Edit tour

Linux Analysis Report
armv5l.elf

Overview

General Information

Sample name:	armv5l.elf
Analysis ID:	1595385
MD5:	bf17bdac59e21ca1e785921237b3dc14
SHA1:	4ba77735a04affa69139b122a8954a6e17eae5c6
SHA256:	12d0e8a06e5dc58e165163f9646b3e82e3d841a2e6921679988bd1e0005d7c94
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1595385
Start date and time:	2025-01-20 20:12:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	armv5l.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/armv5l.elf
PID:	5533
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

armv5l.elf (PID: 5533, Parent: 5450, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/armv5l.elf

armv5l.elf New Fork (PID: 5535, Parent: 5533)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
armv5l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
armv5l.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
armv5l.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1702c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1711c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17144:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17158:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5533.1.00007fe2e8017000.00007fe2e8033000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5533.1.00007fe2e8017000.00007fe2e8033000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1702c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1711c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17144:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17158:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv5l.elf PID: 5533	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv5l.elf PID: 5533	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x6b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x703:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x717:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x753:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x767:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x807:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x81b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x82f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x843:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: armv5l.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: armv5l.elf	ReversingLabs: Detection: 63%
Source: armv5l.elf	Virustotal: Detection: 58%			Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/armv5l.elf (PID: 5533)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.15:48146 -> 94.154.35.238:666

Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: armv5l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5533.1.00007fe2e8017000.00007fe2e8033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv5l.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: armv5l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5533.1.00007fe2e8017000.00007fe2e8033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv5l.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@2/0

Source: armv5l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv5l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv5l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv5l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv5l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /tmp/armv5l.elf (PID: 5533)

Queries kernel information via 'uname':

Jump to behavior

Source: armv5l.elf, 5533.1.0000560e57e0f000.0000560e57f3d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: armv5l.elf, 5533.1.0000560e57e0f000.0000560e57f3d000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: armv5l.elf, 5533.1.00007ffd856cf000.00007ffd856f0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: armv5l.elf, 5533.1.00007ffd856cf000.00007ffd856f0000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/armv5l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv5l.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: armv5l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv5l.elf, type: SAMPLE
Source: Yara match	File source: 5533.1.00007fe2e8017000.00007fe2e8033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv5l.elf PID: 5533, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: armv5l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv5l.elf, type: SAMPLE
Source: Yara match	File source: 5533.1.00007fe2e8017000.00007fe2e8033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv5l.elf PID: 5533, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
armv5l.elf	63%	ReversingLabs	Linux.Backdoor.Gafgyt
armv5l.elf	59%	Virustotal		Browse
armv5l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.154.35.238	unknown	Ukraine		49505	SELECTELRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.154.35.238	94.154.35.238-mips-2025-01-20T16_32_16.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	94.154.35.238-mipsel-2025-01-20T02_58_11.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	94.154.35.238-x86-2025-01-18T14_35_21.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	skid.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	37.114.46.58-skid.arm6-2025-01-20T12_15_18.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	37.114.46.58-skid.arm4-2025-01-20T12_00_03.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	loki.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	37.114.46.58-skid.ppc-2025-01-20T10_59_57.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	94.154.35.238-mipsel-2025-01-20T02_58_11.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm6.bin.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	x86_64.bin.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	94.154.35.238-mips-2025-01-20T16_32_16.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	tKENar6l1f.exe	Get hash	malicious	LummaC Stealer	Browse	176.113.115.215
	94.154.35.238-mipsel-2025-01-20T02_58_11.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	PgOfRNLIVK.exe	Get hash	malicious	LummaC, Amadey, Babadeda, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer	Browse	176.113.115.163
	7x1qzxFZXx.ps1	Get hash	malicious	PureCrypter	Browse	87.247.158.212
	7x1qzxFZXx.ps1	Get hash	malicious	PureCrypter	Browse	87.247.158.212
	94.154.35.238-x86-2025-01-18T14_35_21.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	2.ps1	Get hash	malicious	XWorm	Browse	176.113.115.170
	https://belmash.ru/	Get hash	malicious	Unknown	Browse	178.132.201.50
	random.exe	Get hash	malicious	LummaC, Amadey, KeyLogger, LummaC Stealer, PureLog Stealer, Stealc, StormKitty	Browse	176.113.115.163

