Edit tour

Linux Analysis Report
armv4l.elf

Overview

General Information

Sample name:	armv4l.elf
Analysis ID:	1595389
MD5:	755bff56c2f7ba4e313b87ede6d685f5
SHA1:	99a91d17243be25380563cf787794aa8fc827969
SHA256:	9392f4ef143939c2c0525247736a27a1e54560bae8a6afe43e2238c8c3db3bf3
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1595389
Start date and time:	2025-01-20 20:17:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	armv4l.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/armv4l.elf
PID:	5494
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

armv4l.elf (PID: 5494, Parent: 5419, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/armv4l.elf

armv4l.elf New Fork (PID: 5496, Parent: 5494)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
armv4l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
armv4l.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
armv4l.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5494.1.00007f0be8017000.00007f0be8034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5494.1.00007f0be8017000.00007f0be8034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: armv4l.elf PID: 5494	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: armv4l.elf PID: 5494	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x32b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3306:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x331a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x332e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3342:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3356:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x336a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x337e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3392:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x340a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x341e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3432:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3446:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: armv4l.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: armv4l.elf	Virustotal: Detection: 58%			Perma Link
Source: armv4l.elf	ReversingLabs: Detection: 63%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/armv4l.elf (PID: 5494)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:56206 -> 94.154.35.238:666

Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238
Source: unknown	TCP traffic detected without corresponding DNS query: 94.154.35.238

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: armv4l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5494.1.00007f0be8017000.00007f0be8034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: armv4l.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: armv4l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5494.1.00007f0be8017000.00007f0be8034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: armv4l.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/0@2/0

Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: armv4l.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /tmp/armv4l.elf (PID: 5494)

Queries kernel information via 'uname':

Jump to behavior

Source: armv4l.elf, 5494.1.00007ffe47369000.00007ffe4738a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/armv4l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/armv4l.elf
Source: armv4l.elf, 5494.1.000055fc33769000.000055fc33897000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: armv4l.elf, 5494.1.000055fc33769000.000055fc33897000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: armv4l.elf, 5494.1.00007ffe47369000.00007ffe4738a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: armv4l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv4l.elf, type: SAMPLE
Source: Yara match	File source: 5494.1.00007f0be8017000.00007f0be8034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5494, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: armv4l.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: armv4l.elf, type: SAMPLE
Source: Yara match	File source: 5494.1.00007f0be8017000.00007f0be8034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: armv4l.elf PID: 5494, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
armv4l.elf	59%	Virustotal		Browse
armv4l.elf	63%	ReversingLabs	Linux.Backdoor.Gafgyt
armv4l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.154.35.238	unknown	Ukraine		49505	SELECTELRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
94.154.35.238	ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	94.154.35.238-mips-2025-01-20T16_32_16.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	94.154.35.238-mipsel-2025-01-20T02_58_11.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	94.154.35.238-x86-2025-01-18T14_35_21.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	skid.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	37.114.46.58-skid.arm6-2025-01-20T12_15_18.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	37.114.46.58-skid.arm4-2025-01-20T12_00_03.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	loki.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	37.114.46.58-skid.ppc-2025-01-20T10_59_57.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	94.154.35.238-mips-2025-01-20T16_32_16.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	tKENar6l1f.exe	Get hash	malicious	LummaC Stealer	Browse	176.113.115.215
	94.154.35.238-mipsel-2025-01-20T02_58_11.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.154.35.238
	PgOfRNLIVK.exe	Get hash	malicious	LummaC, Amadey, Babadeda, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer	Browse	176.113.115.163
	7x1qzxFZXx.ps1	Get hash	malicious	PureCrypter	Browse	87.247.158.212
	7x1qzxFZXx.ps1	Get hash	malicious	PureCrypter	Browse	87.247.158.212

