21d68c28f2aa3ebf287544d4a7faa765dca8202538ceb6df7
SSDEEP:	3072:5gM1ZS0Tn3PiTuavNCpw0UcHYZwrhWfCm28ANX/meFsM/9DVI/:5gMegn/iuavNCpw0UGYCWad8qX/mXM/M
TLSH:	C5F33B56F6418B13C0D6277ABADF4245332397A4D3DB73069924AFB43F8679E0E23A05
File Content Preview:	.ELF..............(.........4...........4. ...(........pt...t...t.......................................................................L3..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	130988
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16808	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1e8f8	0x168f8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1e908	0x16908	0x2754	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2105c	0x1905c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x21074	0x19074	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2918c	0x1918c	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x29190	0x19190	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29190	0x19190	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x29194	0x19194	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29198	0x19198	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2919c	0x1919c	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x29244	0x19244	0x2cc	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29510	0x19510	0x2fc8	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19510	0xc64	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a178	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1a2d8	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1a4eb	0x210b	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1c5f6	0x6f6	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1ccec	0xf28	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1dc14	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1decc	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1e796	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1f925	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1fe7d	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1fe93	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x20434	0x5880	0x10	0x0		28	819	4
.strtab	STRTAB	0x0	0x25cb4	0x2c65	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x19074	0x21074	0x21074	0x118	0x118	4.4193	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1918c	0x1918c	6.1252	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1918c	0x2918c	0x2918c	0x384	0x334c	4.6007	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x19190	0x29190	0x29190	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1e8f8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1e908	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x2105c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21074	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2918c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x29190	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x29190	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x29194	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x29198	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2919c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x29244	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x29510	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1e8f8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1e904	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x85c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbfb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdbf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe76c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf82c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf9f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1043c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1055c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1075c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1127c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1141c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1170c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1174c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1185c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1192c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1202c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1248c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1250c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1401c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1468c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1501c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1522c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1531c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1544c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15dfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1679c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1691c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1713c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1734c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1817c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1829c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1898c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18db8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1903c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a56c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b79c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c93c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1caf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ceec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d44c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e87c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29194	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29190	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8aec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa930	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc68c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6a8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xdbec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xddd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdeb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe8d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29244	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2924c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xec60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xecd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x292c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x292c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x292c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xf7b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf81c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf8ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf9e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1009c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x292cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1130c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1150c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11550	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1160c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1164c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11748	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ff64	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11efc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29320	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2931c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12e48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ffd4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x130fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29404	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1ffdc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x137c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2006c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14974	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1509c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1519c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1526c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15dd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29408	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29420	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x169a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29438	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x294d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x16c68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20bf0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1712c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x294e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1807c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1842c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18594	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x294fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18da0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ed8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1928c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1963c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19774	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20f98	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ffc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b644	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21028	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b8c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c004	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c72c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c7dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cfb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d170	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1d698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x29508	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20c7e	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x20c5c	12	OBJECT	<unknown>	DEFAULT	4
C.15.4313	.symtab	0x1f6a8	1024	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1ff64	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x20c68	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1ff7c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1ffac	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1ff88	12	OBJECT	<unknown>	DEFAULT	4
C.7.6365	.symtab	0x20060	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1ffa0	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1ff94	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x2c034	4	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR2	.symtab	0x2c048	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x141d8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x141f4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x18b30	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2919c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1d44c	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1d450	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1e100	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1d444	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1d488	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1e124	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1e8c4	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1d47c	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1e094	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1e0b8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1e0dc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1d3ac	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1d9c4	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1d3f8	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x29508	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x20c7e	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2918c	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2918c	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x29508	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x180b0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x18094	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2950c	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x11b88	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x1127c	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1b79c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x144c8	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x180b0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11314	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x18140	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x18260	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x181d0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x18140	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x18124	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x18260	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x18244	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x15404	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x15428	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x153e0	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x18478	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x18548	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x181d0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x181b4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x144e0	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x18b30	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x167dc	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x16f28	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x14d98	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c790	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x180b0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1174c	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x195c8	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x195fc	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x192a0	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x14e20	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1713c	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x11bdc	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11314	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x13b98	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1b658	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1b79c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x137cc	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x13f44	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x11f0c	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x179c0	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x13fe4	56	FUNC	<unknown>	HIDDEN	2