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.498863403255171
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	armv5l.elf
File size:	193'121 bytes
MD5:	bf17bdac59e21ca1e785921237b3dc14
SHA1:	4ba77735a04affa69139b122a8954a6e17eae5c6
SHA256:	12d0e8a06e5dc58e165163f9646b3e82e3d841a2e6921679988bd1e0005d7c94
SHA512:	468e0744348e7e71a96fc7df78b89bf1823be321c3b7b40f5c60b3500cc672f3b601abf86f01e560ba6f3317ea05f60d7e3d38b017dd8e782817cdd44a2c97d4
SSDEEP:	3072:u7FArNrK8wK43GSz91HuSzHy2NRKzOWi9J3RLOmirGIuUZsweor6rFaf8:trlK/K439z7HnHy2HKCll5OmirGIuUZS
TLSH:	06142B01F8104F57C1C32BBBB79F46993B366B98A7DB3301A634AEB42F8679D1D29501
File Content Preview:	.ELF...a..........(.........4...8"......4. ...(......................................................H..............Q.td..................................-...L."....Z..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	139832
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x16bd0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1ec80	0x16c80	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1ec94	0x16c94	0x4848	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x234dc	0x1b4dc	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x2c000	0x1c000	0xc	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x2c00c	0x1c00c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c014	0x1c014	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x2c020	0x1c020	0x48bc	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x308dc	0x208dc	0x8720	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x208dc	0x111a	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x219f8	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x21a98	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x21da4	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x21e08	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x220f0	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x22190	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22558	0x7f30	0x10	0x0		19	1115	4
.strtab	STRTAB	0x0	0x2a488	0x4dd9	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1b4e0	0x1b4e0	6.0514	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x1c000	0x2c000	0x2c000	0x48dc	0xcffc	0.3564	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1ec80	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1ec94	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x234dc	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x2c000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2c00c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2c014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2c020	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x308dc	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ec80	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec8c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ec44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ec90	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xad60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb37c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc68c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd5f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe39c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf50c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1028c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1099c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1162c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1218c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1264c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1280c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1294c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1319c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1324c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1343c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1409c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1479c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1487c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1518c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1521c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1524c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1594c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1648c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1653c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1805c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1809c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b64c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1baec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c38c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e48c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x2c00c	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2c028	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ec74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c02c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c030	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8f60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa1b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa22c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb1c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb370	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe398	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0b0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2189c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xecd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf16c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10270	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10308	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c004	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x106dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x107d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10994	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x300c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x218a4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10cb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11dc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1204c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1216c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12370	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1241c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1279c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x218c0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x128e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30560	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x30568	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x36ab4	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x134a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13624	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13634	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30570	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x21ec8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1404c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1453c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14aa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1533c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x306ac	