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.5914876255480275
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	armv4l.elf
File size:	196'859 bytes
MD5:	755bff56c2f7ba4e313b87ede6d685f5
SHA1:	99a91d17243be25380563cf787794aa8fc827969
SHA256:	9392f4ef143939c2c0525247736a27a1e54560bae8a6afe43e2238c8c3db3bf3
SHA512:	eddaa4a869b1ace6829820e8e9b4557fb5a00efde2258720a7c90585182ad5997cabf979c60d38766bcc3254e30184a1adfbdd97bacb084e9f49935cd8ae16c9
SSDEEP:	6144:u6x9u4gadLZ7ay2/KzH1/m/rGMXhZ4qZOm6mGDo8:9u4R8d+m/rGMXhCqZOm6mGDo8
TLSH:	E4141A01F8144F57C1C32BBAB79F46993B366B9897DB3301AA34BEB42F8638D1D29511
File Content Preview:	.ELF...a..........(.........4...l,......4. ...(......................................................H..............Q.td..................................-...L."....]..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	142444
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x17808	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f8b8	0x178b8	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f8cc	0x178cc	0x4848	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x24114	0x1c114	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x2c118	0x1c118	0xc	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x2c124	0x1c124	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c12c	0x1c12c	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x2c140	0x1c140	0x48bc	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x309fc	0x209fc	0x8720	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x209fc	0x111a	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x21b18	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x21c38	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x221b0	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x22264	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x22b24	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x22bc4	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22f8c	0x81e0	0x10	0x0		19	1122	4
.strtab	STRTAB	0x0	0x2b16c	0x4f8f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1c118	0x1c118	6.0594	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x1c118	0x2c118	0x2c118	0x48e4	0xd004	0.3566	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f8b8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f8cc	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x24114	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x2c118	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2c124	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2c12c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2c140	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x309fc	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f8b8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8c4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f87c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f8c8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xad60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb37c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc68c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd5f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe39c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf50c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1028c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1099c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1162c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1218c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1264c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1280c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1316c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1321c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1371c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1404c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1455c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1479c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1487c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1518c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1521c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1524c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1594c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1648c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1653c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1822c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1856c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1915c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1963c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b93c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c39c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d16c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e31c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e44c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e64c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c118	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x2c124	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2c148	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f8ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c14c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c150	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8f60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa1b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa22c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb1c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb370	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe398	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c1d0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x224d4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xecd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf16c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10270	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10308	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c11c	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x106dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x107d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10994	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x301e0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x224dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10cb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11dc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1204c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1216c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12370	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1241c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1279c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x224f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x128e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30680	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x30688	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x36bd4	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x1349c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30690	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x22b00	