__GI_fscanf	.symtab	0x136f4	48	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1cad0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1ccd4	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x18b98	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1401c	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1b79c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x18c9c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x18cc8	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x18cdc	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x18cf0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x18d04	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x17e24	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x18d2c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x14e94	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x18d64	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x18da4	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x14d70	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1bcc4	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x14ad4	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1475c	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x16d44	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x18db8	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x145ec	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1141c	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1d104	112	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x1c93c	172	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x1c9e8	232	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1b8e0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x140e0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1b8d0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1b9d0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1b9f4	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x140f0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1898c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x18e98	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x18edc	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x18f5c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x18140	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1192c	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x17e6c	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1691c	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x16bdc	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x18260	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x11aa0	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x191b4	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x11498	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x14f64	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1501c	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x18fbc	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11554	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x150e8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x151a4	136	FUNC	<unknown>	HIDDEN	2
__GI_setpgid	.symtab	0x115d8	56	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x11610	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1522c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x16e3c	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x18a34	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x152b8	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x15308	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1531c	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11650	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x17f5c	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x11f2c	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x15274	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x19778	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x16c6c	216	FUNC	<unknown>	HIDDEN	2
__GI_sscanf	.symtab	0x136c4	48	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x14210	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1bad4	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x14190	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x14190	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1bbc0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1bbe4	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x141b0	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x14300	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1bc28	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1bc78	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x143cc	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x16f48	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1734c	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x14610	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x116dc	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x19028	20	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x1caf4	480	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x1170c	64	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x1a56c	1896	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11f5c	208	FUNC	<unknown>	HIDDEN	2
__GI_vsscanf	.symtab	0x13724	168	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x19644	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x196bc	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x19698	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x181d0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x29198	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x29198	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1e100	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1e094	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1e0b8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1e0dc	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1087c	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x111d8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x111d8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x111bc	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2f	.symtab	0x1d30c	160	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1d2b8	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1087c	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x111f0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x11238	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x11250	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x11220	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x11208	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x10f1c	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x10c8c	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x10870	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x10878	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x10bd8	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x10bb0	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1d174	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1d2a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x10c2c	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x18ae0	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x10b8c	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1075c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x10858	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x10c18	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1e060	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1e058	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1e050	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2bad8	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x294e4	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2c4d8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29510	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29510	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x184f4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x180b0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x18094	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x11138	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2950c	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2c01c	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x29244	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x18ad4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x18ac8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11268	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x10f1c	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1d174	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x29194	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2c4d8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2bad0	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x11138	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x11b88	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x2118c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x21074	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2b580	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x10bd8	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x1127c	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1b79c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x29198	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x29194	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1d2b8	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x10c2c	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x10bb0	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x10c18	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x10b8c	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x179c0	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2c4a4	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2c4a8	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2b584	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x29190	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x11128	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x18bfc	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c7f4	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x18d04	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x17e24	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x144c8	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1d804	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1d8ec	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1e084	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1d880	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1d9a4	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1e08c	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1e168	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1e87c	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1db08	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x11128	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x29194	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x29190	0	NOTYPE	<unknown>	HIDDEN	9
__init_scan_cookie	.symtab	0x1acf0	108	FUNC	<unknown>	HIDDEN	2
__ledf2	.symtab	0x11130	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x180b0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x14e20	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x182d0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x18358	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x11314	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x179c0	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2c4ac	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x18f5c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x18140	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x18260	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x14f64	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1501c	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11554	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x150e8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x151a4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1c4c4	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x18a34	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2bacc	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x181d0	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x17d8c	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x11130	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x163ac	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1544c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x29408	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2c12c	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x162fc	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x10c8c	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x11138	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x18140	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x18124	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2bad4	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x29190	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x29190	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x29500	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x29504	4	OBJECT	<unknown>	DEFAULT	13
__psfs_do_numeric	.symtab	0x1b0e8	1392	FUNC	<unknown>	HIDDEN	2
__psfs_do_numeric.