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1593c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x307b4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x159b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x307cc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15c28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22af4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15f7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30880	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1628c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1647c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16588	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30898	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x16808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16988	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17610	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22b4c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17e24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3089c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x18fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22bb4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1919c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22bc4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x198cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22bdc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19f94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a6e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a7e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22c48	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1ab68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b60c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x308b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1b79c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1baa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c37c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22cc0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1cc28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cedc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cfc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d0d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22d54	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d2a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x308d0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1e14c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e43c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e4b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e67c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e7c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e7fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23180	0	NOTYPE	<unknown>	DEFAULT	4
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C2Host	.symtab	0x2c068	4	OBJECT	<unknown>	DEFAULT	9
C2Sock	.symtab	0x308f8	4	OBJECT	<unknown>	DEFAULT	10
CaptchaHex	.symtab	0xabf8	360	FUNC	<unknown>	DEFAULT	2
Datagram	.symtab	0x8fc8	1228	FUNC	<unknown>	DEFAULT	2
DevArch	.symtab	0x81cc	28	FUNC	<unknown>	DEFAULT	2
FRSTSV	.symtab	0x2c06c	4	OBJECT	<unknown>	DEFAULT	9
GetRandIP	.symtab	0x8f68	96	FUNC	<unknown>	DEFAULT	2
HTTPHex	.symtab	0xaa8c	364	FUNC	<unknown>	DEFAULT	2
Hexed	.symtab	0xa010	420	FUNC	<unknown>	DEFAULT	2
HoHoHo	.symtab	0x9b04	1292	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x14748	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x3090c	16384	OBJECT	<unknown>	DEFAULT	10
Transmission	.symtab	0x9494	1648	FUNC	<unknown>	DEFAULT	2
VSEPacket	.symtab	0xa23c	308	FUNC	<unknown>	DEFAULT	2
ValveSourced	.symtab	0xa370	1820	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x2c008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x2c000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x30560	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x218c8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x308d0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x22dca	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x30568	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x21bc8	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2c010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x2c00c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x234dc	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x234dc	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x30560	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x218c8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x308d0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x22dca	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x30568	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x21bc8	768	OBJECT	<unknown>	HIDDEN	4
__GI___cmsg_nxthdr	.symtab	0x1baec	88	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x30564	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x308d4	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x3056c	4	OBJECT	<unknown>	HIDDEN	9
__GI___fgetc_unlocked	.symtab	0x1e18c	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x14974	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x16c04	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1294c	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x129c0	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x12d1c	44	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x12dcc	92	FUNC	<unknown>	HIDDEN	2
__GI___libc_open64	.symtab	0x12e38	60	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x16a80	24	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_createerr	.symtab	0x16968	40	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_svc_fdset	.symtab	0x16990	36	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_svc_max_pollfd	.symtab	0x16918	40	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_svc_pollfd	.symtab	0x16940	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1648c	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1653c	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x14988	232	FUNC	<unknown>	HIDDEN	2
__GI__authenticate	.symtab	0x19ccc	112	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x12a3c	40	FUNC	<unknown>	HIDDEN	2
__GI__rpc_dtablesize	.symtab	0x1d0f0	40	FUNC	<unknown>	HIDDEN	2
__GI__seterr_reply	.symtab	0x19168	288	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x15804	328	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x14f64	44	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x15f88	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x15f88	12	FUNC	<unknown>	HIDDEN	2
__GI_authnone_create	.symtab	0x1cac4	204	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1df90	44	FUNC	<unknown>	HIDDEN	2
__GI_bindresvport	.symtab	0x1cc2c	348	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1bab0	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x12a64	44	FUNC	<unknown>	HIDDEN	2
__GI_clnt_perror	.symtab	0x1e7e4	28	FUNC	<unknown>	HIDDEN	2
__GI_clnt_spcreateerror	.symtab	0x1e4e8	256	FUNC	<unknown>	HIDDEN	2
__GI_clnt_sperrno	.symtab	0x1e440	76	FUNC	<unknown>	HIDDEN	2
__GI_clnt_sperror	.symtab	0x1e604	480	FUNC	<unknown>	HIDDEN	2
__GI_clntudp_bufcreate	.symtab	0x18548	620	FUNC	<unknown>	HIDDEN	2
