Play interactive tour

Edit tour

Linux Analysis Report s7vKdnDi77

Overview

General Information

Sample Name:	s7vKdnDi77
Analysis ID:	553138
MD5:	c7004f16f15c92e4acd0d78825329a56
SHA1:	08759270368ad69eab73219cc032a3dca620f1da
SHA256:	1ed43a0a7805aff1bae9db3a9cdd0a45ceb3fbd18f84ce7d8cf0c4d49d918838
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Contains symbols with names commonly found in malware

Yara signature match

Sample contains strings indicative of password brute-forcing capabilities

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553138
Start date:	14.01.2022
Start time:	11:24:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	s7vKdnDi77
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal96.troj.lin@0/0@0/0
Warnings:	Show All Report size exceeded maximum capacity and may have missing network information. TCP Packets have been reduced to 100

Process Tree

system is lnxubuntu20

s7vKdnDi77 (PID: 5240, Parent: 5138, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/s7vKdnDi77

s7vKdnDi77 New Fork (PID: 5242, Parent: 5240)

s7vKdnDi77 New Fork (PID: 5244, Parent: 5242)

s7vKdnDi77 New Fork (PID: 5246, Parent: 5242)

s7vKdnDi77 New Fork (PID: 5247, Parent: 5242)

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
s7vKdnDi77	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x18194:$xo1: _}h{~~s='<" 0x18204:$xo1: _}h{~~s='<" 0x18274:$xo1: _}h{~~s='<" 0x182e4:$xo1: _}h{~~s='<" 0x18354:$xo1: _}h{~~s='<"
s7vKdnDi77	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x17108:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
s7vKdnDi77	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
s7vKdnDi77	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x18194:$xo1: _}h{~~s='<" 0x18204:$xo1: _}h{~~s='<" 0x18274:$xo1: _}h{~~s='<" 0x182e4:$xo1: _}h{~~s='<" 0x18354:$xo1: _}h{~~s='<"
5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x17108:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5240.1.0000000063017c71.000000008031ab92.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3a40:$xo1: _}h{~~s='<" 0x3ab8:$xo1: _}h{~~s='<" 0x3b30:$xo1: _}h{~~s='<" 0x3ba8:$xo1: _}h{~~s='<" 0x3c20:$xo1: _}h{~~s='<"
5246.1.0000000063017c71.000000008031ab92.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3a40:$xo1: _}h{~~s='<" 0x3ab8:$xo1: _}h{~~s='<" 0x3b30:$xo1: _}h{~~s='<" 0x3ba8:$xo1: _}h{~~s='<" 0x3c20:$xo1: _}h{~~s='<"
5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x18194:$xo1: _}h{~~s='<" 0x18204:$xo1: _}h{~~s='<" 0x18274:$xo1: _}h{~~s='<" 0x182e4:$xo1: _}h{~~s='<" 0x18354:$xo1: _}h{~~s='<"
5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x17108:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: s7vKdnDi77 PID: 5240	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1f45:$xo1: _}h{~~s='<" 0x1fd2:$xo1: _}h{~~s='<" 0x2022:$xo1: _}h{~~s='<" 0x2e38:$xo1: _}h{~~s='<" 0x2e8a:$xo1: _}h{~~s='<" 0x2f17:$xo1: _}h{~~s='<" 0x2f68:$xo1: _}h{~~s='<" 0x2fb8:$xo1: _}h{~~s='<"
Process Memory Space: s7vKdnDi77 PID: 5246	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x12bc3:$xo1: _}h{~~s='<" 0x12c50:$xo1: _}h{~~s='<" 0x12ca0:$xo1: _}h{~~s='<" 0x13bd4:$xo1: _}h{~~s='<" 0x13c26:$xo1: _}h{~~s='<" 0x13cb3:$xo1: _}h{~~s='<" 0x13d04:$xo1: _}h{~~s='<" 0x13d54:$xo1: _}h{~~s='<"
Click to see the 7 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: s7vKdnDi77	Virustotal: Detection: 59%	Perma Link
Source: s7vKdnDi77	Metadefender: Detection: 37%	Perma Link
Source: s7vKdnDi77	ReversingLabs: Detection: 62%

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 115.53.244.14:23 -> 192.168.2.23:36440
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 115.53.244.14:23 -> 192.168.2.23:36440
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46044
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46044
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46142
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46142
Source: Traffic	Snort IDS: 716 INFO TELNET access 123.142.76.198:23 -> 192.168.2.23:55886
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46316
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.64.214.57:23 -> 192.168.2.23:42890
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.204.52.1:23 -> 192.168.2.23:50546
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37104
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46316
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.204.52.1:23 -> 192.168.2.23:50614
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46514
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37104
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37104
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 209.112.186.138:23 -> 192.168.2.23:46566
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 209.112.186.138:23 -> 192.168.2.23:46566
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46514
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46576
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37258
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46576
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37258
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37258
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46648
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 115.53.244.14:23 -> 192.168.2.23:37106
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 115.53.244.14:23 -> 192.168.2.23:37106
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46648
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37406
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46756
Source: Traffic	Snort IDS: 716 INFO TELNET access 123.142.76.198:23 -> 192.168.2.23:56418
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46756
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37406
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37406
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.64.214.57:23 -> 192.168.2.23:43350
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51320
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46890
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51372
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46890
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37618
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47016
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51484
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37618
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37618
Source: Traffic	Snort IDS: 2023447 ET TROJAN Possible Linux.Mirai Login Attempt (service) 192.168.2.23:47112 -> 209.112.186.138:23
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47016
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51566
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 209.112.186.138:23 -> 192.168.2.23:47112
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 209.112.186.138:23 -> 192.168.2.23:47112
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51594
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39608
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47174
Source: Traffic	Snort IDS: 716 INFO TELNET access 115.89.185.158:23 -> 192.168.2.23:34988
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51666
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37900
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39696
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47174
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:33940
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:33940
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51778
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39814
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47378
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37900
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37900
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39910
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:43664
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51910
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47378
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51922
Source: Traffic	Snort IDS: 716 INFO TELNET access 123.142.76.198:23 -> 192.168.2.23:57122
Source: Traffic	Snort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51942
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.64.214.57:23 -> 192.168.2.23:44060
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47526
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:34226
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:34226
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39986
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:38196
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47526
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40030
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:43800
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:38196
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:38196
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:59908
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47608
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40076
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:59948
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47608
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:34378
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:34378
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40174
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:38384
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:43934
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47738
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60044
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60064
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36852
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36894
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36912
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:38384
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:38384
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47738
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40282
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36920
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36924
Source: Traffic	Snort IDS: 716 INFO TELNET access 115.89.185.158:23 -> 192.168.2.23:35626
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36942
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36950
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36954
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36978
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36982
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36986
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 209.112.186.138:23 -> 192.168.2.23:47896
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 209.112.186.138:23 -> 192.168.2.23:47896
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36984
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60214
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37006
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37010
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37014
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37020
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47942
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:44138
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37042
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37048
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37050
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40426
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37058
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:34630
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:34630
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37086
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37092
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37098
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37106
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37134
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37146
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60372
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37160
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37168
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.115.163.194:23 -> 192.168.2.23:34782
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47942
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 221.155.33.194:23 -> 192.168.2.23:57538
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 221.155.33.194:23 -> 192.168.2.23:57538
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37194
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37200
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37210
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60434
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37216
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:38810
Source: Traffic	Snort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40618
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37250
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37260
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37266
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37270
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37290
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37296
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37298
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37304
Source: Traffic	Snort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:48230
Source: Traffic	Snort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60516
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37322
Source: Traffic	Snort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37328
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 112.115.163.194:23 -> 192.168.2.23:34782