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13dcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1408c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14aa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1533c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x307cc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1593c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x308d4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x159b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x308ec	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15c28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2372c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15f7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x309a0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1628c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1647c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16588	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x309b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x16808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16988	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23784	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17fb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1898c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x309bc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1928c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x237ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1932c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19574	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x237fc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19a5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23814	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a6d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23880	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1acf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b79c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x309d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1b92c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bfc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c50c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x238f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1cdb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d06c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2398c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d2a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ddec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e11c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x309f0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1e2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e54c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e610	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e80c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e954	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23db8	0	NOTYPE	<unknown>	DEFAULT	4
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C2Host	.symtab	0x2c188	4	OBJECT	<unknown>	DEFAULT	9
C2Sock	.symtab	0x30a18	4	OBJECT	<unknown>	DEFAULT	10
CaptchaHex	.symtab	0xabf8	360	FUNC	<unknown>	DEFAULT	2
Datagram	.symtab	0x8fc8	1228	FUNC	<unknown>	DEFAULT	2
DevArch	.symtab	0x81cc	28	FUNC	<unknown>	DEFAULT	2
FRSTSV	.symtab	0x2c18c	4	OBJECT	<unknown>	DEFAULT	9
GetRandIP	.symtab	0x8f68	96	FUNC	<unknown>	DEFAULT	2
HTTPHex	.symtab	0xaa8c	364	FUNC	<unknown>	DEFAULT	2
Hexed	.symtab	0xa010	420	FUNC	<unknown>	DEFAULT	2
HoHoHo	.symtab	0x9b04	1292	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x14748	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x30a2c	16384	OBJECT	<unknown>	DEFAULT	10
Transmission	.symtab	0x9494	1648	FUNC	<unknown>	DEFAULT	2
VSEPacket	.symtab	0xa23c	308	FUNC	<unknown>	DEFAULT	2
ValveSourced	.symtab	0xa370	1820	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x2c120	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x2c118	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x30680	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x22500	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x309f0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x23a02	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x30688	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x22800	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2c128	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x2c124	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x24114	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x24114	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x30680	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x22500	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x309f0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x23a02	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x30688	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x22800	768	OBJECT	<unknown>	HIDDEN	4
__GI___cmsg_nxthdr	.symtab	0x1bc7c	88	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x30684	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x309f4	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x3068c	4	OBJECT	<unknown>	HIDDEN	9
__GI___fgetc_unlocked	.symtab	0x1e31c	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x14974	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x16c04	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x12948	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x129bc	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x12d18	44	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x12dc8	92	FUNC	<unknown>	HIDDEN	2
__GI___libc_open64	.symtab	0x12e34	60	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x16a80	20	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_createerr	.symtab	0x16968	40	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_svc_fdset	.symtab	0x16990	36	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_svc_max_pollfd	.symtab	0x16918	40	FUNC	<unknown>	HIDDEN	2
__GI___rpc_thread_svc_pollfd	.symtab	0x16940	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1648c	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1653c	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x14988	232	FUNC	<unknown>	HIDDEN	2
__GI__authenticate	.symtab	0x19e5c	112	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x12a38	40	FUNC	<unknown>	HIDDEN	2
__GI__rpc_dtablesize	.symtab	0x1d280	40	FUNC	<unknown>	HIDDEN	2
__GI__seterr_reply	.symtab	0x192f8	288	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x15804	328	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x14f64	44	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x15f88	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x15f88	12	FUNC	<unknown>	HIDDEN	2
__GI_authnone_create	.symtab	0x1cc54	204	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1e120	44	FUNC	<unknown>	HIDDEN	2
__GI_bindresvport	.symtab	0x1cdbc	348	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1bc40	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x12a60	44	FUNC	<unknown>	HIDDEN	2
__GI_clnt_perror	.symtab	0x1e974	28	FUNC	<unknown>	HIDDEN	2
__GI_clnt_spcreateerror	.symtab	0x1e678	256	FUNC	<unknown>	HIDDEN	2
__GI_clnt_sperrno	.symtab	0x1e5d0	76	FUNC	<unknown>	HIDDEN	2
__GI_clnt_sperror	