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__psfs_parse_spec	.symtab	0x1ae24	708	FUNC	<unknown>	HIDDEN	2
__psfs_parse_spec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__pthread_initialize_minimal	.symtab	0x1c6f4	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1843c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x18434	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x18434	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x18434	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x18434	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x18260	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x18244	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1e068	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2badc	4	OBJECT	<unknown>	HIDDEN	14
__scan_cookie.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__scan_getc	.symtab	0x1ad5c	132	FUNC	<unknown>	HIDDEN	2
__scan_ungetc	.symtab	0x1ade0	68	FUNC	<unknown>	HIDDEN	2
__sigaddset	.symtab	0x15404	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x15428	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x153e0	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1d0c4	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c7e8	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2932c	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1ce94	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x197ac	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1ceec	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x19888	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1cfb4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1d088	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1cfe4	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x199c8	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12670	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29330	4	OBJECT	<unknown>	DEFAULT	13
__strtofpmax	.symtab	0x1c014	940	FUNC	<unknown>	HIDDEN	2
__strtofpmax.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__subdf3	.symtab	0x10878	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x14ddc	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x14f20	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x14fd4	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x150a4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x15158	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x18a08	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x18f1c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x18af0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x11510	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1c4a0	36	FUNC	<unknown>	DEFAULT	2
__truncdfsf2	.symtab	0x1d30c	160	FUNC	<unknown>	HIDDEN	2
__uClibc_fini	.symtab	0x18478	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x18548	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x185a0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x294fc	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x1075c	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x181d0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x181b4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x144e0	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x19108	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1903c	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_atoi	.symtab	0x105dc	68	FUNC	<unknown>	DEFAULT	2
_bss_custom_printf_spec	.symtab	0x2b570	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2c4d8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x126a0	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2c0d4	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x2c0fc	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x29404	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1c700	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1c738	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2c4d0	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2c4d4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2c4c4	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2c4c0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2c4c8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2c4b8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1c438	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2c4b4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2c4cc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2c4bc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2c4b0	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x29510	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2c4d8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x18b30	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1e8f8	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x29570	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x126f4	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x19ca0	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x19aa4	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x10484	36	FUNC	<unknown>	DEFAULT	2
_memset	.symtab	0x104a8	32	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x12e6c	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x13154	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x12f0c	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x12f50	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x13100	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1844c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x18444	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x18abc	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x2c124	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1202c	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1248c	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x29334	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x29550	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x138e8	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2956c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2955c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x29568	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x29338	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x1250c	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2931c	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x16f64	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdlib_strto_ll	.symtab	0x1bdbc	600	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_ll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x19b18	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strcat	.symtab	0x103fc	64	FUNC	<unknown>	DEFAULT	2
_strcmp2	.symtab	0x1055c	128	FUNC	<unknown>	DEFAULT	2
_strcpy	.symtab	0x1043c	72	FUNC	<unknown>	DEFAULT	2
_string_syserrmsgs	.symtab	0x2007c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x19b44	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12778	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x167dc	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x16f28	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x16f28	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8554	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x84e8	108	FUNC	<unknown>	DEFAULT	2
attack_gre.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_gre_eth	.symtab	0x8b38	1684	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x91cc	1564	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x85c4	1396	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 23:12:57.466412067 CEST	40928	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:12:57.670895100 CEST	33966	40928	45.131.111.219	192.168.2.14
Apr 17, 2024 23:12:57.670986891 CEST	40928	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:12:57.671366930 CEST	40928	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:12:57.875690937 CEST	33966	40928	45.131.111.219	192.168.2.14
Apr 17, 2024 23:12:57.875770092 CEST	40928	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:12:58.080131054 CEST	33966	40928	45.131.111.219	192.168.2.14
Apr 17, 2024 23:12:58.205935955 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:12:59.208709002 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:13:01.224559069 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:13:05.416256905 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:13:13.082674980 CEST	33966	40928	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:13.082920074 CEST	40928	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:13.607834101 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:13:24.382375002 CEST	33966	40928	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:24.382839918 CEST	40928	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:24.587068081 CEST	33966	40928	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:26.430362940 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:26.639909983 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:26.640085936 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:26.640183926 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:26.849819899 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:26.850162983 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:27.059895992 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:29.735058069 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:13:42.062563896 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:42.062825918 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:13:57.274379969 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:13:57.274553061 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:03.269332886 CEST	57248	7733	192.168.2.14	89.190.156.145
Apr 17, 2024 23:14:08.043344975 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:08.043567896 CEST	40932	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:08.252949953 CEST	33966	40932	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:10.091382027 CEST	40934	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:10.297990084 CEST	33966	40934	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:10.298156023 CEST	40934	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:10.298377037 CEST	40934	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:10.504815102 CEST	33966	40934	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:10.504951954 CEST	40934	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:10.711493015 CEST	33966	40934	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:20.308049917 CEST	40934	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:20.514579058 CEST	33966	40934	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:28.925841093 CEST	33966	40934	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:30.976504087 CEST	40936	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:31.184875011 CEST	33966	40936	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:39.236299038 CEST	40938	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:39.444927931 CEST	33966	40938	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:39.445394039 CEST	40938	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:39.445394039 CEST	40938	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:39.654052019 CEST	33966	40938	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:39.654227018 CEST	40938	33966	192.168.2.14	45.131.111.219
Apr 17, 2024 23:14:39.862834930 CEST	33966	40938	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:54.866077900 CEST	33966	40938	45.131.111.219	192.168.2.14
Apr 17, 2024 23:14:54.866372108 CEST	40938	33966	192.168.2.14	45.131.111.219