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35390
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35398
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35414
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35430
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35442
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35446
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35450
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35476
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35480
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35492
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35498
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35500
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35512
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35514
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35520
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35556
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57426
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57434
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57442
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57476
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57490
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57502
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57520
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57530
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57550
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57580
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57600
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57652
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57668
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57690
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57798
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57816

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: global traffic

TCP traffic: 192.168.2.23:39428 -> 109.237.96.10:16771

Source: /tmp/s7vKdnDi77 (PID: 5240)

Socket: 127.0.0.1::9473

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.237.96.10
Source: unknown	TCP traffic detected without corresponding DNS query: 179.152.52.55
Source: unknown	TCP traffic detected without corresponding DNS query: 83.2.90.160
Source: unknown	TCP traffic detected without corresponding DNS query: 152.152.127.54
Source: unknown	TCP traffic detected without corresponding DNS query: 220.115.20.26
Source: unknown	TCP traffic detected without corresponding DNS query: 128.99.42.49
Source: unknown	TCP traffic detected without corresponding DNS query: 165.47.168.40
Source: unknown	TCP traffic detected without corresponding DNS query: 222.77.217.211
Source: unknown	TCP traffic detected without corresponding DNS query: 153.84.214.109
Source: unknown	TCP traffic detected without corresponding DNS query: 108.191.9.10
Source: unknown	TCP traffic detected without corresponding DNS query: 183.161.149.26
Source: unknown	TCP traffic detected without corresponding DNS query: 126.85.218.158
Source: unknown	TCP traffic detected without corresponding DNS query: 148.168.95.159
Source: unknown	TCP traffic detected without corresponding DNS query: 180.42.181.127
Source: unknown	TCP traffic detected without corresponding DNS query: 40.63.80.3
Source: unknown	TCP traffic detected without corresponding DNS query: 95.53.136.208
Source: unknown	TCP traffic detected without corresponding DNS query: 35.197.189.106
Source: unknown	TCP traffic detected without corresponding DNS query: 146.253.81.113
Source: unknown	TCP traffic detected without corresponding DNS query: 199.52.99.108
Source: unknown	TCP traffic detected without corresponding DNS query: 92.185.158.253
Source: unknown	TCP traffic detected without corresponding DNS query: 102.242.177.197
Source: unknown	TCP traffic detected without corresponding DNS query: 207.235.142.149
Source: unknown	TCP traffic detected without corresponding DNS query: 17.76.13.215
Source: unknown	TCP traffic detected without corresponding DNS query: 187.169.23.117
Source: unknown	TCP traffic detected without corresponding DNS query: 211.155.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 164.96.72.64
Source: unknown	TCP traffic detected without corresponding DNS query: 211.181.176.110
Source: unknown	TCP traffic detected without corresponding DNS query: 118.205.227.152
Source: unknown	TCP traffic detected without corresponding DNS query: 206.211.49.208
Source: unknown	TCP traffic detected without corresponding DNS query: 157.22.237.202
Source: unknown	TCP traffic detected without corresponding DNS query: 113.227.19.160
Source: unknown	TCP traffic detected without corresponding DNS query: 152.88.182.158
Source: unknown	TCP traffic detected without corresponding DNS query: 139.151.39.235
Source: unknown	TCP traffic detected without corresponding DNS query: 1.204.61.234
Source: unknown	TCP traffic detected without corresponding DNS query: 223.70.146.149
Source: unknown	TCP traffic detected without corresponding DNS query: 73.66.22.178
Source: unknown	TCP traffic detected without corresponding DNS query: 24.184.140.0
Source: unknown	TCP traffic detected without corresponding DNS query: 104.7.129.78
Source: unknown	TCP traffic detected without corresponding DNS query: 194.216.87.166
Source: unknown	TCP traffic detected without corresponding DNS query: 63.185.220.145
Source: unknown	TCP traffic detected without corresponding DNS query: 216.225.5.196
Source: unknown	TCP traffic detected without corresponding DNS query: 187.71.94.135
Source: unknown	TCP traffic detected without corresponding DNS query: 222.38.0.160
Source: unknown	TCP traffic detected without corresponding DNS query: 101.19.252.3
Source: unknown	TCP traffic detected without corresponding DNS query: 148.229.20.43
Source: unknown	TCP traffic detected without corresponding DNS query: 179.84.203.140
Source: unknown	TCP traffic detected without corresponding DNS query: 87.1.115.98
Source: unknown	TCP traffic detected without corresponding DNS query: 75.218.47.46
Source: unknown	TCP traffic detected without corresponding DNS query: 137.138.184.242
Source: unknown	TCP traffic detected without corresponding DNS query: 152.18.190.84