.symtab	0x1e794	480	FUNC	<unknown>	HIDDEN	2
__GI_clntudp_bufcreate	.symtab	0x186d8	620	FUNC	<unknown>	HIDDEN	2
__GI_clntudp_create	.symtab	0x18944	76	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x12a8c	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x14f90	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x36bd4	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x161fc	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x16ad0	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x16134	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1bcd4	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x12948	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x129bc	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1c6e8	484	FUNC	<unknown>	HIDDEN	2
__GI_ffs	.symtab	0x1cb70	92	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1e31c	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1c488	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1c8cc	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1be54	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x12ab8	44	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1e2ec	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x1c51c	140	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1455c	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1be60	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1bea8	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x14590	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1e31c	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1e248	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x16afc	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x12b10	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x16b28	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x14bac	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x14bf0	884	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x12b3c	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x12b54	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x12bac	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x14fbc	44	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x12bd8	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x16b54	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x36bd8	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x14b88	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1ac10	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1d878	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1d504	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x15d88	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x12c04	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x14a7c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x12c54	44	FUNC	<unknown>	HIDDEN	2
__GI_lrand48_r	.symtab	0x1b9c8	12	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x12d18	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x12c80	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x17ec0	252	FUNC	<unknown>	HIDDEN	2
__GI_memcmp	.symtab	0x1c970	44	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x14650	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17eb0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x17fbc	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x17fd4	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x14660	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x127ac	96	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x12d70	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0xfc50	68	FUNC	<unknown>	HIDDEN	2
__GI_nrand48_r	.symtab	0x1b9d4	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x12dc8	92	FUNC	<unknown>	HIDDEN	2
__GI_open64	.symtab	0x12e34	60	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x1e2a4	72	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x12e9c	44	FUNC	<unknown>	HIDDEN	2
__GI_pmap_getport	.symtab	0x1915c	324	FUNC	<unknown>	HIDDEN	2
__GI_pmap_set	.symtab	0x1d16c	276	FUNC	<unknown>	HIDDEN	2
__GI_pmap_unset	.symtab	0x1d080	236	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x12ec8	44	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x1be6c	60	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_destroy	.symtab	0x10a48	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getdetachstate	.symtab	0x10a68	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getinheritsched	.symtab	0x10ab8	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getschedparam	.symtab	0x10bdc	32	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getschedpolicy	.symtab	0x10a90	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_getscope	.symtab	0x10aec	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_init	.symtab	0x10b58	68	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setdetachstate	.symtab	0x10a50	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setinheritsched	.symtab	0x10aa0	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setschedparam	.symtab	0x10bfc	84	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setschedpolicy	.symtab	0x10a78	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_attr_setscope	.symtab	0x10ac8	36	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_broadcast	.symtab	0x11120	88	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_destroy	.symtab	0x1108c	20	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_init	.symtab	0x11074	24	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_signal	.symtab	0x115dc	80	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_timedwait	.symtab	0x11240	516	FUNC	<unknown>	HIDDEN	2
__GI_pthread_cond_wait	.symtab	0x11444	408	FUNC	<unknown>	HIDDEN	2
__GI_pthread_condattr_destroy	.symtab	0x110a8	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_condattr_init	.symtab	0x110a0	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_equal	.symtab	0xfecc	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_exit	.symtab	0x11864	8	FUNC	<unknown>	HIDDEN	2
__GI_pthread_getschedparam	.symtab	0x1099c	172	FUNC	<unknown>	HIDDEN	2
__GI_pthread_self	.symtab	0xff88	16	FUNC	<unknown>	HIDDEN	2
__GI_pthread_setcancelstate	.symtab	0x10eb0	92	FUNC	<unknown>	HIDDEN	2
__GI_pthread_setcanceltype	.symtab	0x10e54	92	FUNC	<unknown>	HIDDEN	2
__GI_pthread_setschedparam	.symtab	0x108d8	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0xf170	48	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x15950	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x15c2c	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1c9a0	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x13140	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x15018	44	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x15044	52	FUNC	<unknown>	HIDDEN	2
__GI_recvmsg	.symtab	0x15078	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x16b80	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x13274	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x150a4	44	FUNC	<unknown>	HIDDEN	2
__GI_sendmsg	.symtab	0x150d0	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x150fc	52	FUNC	<unknown>	HIDDEN	2
__GI_setrlimit	.symtab	0x132a4	44	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x132d0	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x15130	