__GI_clntudp_create	.symtab	0x187b4	76	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x12a90	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x14f90	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x36ab4	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x161fc	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x16ad0	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x16134	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1bb44	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1294c	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x129c0	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1c558	484	FUNC	<unknown>	HIDDEN	2
__GI_ffs	.symtab	0x1c9e0	92	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1e18c	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1c2f8	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1c73c	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1bcc4	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x12abc	44	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1e15c	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x1c38c	140	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x14560	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1bcd0	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1bd18	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x14594	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1e18c	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1e0b8	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x16afc	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x12b14	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x16b28	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x14bac	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x14bf0	884	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x12b40	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x12b58	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x12bb0	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x14fbc	44	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x12bdc	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x16b54	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x36ab8	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x14b88	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1aa80	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1d6e8	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1d374	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x15d88	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x12c08	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x14a7c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x12c58	44	FUNC	<unknown>	HIDDEN	2
__GI_lrand48_r	.symtab	0x1b838	12	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x12d1c	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x12c84	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x17d30	252	FUNC	<unknown>	HIDDEN	2
__GI_memcmp	.symtab	0x1c7e0	44	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x14650	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17d20	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x17e2c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x17e44	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x14660	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x127ac	96	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x12d74	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0xfc50	68	FUNC	<unknown>	HIDDEN	2
__GI_nrand48_r	.symtab	0x1b844	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x12dcc	92	FUNC	<unknown>	HIDDEN	2
__GI_open64	.symtab	0x12e38	60	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x1e114	72	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x12ea0	44	FUNC	<unknown>	HIDDEN	2
__GI_pmap_getport	.symtab	0x18fcc	324	FUNC	<unknown>	HIDDEN	2
__GI_pmap_set	.symtab	0x1cfdc	276	FUNC	<unknown>	HIDDEN	2
__GI_pmap_unset	.symtab	0x1cef0	236	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x12ecc	44	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x1bcdc	60	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_destroy	.symtab	0x10a48	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getdetachstate	.symtab	0x10a68	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getinheritsched	.symtab	0x10ab8	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getschedparam	.symtab	0x10bdc	32	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getschedpolicy	.symtab	0x10a90	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getscope	.symtab	0x10aec	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_init	.symtab	0x10b58	68	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setdetachstate	.symtab	0x10a50	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setinheritsched	.symtab	0x10aa0	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setschedparam	.symtab	0x10bfc	84	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setschedpolicy	.symtab	0x10a78	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setscope	.symtab	0x10ac8	36	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_broadcast	.symtab	0x11120	88	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_destroy	.symtab	0x1108c	20	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_init	.symtab	0x11074	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_signal	.symtab	0x115dc	80	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_timedwait	.symtab	0x11240	516	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_wait	.symtab	0x11444	408	FUNC	<unknown>	HIDDEN	2
__GI_pthread_condattr_destroy	.symtab	0x110a8	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_condattr_init	.symtab	0x110a0	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_equal	.symtab	0xfecc	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_exit	.symtab	0x11864	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_getschedparam	.symtab	0x1099c	172	FUNC	<unknown>	HIDDEN	2
__GI_pthread_self	.symtab	0xff88	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_setcancelstate	.symtab	0x10eb0	92	FUNC	<unknown>	HIDDEN	2
__GI_pthread_setcanceltype	.symtab	0x10e54	92	FUNC	<unknown>	HIDDEN	2
__GI_pthread_setschedparam	.symtab	0x108d8	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0xf170	48	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x15950	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x15c2c	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1c810	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x13144	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x15018	44	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x15044	52	FUNC	<unknown>	HIDDEN	2
__GI_recvmsg	.symtab	0x15078	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x16b80	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x13278	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x150a4	44	FUNC	<unknown>	HIDDEN	2
__GI_sendmsg	.symtab	0x150d0	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x150fc	52	FUNC	<unknown>	HIDDEN	2
__GI_setrlimit	.symtab	0x132a8	44	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x132d4	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x15130	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x15b6c	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0xee44	304	