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: s7vKdnDi77, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Contains symbols with names commonly found in malware

Show sources

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_ack
Source: ELF static info symbol of initial sample	Name: attack_method_gre

Source: s7vKdnDi77, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: s7vKdnDi77, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5240.1.0000000063017c71.000000008031ab92.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5246.1.0000000063017c71.000000008031ab92.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: s7vKdnDi77 PID: 5240, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: Process Memory Space: s7vKdnDi77 PID: 5246, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =

Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: 54321
Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: 12345
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: admin1234
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 12345678

Source: classification engine

Classification label: mal96.troj.lin@0/0@0/0

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35390
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35398
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35414
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35430
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35442
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35446
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35450
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35476
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35480
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35492
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35498
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35500
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35512
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35514
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35520
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35556
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 35582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57426
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57434
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57442
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57476
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57490
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57502
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57520
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57530
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57550
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57580
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57600
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57652
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57668
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57690
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57798
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57816

Source: /tmp/s7vKdnDi77 (PID: 5240)

Queries kernel information via 'uname':

Source: s7vKdnDi77, 5240.1.00000000b6b1ac15.00000000185438df.rw-.sdmp, s7vKdnDi77, 5246.1.00000000b6b1ac15.00000000cef7dc57.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: s7vKdnDi77, 5240.1.00000000b6b1ac15.00000000185438df.rw-.sdmp, s7vKdnDi77, 5246.1.00000000b6b1ac15.00000000cef7dc57.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: s7vKdnDi77, 5240.1.00000000c2533b13.00000000a1dd4886.rw-.sdmp, s7vKdnDi77, 5246.1.00000000c2533b13.00000000a1dd4886.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: s7vKdnDi77, 5240.1.00000000c2533b13.00000000a1dd4886.rw-.sdmp, s7vKdnDi77, 5246.1.00000000c2533b13.00000000a1dd4886.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/s7vKdnDi77SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/s7vKdnDi77

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: s7vKdnDi77, type: SAMPLE
Source: Yara match	File source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: s7vKdnDi77, type: SAMPLE
Source: Yara match	File source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	Brute Force1	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
s7vKdnDi77	59%	Virustotal		Browse
s7vKdnDi77	37%	Metadefender		Browse
s7vKdnDi77	63%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
204.27.217.172	unknown	United States	18682	AAMU-INTERNETUS	false
135.32.10.197	unknown	United States	54614	CIKTELECOM-CABLECA	false
190.214.138.57	unknown	Ecuador	28006	CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC	false
45.50.54.71	unknown	United States	20001	TWC-20001-PACWESTUS	false
187.18.188.123	unknown	Brazil	28270	VideomarRedeNordesteSABR	false
46.204.222.241	unknown	Poland	12912	TMPL	false
85.136.26.166	unknown	Spain	12357	COMUNITELSPAINES	false
194.0.84.190	unknown	Croatia (LOCAL Name: Hrvatska)	28862	INA-HR-ASHR	false
42.23.111.98	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
179.30.41.166	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
183.59.101.253	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
62.212.42.29	unknown	Georgia	34797	SYSTEM-NETGE	false
66.238.150.209	unknown	United States	2828	XO-AS15US	false
186.198.141.191	unknown	Brazil	26615	TIMSABR	false
114.53.185.89	unknown	Korea Republic of	18302	SKG_NW-AS-KRSKTelecomKR	false
110.11.240.214	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
168.197.111.122	unknown	Sint Maarten	27781	SMITCOMSNVSX	false
41.60.37.74	unknown	Mauritius	30969	ZOL-ASGB	false
19.113.76.30	unknown	United States	3	MIT-GATEWAYSUS	false
162.144.165.123	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
133.199.204.240	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
71.52.220.73	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
74.200.43.113	unknown	United States	14010	JACKHENRYUS	false
105.239.2.105	unknown	Sudan	36998	SDN-MOBITELSD	false
164.147.60.211	unknown	South Africa	37130	SITA-ASZA	false
35.41.112.192	unknown	United States	36375	UMICH-AS-5US	false
149.224.54.91	unknown	Germany	15943	WTNET-ASwilhelmtelGmbHDE	false
90.216.232.241	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
68.244.123.135	unknown	United States	10507	SPCSUS	false
53.249.211.64	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
87.198.165.182	unknown	Ireland	34245	MAGNET-ASIE	false
147.29.88.207	unknown	Denmark	5624	DXCTechnologyDK	false
23.28.227.136	unknown	United States	12083	WOW-INTERNETUS	false
64.216.75.5	unknown	United States	7018	ATT-INTERNET4US	false
8.17.40.162	unknown	United States	23089	HOTWIRE-COMMUNICATIONSUS	false
155.244.100.186	unknown	United States	668	DNIC-AS-00668US	false
196.14.61.84	unknown	South Africa	3741	ISZA	false
20.192.81.234	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.220.180.144	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
14.244.110.225	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
115.45.252.11	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
194.61.106.8	unknown	Luxembourg	21155	ASN-PROSERVEAmsterdamNL	false
161.30.249.20	unknown	United Kingdom	31515	INMARSATGB	false
97.78.53.125	unknown	United States	33363	BHN-33363US	false
2.73.205.136	unknown	Kazakhstan	29355	KCELL-ASKZ	false
151.231.128.231	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
94.35.200.82	unknown	Italy	8612	TISCALI-IT	false
43.116.224.15	unknown	Japan	4249	LILLY-ASUS	false
213.197.169.156	unknown	Lithuania	15440	BALTNETACustomersASLT	false
110.159.18.253	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
89.55.185.212	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
86.122.212.89	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
62.206.208.159	unknown	Germany	20676	PLUSNETDE	false
206.90.168.39	unknown	United States	3549	LVLT-3549US	false
114.190.66.65	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
171.37.201.41	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
206.234.73.102	unknown	United States	174	COGENT-174US	false
17.115.203.104	unknown	United States	714	APPLE-ENGINEERINGUS	false
200.115.155.162	unknown	Panama	21599	CableOndaPA	false
164.184.8.118	unknown	United States	37717	EL-KhawarizmiTN	false
43.189.160.67	unknown	Japan	4249	LILLY-ASUS	false
65.161.32.126	unknown	United States	1239	SPRINTLINKUS	false
182.248.10.121	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
45.75.247.63	unknown	United Kingdom	49425	DIGITAL-REALTY-UKGB	false
139.162.198.100	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	false
20.197.35.159	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
9.226.52.184	unknown	United States	3356	LEVEL3US	false
160.115.102.54	unknown	South Africa	6711	HUNGARNET-SZEGEDSzegedUniversityAssociationandHU	false
13.27.46.121	unknown	United States	26662	XEROX-WVUS	false
24.1.63.121	unknown	United States	7922	COMCAST-7922US	false
143.118.4.154	unknown	Sweden	1881	FMVSE	false
57.255.10.200	unknown	Belgium	2686	ATGS-MMD-ASUS	false
89.70.205.186	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
187.117.54.244	unknown	Brazil	26599	TELEFONICABRASILSABR	false
164.171.204.250	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
166.73.67.203	unknown	United States	6318	CHECKFREEUS	false
142.254.167.45	unknown	United States	12271	TWC-12271-NYCUS	false
183.54.199.129	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.228.244.196	unknown	South Africa	37251	TELKOMMOBILEZA	false
94.56.115.42	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
131.143.147.98	unknown	United States	1742	HARVARD-UNIVUS	false
131.127.5.215	unknown	United States	668	DNIC-AS-00668US	false
94.110.83.77	unknown	Belgium	47377	ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired	false
39.215.102.196	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
144.246.29.224	unknown	United States	1477	DNIC-ASBLK-01474-01477US	false
2.196.140.242	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
138.209.172.72	unknown	United States	21727	HAMLINE-EDUUS	false
142.184.216.13	unknown	Canada	577	BACOMCA	false
188.103.181.58	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
213.73.12.176	unknown	Poland	21064	OLMAN-COM-ASOLMANMetropolitanAreaNetworkcommercialAS	false
66.159.117.247	unknown	Canada	5690	VIANET-NOCA	false
88.252.86.135	unknown	Turkey	9121	TTNETTR	false
179.247.8.25	unknown	Brazil	26599	TELEFONICABRASILSABR	false
176.8.233.93	unknown	Ukraine	15895	KSNET-ASUA	false
140.89.210.143	unknown	United States	33651	CMCSUS	false
216.18.233.102	unknown	United States	33569	ALLHOSTSHOPUS	false
58.222.142.125	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
170.73.136.1	unknown	United States	16761	FEDMOG-ASN-01US	false
182.37.50.95	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
155.159.23.90	unknown	South Africa	137951	CLAYERLIMITED-AS-APClayerLimitedHK	false