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 23:12:56.836816072 CEST	45186	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:12:56.941817999 CEST	53	45186	8.8.8.8	192.168.2.14
Apr 17, 2024 23:12:56.942436934 CEST	55556	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:12:57.046876907 CEST	53	55556	8.8.8.8	192.168.2.14
Apr 17, 2024 23:12:57.047095060 CEST	48217	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:12:57.151671886 CEST	53	48217	8.8.8.8	192.168.2.14
Apr 17, 2024 23:12:57.151832104 CEST	57566	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:12:57.256975889 CEST	53	57566	8.8.8.8	192.168.2.14
Apr 17, 2024 23:12:57.257117033 CEST	48434	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:12:57.361485958 CEST	53	48434	8.8.8.8	192.168.2.14
Apr 17, 2024 23:12:57.361655951 CEST	42850	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:12:57.466126919 CEST	53	42850	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:25.383395910 CEST	34136	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:25.487634897 CEST	53	34136	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:25.487909079 CEST	53295	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:25.592331886 CEST	53	53295	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:25.592617989 CEST	46899	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:25.697122097 CEST	53	46899	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:25.697329044 CEST	56413	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:25.801743031 CEST	53	56413	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:25.801970959 CEST	49481	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:25.906394005 CEST	53	49481	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:25.906682014 CEST	43716	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:26.011210918 CEST	53	43716	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:26.011464119 CEST	48686	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:26.115761995 CEST	53	48686	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:26.116188049 CEST	49035	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:26.220663071 CEST	53	49035	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:26.221012115 CEST	42614	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:26.325246096 CEST	53	42614	8.8.8.8	192.168.2.14
Apr 17, 2024 23:13:26.325555086 CEST	37191	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:13:26.429845095 CEST	53	37191	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.043868065 CEST	52774	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.148593903 CEST	53	52774	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.149081945 CEST	53814	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.253376007 CEST	53	53814	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.253756046 CEST	55637	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.358118057 CEST	53	55637	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.358601093 CEST	35174	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.462984085 CEST	53	35174	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.463485003 CEST	52689	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.567888975 CEST	53	52689	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.568324089 CEST	40666	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.672486067 CEST	53	40666	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.672805071 CEST	43515	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.777095079 CEST	53	43515	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.777398109 CEST	38912	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.881684065 CEST	53	38912	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.882003069 CEST	41742	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:09.986373901 CEST	53	41742	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:09.986685991 CEST	40575	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:10.091103077 CEST	53	40575	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:29.926605940 CEST	60244	