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1518c	48	FUNC	<unknown>	HIDDEN	2
__GI_sigdelset	.symtab	0x151bc	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x151ec	24	FUNC	<unknown>	HIDDEN	2
__GI_sigfillset	.symtab	0x15204	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x15288	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x13300	84	FUNC	<unknown>	HIDDEN	2
__GI_sigsuspend	.symtab	0x13354	48	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x16290	420	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x134a4	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x15160	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x134d4	52	FUNC	<unknown>	HIDDEN	2
__GI_srand48_r	.symtab	0x1b88c	104	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x15cbc	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1e3c4	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1e2bc	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x14700	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x14700	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x14780	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1ca3c	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x14720	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x1c8c8	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x17f30	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1479c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1805c	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1c990	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1487c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x14a70	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x17fe8	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x15f94	8	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreq	.symtab	0x19930	68	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreq_common	.symtab	0x19730	416	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreq_poll	.symtab	0x19b2c	128	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreqset	.symtab	0x198d0	96	FUNC	<unknown>	HIDDEN	2
__GI_svc_register	.symtab	0x199f8	164	FUNC	<unknown>	HIDDEN	2
__GI_svc_sendreply	.symtab	0x194ac	92	FUNC	<unknown>	HIDDEN	2
__GI_svc_unregister	.symtab	0x19974	96	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_auth	.symtab	0x195f8	52	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_decode	.symtab	0x19558	80	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_noprog	.symtab	0x19634	76	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_progvers	.symtab	0x19680	96	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x14aac	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x13384	44	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x16bd8	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x1e0e0	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1343c	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x16aa0	40	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1c23c	188	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x13508	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x133c4	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xf90c	76	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x16c10	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x16c80	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x16c60	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x133f8	44	FUNC	<unknown>	HIDDEN	2
__GI_xdr_accepted_reply	.symtab	0x19420	140	FUNC	<unknown>	HIDDEN	2
__GI_xdr_array	.symtab	0x1d16c	316	FUNC	<unknown>	HIDDEN	2
__GI_xdr_authunix_parms	.symtab	0x1cb90	156	FUNC	<unknown>	HIDDEN	2
__GI_xdr_bool	.symtab	0x1a3ec	144	FUNC	<unknown>	HIDDEN	2
__GI_xdr_bytes	.symtab	0x1a700	232	FUNC	<unknown>	HIDDEN	2
__GI_xdr_callhdr	.symtab	0x19288	136	FUNC	<unknown>	HIDDEN	2
__GI_xdr_enum	.symtab	0x1a47c	4	FUNC	<unknown>	HIDDEN	2
__GI_xdr_hyper	.symtab	0x1a118	232	FUNC	<unknown>	HIDDEN	2
__GI_xdr_int	.symtab	0x1a0a0	4	FUNC	<unknown>	HIDDEN	2
__GI_xdr_long	.symtab	0x19fc8	72	FUNC	<unknown>	HIDDEN	2
__GI_xdr_opaque	.symtab	0x1a480	200	FUNC	<unknown>	HIDDEN	2
__GI_xdr_opaque_auth	.symtab	0x193f0	48	FUNC	<unknown>	HIDDEN	2
__GI_xdr_pmap	.symtab	0x19110	88	FUNC	<unknown>	HIDDEN	2
__GI_xdr_rejected_reply	.symtab	0x19310	108	FUNC	<unknown>	HIDDEN	2
__GI_xdr_replymsg	.symtab	0x1937c	108	FUNC	<unknown>	HIDDEN	2
__GI_xdr_short	.symtab	0x1a010	144	FUNC	<unknown>	HIDDEN	2
__GI_xdr_string	.symtab	0x1a5d0	280	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_hyper	.symtab	0x1a200	232	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_int	.symtab	0x1a114	4	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_long	.symtab	0x1a0a4	112	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_short	.symtab	0x1a2f0	140	FUNC	<unknown>	HIDDEN	2
__GI_xdr_union	.symtab	0x1a548	136	FUNC	<unknown>	HIDDEN	2
__GI_xdr_void	.symtab	0x19fc0	8	FUNC	<unknown>	HIDDEN	2
__GI_xdrmem_create	.symtab	0x1a7f8	32	FUNC	<unknown>	HIDDEN	2
__GI_xprt_register	.symtab	0x19bac	288	FUNC	<unknown>	HIDDEN	2
__GI_xprt_unregister	.symtab	0x19a9c	144	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2c014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x2c014	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x1eb04	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xd6dc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x1ec2c	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xd6dc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xd41c	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xd514	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x38cd8	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x30880	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x15288	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x38ffc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x308dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x308dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x16504	56	FUNC	<unknown>	DEFAULT	2
__cmsg_nxthdr	.symtab	0x1baec	88	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x30564	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x308d4	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x3056c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x38e10	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x2c020	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x1db58	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1e8a8	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1da30	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x12948	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x12944	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xd6dc	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x1eb04	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x1ab6c	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1ec44	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__drand48_iterate	.symtab	0x1dfbc	252	FUNC	<unknown>	HIDDEN	2
__dso_handle	.symtab	0x2c024	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1e800	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1d948	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1dae8	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x38ffc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x38cd0	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0xd7bc	16	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x12930	0	NOTYPE	<unknown>	DEFAULT	2
__error	.symtab	0x16ac4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x38cc4	4	OBJECT	<unknown>	HIDDEN	10
__exit_count	.symtab	0x38e04	4	OBJECT	<unknown>	HIDDEN	10
__exit_function_table	.symtab	0x38e08	4	OBJECT	<unknown>	HIDDEN	10
__exit_handler	.symtab	0x1b8f4	148	FUNC	<unknown>	HIDDEN	2
__exit_handler.