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x15b6c	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0xee44	304	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1518c	48	FUNC	<unknown>	HIDDEN	2
__GI_sigdelset	.symtab	0x151bc	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x151ec	24	FUNC	<unknown>	HIDDEN	2
__GI_sigfillset	.symtab	0x15204	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x15288	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x132fc	84	FUNC	<unknown>	HIDDEN	2
__GI_sigsuspend	.symtab	0x13350	48	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x16290	420	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x134a0	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x15160	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x134d0	52	FUNC	<unknown>	HIDDEN	2
__GI_srand48_r	.symtab	0x1ba1c	104	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x15cbc	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1e554	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1e44c	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x14700	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x14700	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x14780	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1cbcc	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x14720	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x1ca58	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x180c0	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1479c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x181ec	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1cb20	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1487c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x14a70	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x18178	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x15f94	8	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreq	.symtab	0x19ac0	68	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreq_common	.symtab	0x198c0	416	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreq_poll	.symtab	0x19cbc	128	FUNC	<unknown>	HIDDEN	2
__GI_svc_getreqset	.symtab	0x19a60	96	FUNC	<unknown>	HIDDEN	2
__GI_svc_register	.symtab	0x19b88	164	FUNC	<unknown>	HIDDEN	2
__GI_svc_sendreply	.symtab	0x1963c	92	FUNC	<unknown>	HIDDEN	2
__GI_svc_unregister	.symtab	0x19b04	96	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_auth	.symtab	0x19788	52	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_decode	.symtab	0x196e8	80	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_noprog	.symtab	0x197c4	76	FUNC	<unknown>	HIDDEN	2
__GI_svcerr_progvers	.symtab	0x19810	96	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x14aac	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x13380	44	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x16bd8	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x1e270	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x13438	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x16aa0	40	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1c3cc	188	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x13504	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x133c0	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xf90c	76	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x16c10	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x16c80	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x16c60	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x133f4	44	FUNC	<unknown>	HIDDEN	2
__GI_xdr_accepted_reply	.symtab	0x195b0	140	FUNC	<unknown>	HIDDEN	2
__GI_xdr_array	.symtab	0x1d2fc	316	FUNC	<unknown>	HIDDEN	2
__GI_xdr_authunix_parms	.symtab	0x1cd20	156	FUNC	<unknown>	HIDDEN	2
__GI_xdr_bool	.symtab	0x1a57c	144	FUNC	<unknown>	HIDDEN	2
__GI_xdr_bytes	.symtab	0x1a890	232	FUNC	<unknown>	HIDDEN	2
__GI_xdr_callhdr	.symtab	0x19418	136	FUNC	<unknown>	HIDDEN	2
__GI_xdr_enum	.symtab	0x1a60c	4	FUNC	<unknown>	HIDDEN	2
__GI_xdr_hyper	.symtab	0x1a2a8	232	FUNC	<unknown>	HIDDEN	2
__GI_xdr_int	.symtab	0x1a230	4	FUNC	<unknown>	HIDDEN	2
__GI_xdr_long	.symtab	0x1a158	72	FUNC	<unknown>	HIDDEN	2
__GI_xdr_opaque	.symtab	0x1a610	200	FUNC	<unknown>	HIDDEN	2
__GI_xdr_opaque_auth	.symtab	0x19580	48	FUNC	<unknown>	HIDDEN	2
__GI_xdr_pmap	.symtab	0x192a0	88	FUNC	<unknown>	HIDDEN	2
__GI_xdr_rejected_reply	.symtab	0x194a0	108	FUNC	<unknown>	HIDDEN	2
__GI_xdr_replymsg	.symtab	0x1950c	108	FUNC	<unknown>	HIDDEN	2
__GI_xdr_short	.symtab	0x1a1a0	144	FUNC	<unknown>	HIDDEN	2
__GI_xdr_string	.symtab	0x1a760	280	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_hyper	.symtab	0x1a390	232	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_int	.symtab	0x1a2a4	4	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_long	.symtab	0x1a234	112	FUNC	<unknown>	HIDDEN	2
__GI_xdr_u_short	.symtab	0x1a480	140	FUNC	<unknown>	HIDDEN	2
__GI_xdr_union	.symtab	0x1a6d8	136	FUNC	<unknown>	HIDDEN	2
__GI_xdr_void	.symtab	0x1a150	8	FUNC	<unknown>	HIDDEN	2
__GI_xdrmem_create	.symtab	0x1a988	32	FUNC	<unknown>	HIDDEN	2
__GI_xprt_register	.symtab	0x19d3c	288	FUNC	<unknown>	HIDDEN	2
__GI_xprt_unregister	.symtab	0x19c2c	144	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2c12c	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x2c12c	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x1ede0	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x1f7b0	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x1f7b0	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x1f794	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x1f828	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x1ede0	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x1f7c4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x1f800	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x1f814	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x1f7ec	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x1f7d8	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x1f4fc	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x1f1d4	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x1edd4	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x1eddc	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x1f114	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x1f0e8	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x1ec94	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xd6dc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x1edbc	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x1f168	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xd6dc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1f0c0	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xd41c	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xd514	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x1f154	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x38df8	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x309a0	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x15288	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x3911c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x309fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x309fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x16504	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f710	