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.030853987 CEST	53	60244	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.031203985 CEST	41897	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.135660887 CEST	53	41897	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.135900974 CEST	60281	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.242614985 CEST	53	60281	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.242957115 CEST	37499	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.347292900 CEST	53	37499	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.347489119 CEST	36300	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.451802015 CEST	53	36300	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.452229023 CEST	43972	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.556515932 CEST	53	43972	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.556968927 CEST	57819	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.662136078 CEST	53	57819	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.662430048 CEST	54665	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.767234087 CEST	53	54665	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.767477036 CEST	37652	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.871653080 CEST	53	37652	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:30.871927977 CEST	44868	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:30.976054907 CEST	53	44868	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.185131073 CEST	58450	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.289535999 CEST	53	58450	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.289901972 CEST	43480	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.394531012 CEST	53	43480	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.394794941 CEST	43363	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.501784086 CEST	53	43363	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.502154112 CEST	33629	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.606473923 CEST	53	33629	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.606758118 CEST	60179	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.712090015 CEST	53	60179	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.712419987 CEST	45965	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.816836119 CEST	53	45965	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.817117929 CEST	47595	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:38.921331882 CEST	53	47595	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:38.921725035 CEST	48141	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:39.026041985 CEST	53	48141	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:39.026382923 CEST	35574	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:39.131069899 CEST	53	35574	8.8.8.8	192.168.2.14
Apr 17, 2024 23:14:39.131565094 CEST	60793	53	192.168.2.14	8.8.8.8
Apr 17, 2024 23:14:39.235924959 CEST	53	60793	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 23:12:56.836816072 CEST	192.168.2.14	8.8.8.8	0xf273	Standard query (0)	kovey.mezo-api.xyz	A (IP address)	IN (0x0001)	false
Apr 17, 2024 23:12:56.942436934 CEST	192.168.2.14	8.8.8.8	0xdc41	Standard query (0)	kovey.mezo-api.xyz.Y; f66a0PV!E(Yj%5AY; fOOPV!a0EAuH@@	526	2056	false
Apr 17, 2024 23:12:57.047095060 CEST	192.168.2.14	8.8.8.8	0xdc41	Standard query (0)	kovey.mezo-api.xyz.Y; fxP66a0PV!E(^:5Y.AY; fQOOPV!a0EAuP@@	526	2056	false
Apr 17, 2024 23:12:57.151832104 CEST	192.168.2.14	8.8.8.8	0xdc41	Standard query (0)	kovey.mezo-api.xyz.Y; f66a0PV!E(:5AY; f]OOPV!a0EAud@@	526	2056	false
Apr 17, 2024 23:12:57.257117033 CEST	192.168.2.14	8.8.8.8	0xdc41	Standard query (0)	kovey.mezo-api.xyz.Y; f66a0PV!E(7:vU52UAY; fOOPV!a0EAuy@@l	526	2056	false
Apr 17, 2024 23:12:57.361655951 CEST	192.168.2.14	8.8.8.8	0xdc41	Standard query (0)	kovey.mezo-api.xyz.Y; f66a0PV!E(:5b(%AY; fJJPV!a0E<n@@k	526	11651	false
Apr 17, 2024 23:13:25.906682014 CEST	192.168.2.14	8.8.8.8	0xbf40	Standard query (0)	kovey.mezo-api.xyz.v; f+66a0PV!E(:5A@v; f,OOPV!a0EA}@@	526	2056	false