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_slots	.symtab	0x38e0c	4	OBJECT	<unknown>	HIDDEN	10
__fake_pread_write	.symtab	0x13054	184	FUNC	<unknown>	DEFAULT	2
__fake_pread_write64	.symtab	0x12ef8	236	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1e18c	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x2c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fork	.symtab	0xe3f4	404	FUNC	<unknown>	HIDDEN	2
__fresetlockfiles	.symtab	0x11b4c	96	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x1b64c	72	FUNC	<unknown>	HIDDEN	2
__get_myaddress	.symtab	0x1cd88	360	FUNC	<unknown>	DEFAULT	2
__getpagesize	.symtab	0x12b40	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x14974	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0xd7ac	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x15648	148	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1b7ac	140	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x15710	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x156dc	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x156fc	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x2c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x2c000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x1e974	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x1db44	20	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x14f64	44	FUNC	<unknown>	DEFAULT	2
__libc_allocate_rtsig	.symtab	0xfe78	84	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x12a90	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x14f90	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x12e28	16	FUNC	<unknown>	DEFAULT	2
__libc_current_sigrtmax	.symtab	0xfe68	16	FUNC	<unknown>	DEFAULT	2
__libc_current_sigrtmin	.symtab	0xfe58	16	FUNC	<unknown>	DEFAULT	2
__libc_drand48_data	.symtab	0x38fe4	24	OBJECT	<unknown>	HIDDEN	10
__libc_fcntl	.symtab	0x1294c	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x129c0	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x12abc	44	FUNC	<unknown>	DEFAULT	2
__libc_fsync	.symtab	0x12ae8	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x12b58	44	FUNC	<unknown>	DEFAULT	2
__libc_longjmp	.symtab	0x12ce8	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x12d1c	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x12c84	100	FUNC	<unknown>	DEFAULT	2
__libc_msync	.symtab	0x12d48	44	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x38cc8	4	OBJECT	<unknown>	HIDDEN	10
__libc_multiple_threads_ptr	.symtab	0x34a6c	4	OBJECT	<unknown>	DEFAULT	10
__libc_nanosleep	.symtab	0x12da0	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x12dcc	92	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2025 20:12:59.405827045 CET	48146	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:12:59.410836935 CET	666	48146	94.154.35.238	192.168.2.15
Jan 20, 2025 20:12:59.411111116 CET	48146	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:12:59.411618948 CET	48146	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:12:59.416443110 CET	666	48146	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:01.243115902 CET	666	48146	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:01.243776083 CET	48146	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:01.248801947 CET	666	48146	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:16.261392117 CET	48148	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:16.266733885 CET	666	48148	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:16.266956091 CET	48148	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:16.267112970 CET	48148	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:16.272237062 CET	666	48148	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:18.024342060 CET	666	48148	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:18.024523973 CET	48148	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:18.029382944 CET	666	48148	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:33.038429022 CET	48150	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:33.043665886 CET	666	48150	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:33.043817997 CET	48150	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:33.043883085 CET	48150	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:33.048751116 CET	666	48150	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:34.837769032 CET	666	48150	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:34.838191032 CET	48150	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:34.843061924 CET	666	48150	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:49.845920086 CET	48152	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:49.851481915 CET	666	48152	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:49.851963997 CET	48152	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:49.851963997 CET	48152	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:49.857335091 CET	666	48152	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:51.624018908 CET	666	48152	94.154.35.238	192.168.2.15
Jan 20, 2025 20:13:51.624486923 CET	48152	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:13:51.629481077 CET	666	48152	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:06.633986950 CET	48154	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:06.639622927 CET	666	48154	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:06.639915943 CET	48154	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:06.640162945 CET	48154	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:06.645452976 CET	666	48154	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:08.428572893 CET	666	48154	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:08.429287910 CET	48154	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:08.434873104 CET	666	48154	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:23.439538002 CET	48156	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:23.444503069 CET	666	48156	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:23.444761038 CET	48156	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:23.444890022 CET	48156	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:23.449820042 CET	666	48156	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:25.239685059 CET	666	48156	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:25.240396976 CET	48156	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:25.245579004 CET	666	48156	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:40.254049063 CET	48158	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:40.259418011 CET	666	48158	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:40.259510040 CET	48158	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:40.259730101 CET	48158	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:40.264709949 CET	666	48158	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:42.074366093 CET	666	48158	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:42.074918985 CET	48158	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:42.079824924 CET	666	48158	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:57.085675001 CET	48160	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:57.090775013 CET	666	48160	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:57.090883970 CET	48160	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:57.090924978 CET	48160	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:57.095757961 CET	666	48160	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:58.854496956 CET	666	48160	94.154.35.238	192.168.2.15