Runtime Messages

Command:	/tmp/s7vKdnDi77
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	connecterror
Standard Error:

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.01865945547176
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	s7vKdnDi77
File size:	155973
MD5:	c7004f16f15c92e4acd0d78825329a56
SHA1:	08759270368ad69eab73219cc032a3dca620f1da
SHA256:	1ed43a0a7805aff1bae9db3a9cdd0a45ceb3fbd18f84ce7d8cf0c4d49d918838
SHA512:	0cff76c00181c4943540a4ab1d15e890979917b9c800c382269432c84180b959f4c9bf02c0c913309335a32709adc4fae543be13db323fee635966af2deb787c
SSDEEP:	3072:9cQ07QqwGqv3B0o0fS1q7usQeifOrTLtHoSEX/5M/95R9vU:9cTQ1GqJX31q7usQVfQdoSEXxM/9/BU
File Content Preview:	.ELF..............(.........4...........4. ...(........p.................................................................................4..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	126968
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17008	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f0f8	0x170f8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f108	0x17108	0x1acc	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x20bd4	0x18bd4	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x20bec	0x18bec	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29000	0x19000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x29004	0x19004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29004	0x19004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x29008	0x19008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2900c	0x1900c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x29010	0x19010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x290b8	0x190b8	0x21c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x292d4	0x192d4	0x3224	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x192d4	0x93a	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x19c10	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x19cd0	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x19ee3	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1bc06	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1c298	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1cc60	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1cf18	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1d7e2	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1e971	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1eec9	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1eedf	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1f480	0x4950	0x10	0x0		28	684	4
.strtab	STRTAB	0x0	0x23dd0	0x2375	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x18bec	0x20bec	0x20bec	0x118	0x118	1.5455	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x18d04	0x18d04	3.3528	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19000	0x29000	0x29000	0x2d4	0x34f8	2.1140	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
TLS	0x19004	0x29004	0x29004	0x0	0x8	0.0000	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f0f8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f108	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x20bd4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x20bec	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x29000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x29004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x29004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x29008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2900c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x29010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x290b8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x292d4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f0f8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f104	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xace4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xadec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbbd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd19c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe44c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1102c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1232c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1577c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1591c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1622c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1653c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1657c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16684	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1741c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1923c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a284	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aafc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ada4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ade4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d77c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dafc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1deb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa0b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xade4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd194	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd82c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f928	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1fc1c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe70c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf3fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x290b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fdcc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x290bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fdd0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x290d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x290d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x290d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x290dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xffc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1020c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x290e0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x123e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x207ef	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x207f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x162d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x163bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16578	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1663c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16680	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1670c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16918	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x207fc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16b68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17008	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1711c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1718c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x290e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1892c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x290fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x189e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18bfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29114	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x291ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18ca4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20814	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1921c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x291c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19364	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19da0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a46c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x291d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1aa40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aaf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ada0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ade0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aeb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b59c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x291f0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x291ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c45c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c80c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cfe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d0d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d3b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d424	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d8c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dba8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x291e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x208a2	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x20880	12	OBJECT	<unknown>	DEFAULT	4
C.23.4863	.symtab	0x1fc1c	68	OBJECT	<unknown>	DEFAULT	4
C.34.5163	.symtab	0x1f928	8	OBJECT	<unknown>	DEFAULT	4
C.43.5535	.symtab	0x207f8	3	OBJECT	<unknown>	DEFAULT	4
C.44.5536	.symtab	0x207ef	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x207fc	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x2088c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x20bc8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x20ba4	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20bbc	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x20bb0	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x2be10	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x1cec8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x1cee4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1ab70	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x29010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1dc4c	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1dc50	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1e900	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1dc44	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1dc88	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1e924	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1f0c4	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1dc7c	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1e894	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1e8b8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1e8dc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1dbac	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1e1c4	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1dbf8	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x291e4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x208a2	