132	FUNC	<unknown>	DEFAULT	2
__cmsg_nxthdr	.symtab	0x1bc7c	88	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x30684	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x309f4	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x3068c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x38f30	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x2c140	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x1dce8	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1ea38	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1dbc0	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x12944	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x12940	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xd6dc	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x1f4fc	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x1ec94	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x1acfc	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1f87c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__drand48_iterate	.symtab	0x1e14c	252	FUNC	<unknown>	HIDDEN	2
__dso_handle	.symtab	0x2c144	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1e990	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1dad8	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1dc78	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x3911c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x38df0	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x1f710	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0xd7bc	16	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x12930	0	NOTYPE	<unknown>	DEFAULT	2
__error	.symtab	0x16ac4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x38de4	4	OBJECT	<unknown>	HIDDEN	10
__exit_count	.symtab	0x38f24	4	OBJECT	<unknown>	HIDDEN	10
__exit_function_table	.symtab	0x38f28	4	OBJECT	<unknown>	HIDDEN	10
__exit_handler	.symtab	0x1ba84	148	FUNC	<unknown>	HIDDEN	2
__exit_handler.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_slots	.symtab	0x38f2c	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x1f114	64	FUNC	<unknown>	DEFAULT	2
__fake_pread_write	.symtab	0x13050	184	FUNC	<unknown>	DEFAULT	2
__fake_pread_write64	.symtab	0x12ef4	236	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1e31c	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2c118	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x2c118	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x1f828	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x1f168	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x1f0e8	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x1f154	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x1f0c0	40	FUNC	<unknown>	DEFAULT	2
__fork	.symtab	0xe3f4	404	FUNC	<unknown>	HIDDEN	2
__fresetlockfiles	.symtab	0x11b4c	96	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x1f700	148	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2025 20:18:38.574398041 CET	56206	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:38.579615116 CET	666	56206	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:38.579794884 CET	56206	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:38.580161095 CET	56206	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:38.585037947 CET	666	56206	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:40.374785900 CET	666	56206	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:40.375932932 CET	56206	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:40.380863905 CET	666	56206	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:55.388520002 CET	56208	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:55.393876076 CET	666	56208	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:55.394001961 CET	56208	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:55.394125938 CET	56208	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:55.399133921 CET	666	56208	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:57.162731886 CET	666	56208	94.154.35.238	192.168.2.13
Jan 20, 2025 20:18:57.163300991 CET	56208	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:18:57.168385029 CET	666	56208	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:12.172935009 CET	56210	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:12.178575039 CET	666	56210	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:12.178802967 CET	56210	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:12.178802967 CET	56210	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:12.184019089 CET	666	56210	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:13.965882063 CET	666	56210	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:13.966764927 CET	56210	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:13.972022057 CET	666	56210	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:28.974772930 CET	56212	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:28.980087042 CET	666	56212	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:28.980168104 CET	56212	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:28.980189085 CET	56212	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:28.985338926 CET	666	56212	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:30.785804033 CET	666	56212	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:30.786133051 CET	56212	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:30.786133051 CET	56212	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:30.791501045 CET	666	56212	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:45.796292067 CET	56214	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:45.802748919 CET	666	56214	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:45.802860975 CET	56214	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:45.802901983 CET	56214	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:45.809333086 CET	666	56214	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:47.582056999 CET	666	56214	94.154.35.238	192.168.2.13
Jan 20, 2025 20:19:47.582232952 CET	56214	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:19:47.587482929 CET	666	56214	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:02.592953920 CET	56216	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:02.598205090 CET	666	56216	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:02.598344088 CET	56216	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:02.598433018 CET	56216	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:02.603282928 CET	666	56216	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:04.363122940 CET	666	56216	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:04.363637924 CET	56216	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:04.368868113 CET	666	56216	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:19.373022079 CET	56218	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:19.378078938 CET	666	56218	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:19.378175020 CET	56218	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:19.378237963 CET	56218	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:19.383855104 CET	666	56218	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:21.200475931 CET	666	56218	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:21.200793028 