Apr 17, 2024 23:13:26.011464119 CEST	192.168.2.14	8.8.8.8	0xbf40	Standard query (0)	kovey.mezo-api.xyz.v; f266a0PV!E(^:5..Z@v; fOOPV!a0EA~@@	526	2056	false
Apr 17, 2024 23:13:26.116188049 CEST	192.168.2.14	8.8.8.8	0xbf40	Standard query (0)	kovey.mezo-api.xyz.v; f]66a0PV!E(E-:h5,@v; fT_OOPV!a0EA~@@	526	2056	false
Apr 17, 2024 23:13:26.221012115 CEST	192.168.2.14	8.8.8.8	0xbf40	Standard query (0)	kovey.mezo-api.xyz.v; f~66a0PV!E(X?9V5vF@v; fOOPV!a0EA~@@	526	2056	false
Apr 17, 2024 23:13:26.325555086 CEST	192.168.2.14	8.8.8.8	0xbf40	Standard query (0)	kovey.mezo-api.xyz.v; f66a0PV!E(k:BU5G[A@v; fJJPV!a0E<@@+	526	11651	false
Apr 17, 2024 23:14:09.568324089 CEST	192.168.2.14	8.8.8.8	0x542	Standard query (0)	kovey.mezo-api.xyz.; fB66a0PV!E(95B; f%DOOPV!a0EA?@@	526	2056	false
Apr 17, 2024 23:14:09.672805071 CEST	192.168.2.14	8.8.8.8	0x542	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(9]5B; fOOPV!a0EAJ@@	526	2056	false
Apr 17, 2024 23:14:09.777398109 CEST	192.168.2.14	8.8.8.8	0x542	Standard query (0)	kovey.mezo-api.xyz.; ft66a0PV!E(I9e75B; fSuOOPV!a0EAO@@	526	2056	false
Apr 17, 2024 23:14:09.882003069 CEST	192.168.2.14	8.8.8.8	0x542	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(-9-5yB; f>OOPV!a0EAS@@	526	2056	false
Apr 17, 2024 23:14:09.986685991 CEST	192.168.2.14	8.8.8.8	0x542	Standard query (0)	kovey.mezo-api.xyz.; fc66a0PV!E(H*j5U5B; fdJJPV!a0E<@@	526	11651	false
Apr 17, 2024 23:14:30.452229023 CEST	192.168.2.14	8.8.8.8	0x1ccb	Standard query (0)	kovey.mezo-api.xyz.; f}66a0PV!E(:c59; fOOPV!a0EA@@	526	2056	false
Apr 17, 2024 23:14:30.556968927 CEST	192.168.2.14	8.8.8.8	0x1ccb	Standard query (0)	kovey.mezo-api.xyz.; fx66a0PV!E(:5"; fOOPV!a0EA@@	526	2056	false
Apr 17, 2024 23:14:30.662430048 CEST	192.168.2.14	8.8.8.8	0x1ccb	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(?mj>5t; fOOPV!a0EA@@	526	2056	false
Apr 17, 2024 23:14:30.767477036 CEST	192.168.2.14	8.8.8.8	0x1ccb	Standard query (0)	kovey.mezo-api.xyz.; fL66a0PV!E(Z&:S5; fMOOPV!a0EA)@@	526	2056	false
Apr 17, 2024 23:14:30.871927977 CEST	192.168.2.14	8.8.8.8	0x1ccb	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(`:Ml5D; fxJJPV!a0E<@@	526	11651	false
Apr 17, 2024 23:14:38.712419987 CEST	192.168.2.14	8.8.8.8	0x3256	Standard query (0)	kovey.mezo-api.xyz.; fv66a0PV!E(:-52V; fwOOPV!a0EA{@@j	526	2056	false
Apr 17, 2024 23:14:38.817117929 CEST	192.168.2.14	8.8.8.8	0x3256	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(_:N}52V; f}OOPV!a0EA@@[	526	2056	false
Apr 17, 2024 23:14:38.921725035 CEST	192.168.2.14	8.8.8.8	0x3256	Standard query (0)	kovey.mezo-api.xyz.; fe66a0PV!E(:5e2V; fgOOPV!a0EA@@H	526	2056	false
Apr 17, 2024 23:14:39.026382923 CEST	192.168.2.14	8.8.8.8	0x3256	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(4jH5\|2V; fOOPV!a0EA@@=	526	2056	false
Apr 17, 2024 23:14:39.131565094 CEST	192.168.2.14	8.8.8.8	0x3256	Standard query (0)	kovey.mezo-api.xyz.; f66a0PV!E(:j5y2V; fJJPV!a0E<w@@/	526	11651	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 23:12:56.941817999 CEST	8.8.8.8	192.168.2.14	0xf273	No error (0)	kovey.mezo-api.xyz		45.131.111.219	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: sMmzRMu1P6.elf PID: 5513, Parent PID: 5432

General

Start time (UTC):	21:12:55
Start date (UTC):	17/04/2024
Path:	/tmp/sMmzRMu1P6.elf
Arguments:	/tmp/sMmzRMu1P6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sMmzRMu1P6.elf PID: 5516, Parent PID: 5513

General

Start time (UTC):	21:12:55
Start date (UTC):	17/04/2024
Path:	/tmp/sMmzRMu1P6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sMmzRMu1P6.elf PID: 5518, Parent PID: 5516

General

Start time (UTC):	21:12:55
Start date (UTC):	17/04/2024
Path:	/tmp/sMmzRMu1P6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sMmzRMu1P6.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.uOrfn6 (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: sMmzRMu1P6.elf PID: 5513, Parent PID: 5432

General

Chronological Activities

Analysis Process: sMmzRMu1P6.elf PID: 5516, Parent PID: 5513

General

Chronological Activities

Analysis Process: sMmzRMu1P6.elf PID: 5518, Parent PID: 5516

General

Chronological Activities

Linux Analysis Report
sMmzRMu1P6.elf