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x29000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x29000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x291e4	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x1a0f0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1a0d4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x291e8	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x16b7c	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x16240	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1c824	300	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1a0f0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x162d8	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1a180	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1a2a0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1a210	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1a180	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1a164	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1a2a0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1a284	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x17440	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x17464	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1741c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1a4b8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1a588	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1a210	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1a1f4	24	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1ab70	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x18818	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x16d20	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x18f64	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x16d94	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1d724	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1a0f0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x16740	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1b528	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1b55c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1b200	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x16e1c	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x19178	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1b5a4	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x162d8	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1c478	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1bf68	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1c824	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1c0ac	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1c950	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1b8d4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x199fc	972	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1abd8	100	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1c824	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1acdc	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1ad08	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1ad1c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1ad30	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1ad44	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x19e60	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1ad6c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x16e90	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1ada4	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1ade4	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x16cb4	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1d25c	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x18d80	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x163e0	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1d1bc	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x164c0	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x16f1c	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1db3c	112	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x16bd0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16be0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1dad8	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x16bf0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1a9cc	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1adf8	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1ae3c	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1aebc	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1a180	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x16920	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x19ea8	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x18958	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x18c18	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1a2a0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x16a94	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1b114	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x1653c	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x16fa0	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17058	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1af1c	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x165c0	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17124	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x171e0	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x16644	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17268	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x18e78	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1aa74	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x172f4	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x17344	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x17358	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x16684	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x19f98	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x172b0	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x18ca8	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1cf00	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1cff0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1ce80	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1ce80	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x16c90	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1d0dc	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1cea0	96	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1d120	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1d170	76	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x18f84	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x19388	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1d1e0	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x16710	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1af88	20	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1a210	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2900c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2900c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1e900	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1e894	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1e8b8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1e8dc	36	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x160e8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x16214	24	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x1ab20	8	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x15fd4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x160d0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1e860	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1e858	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1e850	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x298a4	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x291c0	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2c4f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x292d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x292d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1a534	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1a0f0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1a0d4	24	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x291e8	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2be08	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x290b8	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x1ab14	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1ab08	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x1622c	20	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x160e8	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x29008	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2c4f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2989c	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x16b7c	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x20d04	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x20bec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2934c	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x16240	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1c824	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2900c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x29008	0	NOTYPE	<unknown>	HIDDEN	10
__fork	.symtab	0x199fc	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2c4c4	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2c4c8	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x29350	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x29004	0	OBJECT	<unknown>	DEFAULT	9
__getdents	.symtab	0x1ac3c	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1d788	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1ad44	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x19e60	72	FUNC	<unknown>	DEFAULT	2
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1e004	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1e0ec	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1e884	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1e080	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1e1a4	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1e88c	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1e968	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1f07c	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1e308	1352	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x29008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x29004	0	NOTYPE	<unknown>	HIDDEN	9