CET	56218	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:21.206079960 CET	666	56218	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:36.209513903 CET	56220	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:36.214623928 CET	666	56220	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:36.214704990 CET	56220	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:36.214732885 CET	56220	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:36.219639063 CET	666	56220	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:38.014723063 CET	666	56220	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:38.015098095 CET	56220	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:38.020155907 CET	666	56220	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:53.021137953 CET	56222	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:53.026253939 CET	666	56222	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:53.026350975 CET	56222	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:53.026412964 CET	56222	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:53.031254053 CET	666	56222	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:54.809097052 CET	666	56222	94.154.35.238	192.168.2.13
Jan 20, 2025 20:20:54.809434891 CET	56222	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:20:54.814246893 CET	666	56222	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:09.816200018 CET	56224	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:09.821280003 CET	666	56224	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:09.821365118 CET	56224	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:09.821408033 CET	56224	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:09.826244116 CET	666	56224	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:11.587594032 CET	666	56224	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:11.588017941 CET	56224	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:11.593005896 CET	666	56224	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:26.594470978 CET	56226	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:26.599409103 CET	666	56226	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:26.599513054 CET	56226	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:26.599556923 CET	56226	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:26.604401112 CET	666	56226	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:28.373361111 CET	666	56226	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:28.373692036 CET	56226	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:28.379453897 CET	666	56226	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:43.378897905 CET	56228	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:43.383776903 CET	666	56228	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:43.383897066 CET	56228	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:43.383944988 CET	56228	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:43.388855934 CET	666	56228	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:45.151727915 CET	666	56228	94.154.35.238	192.168.2.13
Jan 20, 2025 20:21:45.151968002 CET	56228	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:21:45.156893015 CET	666	56228	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:00.157635927 CET	56230	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:00.162520885 CET	666	56230	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:00.162631035 CET	56230	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:00.162672043 CET	56230	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:00.167416096 CET	666	56230	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:01.929408073 CET	666	56230	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:01.929752111 CET	56230	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:01.934565067 CET	666	56230	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:16.935858011 CET	56232	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:16.940886974 CET	666	56232	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:16.940973997 CET	56232	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:16.941015959 CET	56232	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:16.946336985 CET	666	56232	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:18.709323883 CET	666	56232	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:18.709656954 CET	56232	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:18.714574099 CET	666	56232	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:33.716598988 CET	56234	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:33.722270012 CET	666	56234	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:33.722398996 CET	56234	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:33.722451925 CET	56234	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:33.727906942 CET	666	56234	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:35.514873028 CET	666	56234	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:35.515350103 CET	56234	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:35.520315886 CET	666	56234	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:50.522716999 CET	56236	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:50.527717113 CET	666	56236	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:50.527784109 CET	56236	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:50.527821064 CET	56236	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:50.532679081 CET	666	56236	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:52.305732012 CET	666	56236	94.154.35.238	192.168.2.13
Jan 20, 2025 20:22:52.306005955 CET	56236	666	192.168.2.13	94.154.35.238
Jan 20, 2025 20:22:52.310908079 CET	666	56236	94.154.35.238	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 20, 2025 20:21:22.759617090 CET	37046	53	192.168.2.13	1.1.1.1
Jan 20, 2025 20:21:22.759617090 CET	34281	53	192.168.2.13	1.1.1.1
Jan 20, 2025 20:21:22.767153025 CET	53	34281	1.1.1.1	192.168.2.13
Jan 20, 2025 20:21:22.767848015 CET	53	37046	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 20, 2025 20:21:22.759617090 CET	192.168.2.13	1.1.1.1	0xbf36	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 20, 2025 20:21:22.759617090 CET	192.168.2.13	1.1.1.1	0x7e26	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 20, 2025 20:21:22.767848015 CET	1.1.1.1	192.168.2.13	0xbf36	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 20, 2025 20:21:22.767848015 CET	1.1.1.1	192.168.2.13	0xbf36	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: armv4l.elf PID: 5494, Parent PID: 5419

General

Start time (UTC):	19:18:37
Start date (UTC):	20/01/2025
Path:	/tmp/armv4l.elf
Arguments:	/tmp/armv4l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: armv4l.elf PID: 5496, Parent PID: 5494

General

Start time (UTC):	19:18:37
Start date (UTC):	20/01/2025
Path:	/tmp/armv4l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report armv4l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: armv4l.elf PID: 5494, Parent PID: 5419

General

Chronological Activities

Analysis Process: armv4l.elf PID: 5496, Parent PID: 5494

General

Chronological Activities

Linux Analysis Report
armv4l.elf