Jan 20, 2025 20:14:58.854742050 CET	48160	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:14:58.859664917 CET	666	48160	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:13.865120888 CET	48162	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:13.870242119 CET	666	48162	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:13.870429993 CET	48162	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:13.870871067 CET	48162	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:13.876092911 CET	666	48162	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:15.643831968 CET	666	48162	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:15.644686937 CET	48162	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:15.649828911 CET	666	48162	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:30.658618927 CET	48164	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:30.663820982 CET	666	48164	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:30.663932085 CET	48164	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:30.664097071 CET	48164	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:30.669025898 CET	666	48164	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:32.422075033 CET	666	48164	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:32.422709942 CET	48164	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:32.427819014 CET	666	48164	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:47.430341005 CET	48166	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:47.435687065 CET	666	48166	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:47.435870886 CET	48166	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:47.435870886 CET	48166	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:47.441253901 CET	666	48166	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:49.230027914 CET	666	48166	94.154.35.238	192.168.2.15
Jan 20, 2025 20:15:49.230390072 CET	48166	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:15:49.235651970 CET	666	48166	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:04.235410929 CET	48168	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:04.240570068 CET	666	48168	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:04.240653992 CET	48168	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:04.240735054 CET	48168	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:04.245544910 CET	666	48168	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:06.023117065 CET	666	48168	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:06.023379087 CET	48168	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:06.028342962 CET	666	48168	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:21.030523062 CET	48170	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:21.035726070 CET	666	48170	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:21.035861015 CET	48170	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:21.035974979 CET	48170	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:21.040885925 CET	666	48170	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:22.801392078 CET	666	48170	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:22.801965952 CET	48170	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:22.807065010 CET	666	48170	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:37.808092117 CET	48172	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:37.813469887 CET	666	48172	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:37.813679934 CET	48172	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:37.813679934 CET	48172	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:37.819093943 CET	666	48172	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:39.594876051 CET	666	48172	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:39.597938061 CET	48172	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:39.603355885 CET	666	48172	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:54.603477955 CET	48174	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:54.608858109 CET	666	48174	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:54.608966112 CET	48174	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:54.608966112 CET	48174	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:54.614156961 CET	666	48174	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:56.374157906 CET	666	48174	94.154.35.238	192.168.2.15
Jan 20, 2025 20:16:56.374520063 CET	48174	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:16:56.379730940 CET	666	48174	94.154.35.238	192.168.2.15
Jan 20, 2025 20:17:11.380287886 CET	48176	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:17:11.385797977 CET	666	48176	94.154.35.238	192.168.2.15
Jan 20, 2025 20:17:11.386012077 CET	48176	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:17:11.386013031 CET	48176	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:17:11.391448021 CET	666	48176	94.154.35.238	192.168.2.15
Jan 20, 2025 20:17:13.159055948 CET	666	48176	94.154.35.238	192.168.2.15
Jan 20, 2025 20:17:13.159462929 CET	48176	666	192.168.2.15	94.154.35.238
Jan 20, 2025 20:17:13.164715052 CET	666	48176	94.154.35.238	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2025 20:15:42.801115990 CET	43950	53	192.168.2.15	8.8.8.8
Jan 20, 2025 20:15:42.801208019 CET	60402	53	192.168.2.15	8.8.8.8
Jan 20, 2025 20:15:42.808147907 CET	53	60402	8.8.8.8	192.168.2.15
Jan 20, 2025 20:15:42.808597088 CET	53	43950	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 20, 2025 20:15:42.801115990 CET	192.168.2.15	8.8.8.8	0xf296	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 20, 2025 20:15:42.801208019 CET	192.168.2.15	8.8.8.8	0x45c9	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 20, 2025 20:15:42.808597088 CET	8.8.8.8	192.168.2.15	0xf296	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 20, 2025 20:15:42.808597088 CET	8.8.8.8	192.168.2.15	0xf296	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: armv5l.elf PID: 5533, Parent PID: 5450

General

Start time (UTC):	19:12:58
Start date (UTC):	20/01/2025
Path:	/tmp/armv5l.elf
Arguments:	/tmp/armv5l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv5l.elf PID: 5535, Parent PID: 5533

General

Start time (UTC):	19:12:58
Start date (UTC):	20/01/2025
Path:	/tmp/armv5l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report armv5l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: armv5l.elf PID: 5533, Parent PID: 5450

General

Chronological Activities

Analysis Process: armv5l.elf PID: 5535, Parent PID: 5533

General

Chronological Activities

Linux Analysis Report
armv5l.elf