__libc_accept	.symtab	0x16d20	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1a0f0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x16e1c	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1a310	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1a398	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x162d8	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x199fc	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2c4cc	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1aebc	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1a180	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1a2a0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x16fa0	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17058	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x165c0	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17124	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x171e0	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1d458	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1aa74	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x29898	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x1a210	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x19dc8	152	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x183e8	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x17488	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x290e4	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2c14c	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x18338	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x1a180	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1a164	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x298a0	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x29004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x29004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x291dc	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x291e0	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1d688	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1a47c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1a474	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1a474	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1a474	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1a474	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x1a2a0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1a284	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1e868	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x298a8	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x17440	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x17464	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1741c	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1dafc	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1d77c	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x291fc	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1d8d0	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1d928	220	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1da04	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1da34	164	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1bf38	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29200	4	OBJECT	<unknown>	DEFAULT	13
__sys_accept	.symtab	0x16cdc	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x16dd8	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x16f5c	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x17010	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x170e0	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x17194	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1aa48	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1ae7c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1ab30	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1657c	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1d434	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x1a4b8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1a588	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1a5e0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x291d8	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x15fd4	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x1a210	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x1a1f4	24	FUNC	<unknown>	DEFAULT	2
__xstat32_conv	.symtab	0x1b068	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1af9c	204	FUNC	<unknown>	HIDDEN	2
_bss_end__	.symtab	0x2c4f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x1d694	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1d6cc	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2c4f0	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2c4f4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2c4e4	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2c4e0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2c4e8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2c4d8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1d3cc	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2c4d4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2c4ec	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2c4dc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2c4d0	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x292d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2c4f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x1ab70	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1f0f8	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x298cc	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x1c9f0	0	FUNC	<unknown>	HIDDEN	2
_pthread_cleanup_pop_restore	.symtab	0x1a48c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1a484	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1aafc	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x2c144	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1b8f4	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1bd54	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x29204	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x298ac	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1c1c8	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x298c8	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x298b8	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x298c4	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x29208	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x1bdd4	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x291ec	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x18fa0	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x18818	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x16d20	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_auth_entry	.symtab	0x1232c	196	FUNC	<unknown>	DEFAULT	2
anti_gdb_entry	.symtab	0xf400	24	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x18f64	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x18f64	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app_http	.symtab	0x81d0	7568	FUNC	<unknown>	DEFAULT	2
attack_get_opt_int	.symtab	0xa340	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0xa2d4	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x9f60	92	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0xa3b0	908	FUNC	<unknown>	DEFAULT	2
attack_method.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_method_ack	.symtab	0xb518	1724	FUNC	<unknown>	DEFAULT	2
attack_method_gre	.symtab	0xd19c	1684	FUNC	<unknown>	DEFAULT	2
attack_method_gudp	.symtab	0xce3c	864	FUNC	<unknown>	DEFAULT	2
attack_method_plaintcp	.symtab	0xc28c	1720	FUNC	<unknown>	DEFAULT	2
attack_method_plainudp	.symtab	0xaa44	672	FUNC	<unknown>	DEFAULT	2
attack_method_std	.symtab	0xa73c	776	FUNC	<unknown>	DEFAULT	2
attack_method_syn	.symtab	0xbbd4	1720	FUNC	<unknown>	DEFAULT	2
attack_method_synack	.symtab	0xadec	1836	FUNC	<unknown>	DEFAULT	2
attack_method_udpgeneric	.symtab	0xd830	1284	FUNC	<unknown>	DEFAULT	2
attack_method_vse	.symtab	0xc944	1272	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0xa0b8	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x9fbc	252	FUNC	<unknown>	DEFAULT	2
auth_table	.symtab	0x2933c	4	OBJECT	<unknown>	DEFAULT	14
auth_table_len	.symtab	0x29310	4	OBJECT	<unknown>	DEFAULT	14
auth_table_max_weight	.symtab	0x29340	2	OBJECT	<unknown>	DEFAULT	14
been_there_done_that	.symtab	0x29348	4	OBJECT	<unknown>	DEFAULT	14
binary	.symtab	0x2be7c	8	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x16d94	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1d724	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x17358	196	FUNC	<unknown>	DEFAULT	2
buffer	.symtab	0x2be14	100	OBJECT	<unknown>	DEFAULT	14
calloc	.symtab	0x17e38	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xdd34	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xdd84	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x16b9c	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1a0f0	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x16740	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x292d4	1	OBJECT	<unknown>	DEFAULT	14
conn_table	.symtab	0x2c134	4	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x16e1c	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
consume_iacs	.symtab	0x121bc	368	FUNC	<unknown>	DEFAULT	2
consume_resp_prompt	.symtab	0x123f0	176	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enc_switch	.symtab	0xde28	1524	FUNC	<unknown>	DEFAULT	2
ensure_single_instance	.symtab	0xf474	352	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x2989c	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x19178	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fake_time	.symtab	0x29344	4	OBJECT	<unknown>	DEFAULT	14
fclose	.symtab	0x1b5a4	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x162d8	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x290d0	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x290d4	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x16850	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x169e4	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1c478	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1bf68	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1c824	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1c0ac	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1c950	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x1b8d4	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x199fc	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x29354	1348	OBJECT	<unknown>	DEFAULT	14
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1859c	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1abd8	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_eit_entry	.symtab	0x1dc94	544	FUNC	<unknown>	DEFAULT	2
get_random_ip	.symtab	0x1102c	4496	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x1bf68	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1c824	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1acdc	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x1ad08	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1ad1c	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x1ad30	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x1ad44	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x19e60	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x163cc	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1ad6c	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x16e90	68	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x16ed4	72	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x1ada4	64	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1ade4	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	8
hex_to_decimal	.symtab	0x15da8	136	FUNC	<unknown>	DEFAULT	2
httpd_port	.symtab	0x2be78	4	OBJECT	<unknown>	DEFAULT	14
index	.symtab	0x1cf00	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x16cb4	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1d25c	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x1d354	120	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x18ab4	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x18d80	248	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x163e0	224	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ioctl_keepalive	.symtab	0xf5d4	480	FUNC	<unknown>	DEFAULT	2
ioctl_pid	.symtab	0x292f8	4	OBJECT	<unknown>	DEFAULT	14
isatty	.symtab	0x1d1bc	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
key	.symtab	0x290bc	17	OBJECT	<unknown>	DEFAULT	13
kill	.symtab	0x164c0	56	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_get_tcpconns	.symtab	0xe44c	716	FUNC	<unknown>	DEFAULT	2
killer_kill_by_port	.symtab	0xee84	1404	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x290b8	4	OBJECT	<unknown>	DEFAULT	13
killer_start	.symtab	0xe718	1900	FUNC	<unknown>	DEFAULT	2
killer_stop	.symtab	0xe41c	48	FUNC	<unknown>	DEFAULT	2
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_multiple_threads.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0x16f1c	64	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
local_bind	.symtab	0x1fdd0	4	OBJECT	<unknown>	DEFAULT	4
local_bind.5801	.symtab	0x290dc	1	OBJECT	<unknown>	DEFAULT	13
lseek64	.symtab	0x1db3c	112	FUNC	<unknown>	DEFAULT	2
main	.symtab	0xf7b4	1992	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x17500	2360	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x187d8	64	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x16bd0	4	FUNC	<unknown>	DEFAULT	2
memcpy_	.symtab	0x158b0	36	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x16be0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x1dad8	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x16bf0	156	FUNC	<unknown>	DEFAULT	2
memset_	.symtab	0x15844	36	FUNC	<unknown>	DEFAULT	2
methods	.symtab	0x292f4	4	OBJECT	<unknown>	DEFAULT	14
methods_len	.symtab	0x292f0	1	OBJECT	<unknown>	DEFAULT	14
mmap	.symtab	0x1a9cc	124	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1adf8	68	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x1ae3c	64	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x290fc	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x29114	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x1aebc	96	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nprocessors_onln	.symtab	0x1923c	332	FUNC	<unknown>	DEFAULT	2
object.5113	.symtab	0x292d8	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x1a180	100	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x16920	196	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p	.symtab	0x2be0c	4	OBJECT	<unknown>	DEFAULT	14
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x292fc	1	OBJECT	<unknown>	DEFAULT	14
pr-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x164f8	68	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
proc_net_tcp	.symtab	0x1fdcc	4	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 11:25:10.863307953 CET	39428	16771	192.168.2.23	109.237.96.10
Jan 14, 2022 11:25:10.881237030 CET	32480	23	192.168.2.23	179.152.52.55
Jan 14, 2022 11:25:10.881298065 CET	32480	23	192.168.2.23	83.2.90.160
Jan 14, 2022 11:25:10.881319046 CET	32480	23	192.168.2.23	152.152.127.54
Jan 14, 2022 11:25:10.881321907 CET	32480	23	192.168.2.23	220.115.20.26
Jan 14, 2022 11:25:10.881351948 CET	32480	23	192.168.2.23	128.99.42.49
Jan 14, 2022 11:25:10.881367922 CET	32480	23	192.168.2.23	165.47.168.40
Jan 14, 2022 11:25:10.881367922 CET	32480	23	192.168.2.23	222.77.217.211
Jan 14, 2022 11:25:10.881381989 CET	32480	23	192.168.2.23	153.84.214.109
Jan 14, 2022 11:25:10.881386042 CET	32480	23	192.168.2.23	108.191.9.10
Jan 14, 2022 11:25:10.881392956 CET	32480	23	192.168.2.23	183.161.149.26
Jan 14, 2022 11:25:10.881392002 CET	32480	23	192.168.2.23	126.85.218.158
Jan 14, 2022 11:25:10.881407976 CET	32480	23	192.168.2.23	148.168.95.159
Jan 14, 2022 11:25:10.881417990 CET	32480	23	192.168.2.23	180.42.181.127
Jan 14, 2022 11:25:10.881428003 CET	32480	23	192.168.2.23	40.63.80.3
Jan 14, 2022 11:25:10.881448030 CET	32480	23	192.168.2.23	95.53.136.208
Jan 14, 2022 11:25:10.881458044 CET	32480	23	192.168.2.23	35.197.189.106
Jan 14, 2022 11:25:10.881463051 CET	32480	23	192.168.2.23	146.253.81.113
Jan 14, 2022 11:25:10.881473064 CET	32480	23	192.168.2.23	199.52.99.108
Jan 14, 2022 11:25:10.881484985 CET	32480	23	192.168.2.23	92.185.158.253
Jan 14, 2022 11:25:10.881504059 CET	32480	23	192.168.2.23	119.188.10.74
Jan 14, 2022 11:25:10.881510973 CET	32480	23	192.168.2.23	102.242.177.197
Jan 14, 2022 11:25:10.881514072 CET	32480	23	192.168.2.23	207.235.142.149
Jan 14, 2022 11:25:10.881541014 CET	32480	23	192.168.2.23	17.76.13.215
Jan 14, 2022 11:25:10.881541014 CET	32480	23	192.168.2.23	187.169.23.117
Jan 14, 2022 11:25:10.881541014 CET	32480	23	192.168.2.23	211.155.176.161
Jan 14, 2022 11:25:10.881552935 CET	32480	23	192.168.2.23	164.96.72.64
Jan 14, 2022 11:25:10.881556034 CET	32480	23	192.168.2.23	211.181.176.110
Jan 14, 2022 11:25:10.881560087 CET	32480	23	192.168.2.23	118.205.227.152
Jan 14, 2022 11:25:10.881562948 CET	32480	23	192.168.2.23	206.211.49.208
Jan 14, 2022 11:25:10.881570101 CET	32480	23	192.168.2.23	157.22.237.202
Jan 14, 2022 11:25:10.881577969 CET	32480	23	192.168.2.23	113.227.19.160
Jan 14, 2022 11:25:10.881580114 CET	32480	23	192.168.2.23	152.88.182.158
Jan 14, 2022 11:25:10.881581068 CET	32480	23	192.168.2.23	139.151.39.235
Jan 14, 2022 11:25:10.881589890 CET	32480	23	192.168.2.23	1.204.61.234
Jan 14, 2022 11:25:10.881592035 CET	32480	23	192.168.2.23	223.70.146.149
Jan 14, 2022 11:25:10.881597042 CET	32480	23	192.168.2.23	73.66.22.178
Jan 14, 2022 11:25:10.881606102 CET	32480	23	192.168.2.23	24.184.140.0
Jan 14, 2022 11:25:10.881606102 CET	32480	23	192.168.2.23	104.7.129.78
Jan 14, 2022 11:25:10.881614923 CET	32480	23	192.168.2.23	194.216.87.166
Jan 14, 2022 11:25:10.881633997 CET	32480	23	192.168.2.23	63.185.220.145
Jan 14, 2022 11:25:10.881654978 CET	32480	23	192.168.2.23	216.225.5.196
Jan 14, 2022 11:25:10.881659031 CET	32480	23	192.168.2.23	187.71.94.135
Jan 14, 2022 11:25:10.881700993 CET	32480	23	192.168.2.23	222.38.0.160
Jan 14, 2022 11:25:10.881704092 CET	32480	23	192.168.2.23	101.19.252.3
Jan 14, 2022 11:25:10.881705046 CET	32480	23	192.168.2.23	194.228.210.95
Jan 14, 2022 11:25:10.881715059 CET	32480	23	192.168.2.23	148.229.20.43
Jan 14, 2022 11:25:10.881726027 CET	32480	23	192.168.2.23	179.84.203.140
Jan 14, 2022 11:25:10.881728888 CET	32480	23	192.168.2.23	87.1.115.98
Jan 14, 2022 11:25:10.881735086 CET	32480	23	192.168.2.23	75.218.47.46
Jan 14, 2022 11:25:10.881736994 CET	32480	23	192.168.2.23	137.138.184.242
Jan 14, 2022 11:25:10.881752968 CET	32480	23	192.168.2.23	152.18.190.84
Jan 14, 2022 11:25:10.881755114 CET	32480	23	192.168.2.23	107.245.79.158
Jan 14, 2022 11:25:10.881758928 CET	32480	23	192.168.2.23	161.163.64.185
Jan 14, 2022 11:25:10.881768942 CET	32480	23	192.168.2.23	43.243.124.176
Jan 14, 2022 11:25:10.881774902 CET	32480	23	192.168.2.23	88.116.98.91
Jan 14, 2022 11:25:10.881784916 CET	32480	23	192.168.2.23	191.41.215.119
Jan 14, 2022 11:25:10.881787062 CET	32480	23	192.168.2.23	69.238.162.53
Jan 14, 2022 11:25:10.881793022 CET	32480	23	192.168.2.23	168.200.186.46
Jan 14, 2022 11:25:10.881803989 CET	32480	23	192.168.2.23	151.72.176.73
Jan 14, 2022 11:25:10.881805897 CET	32480	23	192.168.2.23	167.174.172.229
Jan 14, 2022 11:25:10.881814957 CET	32480	23	192.168.2.23	187.122.51.37
Jan 14, 2022 11:25:10.881817102 CET	32480	23	192.168.2.23	177.151.204.68
Jan 14, 2022 11:25:10.881829023 CET	32480	23	192.168.2.23	34.104.127.3
Jan 14, 2022 11:25:10.881833076 CET	32480	23	192.168.2.23	196.15.127.210
Jan 14, 2022 11:25:10.881865978 CET	32480	23	192.168.2.23	132.69.205.188
Jan 14, 2022 11:25:10.881876945 CET	32480	23	192.168.2.23	187.35.208.219
Jan 14, 2022 11:25:10.881889105 CET	32480	23	192.168.2.23	88.33.156.13
Jan 14, 2022 11:25:10.881890059 CET	32480	23	192.168.2.23	84.9.127.175
Jan 14, 2022 11:25:10.881891012 CET	32480	23	192.168.2.23	193.178.127.111
Jan 14, 2022 11:25:10.881905079 CET	32480	23	192.168.2.23	89.166.116.199
Jan 14, 2022 11:25:10.881918907 CET	32480	23	192.168.2.23	186.93.110.37
Jan 14, 2022 11:25:10.881931067 CET	32480	23	192.168.2.23	142.98.156.12
Jan 14, 2022 11:25:10.881933928 CET	32480	23	192.168.2.23	133.235.238.199
Jan 14, 2022 11:25:10.881937027 CET	32480	23	192.168.2.23	60.240.31.79
Jan 14, 2022 11:25:10.881937027 CET	32480	23	192.168.2.23	146.65.82.149
Jan 14, 2022 11:25:10.881937981 CET	32480	23	192.168.2.23	102.43.11.201
Jan 14, 2022 11:25:10.881947994 CET	32480	23	192.168.2.23	114.102.107.145
Jan 14, 2022 11:25:10.881953955 CET	32480	23	192.168.2.23	160.200.154.254
Jan 14, 2022 11:25:10.881982088 CET	32480	23	192.168.2.23	74.234.181.30
Jan 14, 2022 11:25:10.882005930 CET	32480	23	192.168.2.23	62.95.20.209
Jan 14, 2022 11:25:10.882013083 CET	32480	23	192.168.2.23	89.63.47.46
Jan 14, 2022 11:25:10.882019997 CET	32480	23	192.168.2.23	123.50.239.149
Jan 14, 2022 11:25:10.882021904 CET	32480	23	192.168.2.23	199.163.161.122
Jan 14, 2022 11:25:10.882024050 CET	32480	23	192.168.2.23	32.148.86.70
Jan 14, 2022 11:25:10.882035017 CET	32480	23	192.168.2.23	192.41.10.239
Jan 14, 2022 11:25:10.882036924 CET	32480	23	192.168.2.23	153.97.79.251
Jan 14, 2022 11:25:10.882040977 CET	32480	23	192.168.2.23	184.48.254.65
Jan 14, 2022 11:25:10.882045984 CET	32480	23	192.168.2.23	48.122.35.149
Jan 14, 2022 11:25:10.882072926 CET	32480	23	192.168.2.23	117.194.52.217
Jan 14, 2022 11:25:10.882101059 CET	32480	23	192.168.2.23	145.40.131.39
Jan 14, 2022 11:25:10.882102966 CET	32480	23	192.168.2.23	81.60.249.150
Jan 14, 2022 11:25:10.882112026 CET	32480	23	192.168.2.23	212.237.72.84
Jan 14, 2022 11:25:10.882122040 CET	32480	23	192.168.2.23	98.96.243.254
Jan 14, 2022 11:25:10.882126093 CET	32480	23	192.168.2.23	141.88.233.146
Jan 14, 2022 11:25:10.882127047 CET	32480	23	192.168.2.23	91.37.251.97
Jan 14, 2022 11:25:10.882127047 CET	32480	23	192.168.2.23	196.167.78.217
Jan 14, 2022 11:25:10.882132053 CET	32480	23	192.168.2.23	175.126.188.88
Jan 14, 2022 11:25:10.882134914 CET	32480	23	192.168.2.23	85.62.182.229
Jan 14, 2022 11:25:10.882136106 CET	32480	23	192.168.2.23	217.145.157.174

System Behavior

Analysis Process: s7vKdnDi77 PID: 5240 Parent PID: 5138

General

Start time:	11:25:10
Start date:	14/01/2022
Path:	/tmp/s7vKdnDi77
Arguments:	/tmp/s7vKdnDi77
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: s7vKdnDi77 PID: 5242 Parent PID: 5240

General

Start time:	11:25:10
Start date:	14/01/2022
Path:	/tmp/s7vKdnDi77
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: s7vKdnDi77 PID: 5244 Parent PID: 5242

General

Start time:	11:25:10
Start date:	14/01/2022
Path:	/tmp/s7vKdnDi77
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: s7vKdnDi77 PID: 5246 Parent PID: 5242

General

Start time:	11:25:10
Start date:	14/01/2022
Path:	/tmp/s7vKdnDi77
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: s7vKdnDi77 PID: 5247 Parent PID: 5242

General

Start time:	11:25:10
Start date:	14/01/2022
Path:	/tmp/s7vKdnDi77
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Authentication logs, Office 365 account logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report s7vKdnDi77

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: s7vKdnDi77 PID: 5240 Parent PID: 5138

General

Analysis Process: s7vKdnDi77 PID: 5242 Parent PID: 5240

General

Analysis Process: s7vKdnDi77 PID: 5244 Parent PID: 5242

General

Analysis Process: s7vKdnDi77 PID: 5246 Parent PID: 5242

General

Analysis Process: s7vKdnDi77 PID: 5247 Parent PID: 5242

General