Edit tour

Linux Analysis Report
meow.arm7.elf

Overview

General Information

Sample name:	meow.arm7.elf
Analysis ID:	1546866
MD5:	88d73a66357528223b9d2fffe7d273ba
SHA1:	3c33aa8d1b962ec6a107897d80d34a5d0b99899e
SHA256:	75a1199fbf8abd52bc957b07ff7574ddc98719272ad9f2f0d427178ac1c60967
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546866
Start date and time:	2024-11-01 16:54:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	meow.arm7.elf
Detection:	MAL
Classification:	mal52.linELF@0/0@0/0

Warnings

VT rate limit hit for: meow.arm7.elf

Runtime Messages

Command:	/tmp/meow.arm7.elf
PID:	6221
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

meow.arm7.elf (PID: 6221, Parent: 6142, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/meow.arm7.elf

meow.arm7.elf New Fork (PID: 6223, Parent: 6221)

dash New Fork (PID: 6262, Parent: 4331)

rm (PID: 6262, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.NA12ehSwW9 /tmp/tmp.LhvMiYHory /tmp/tmp.i3CCLNAnoB

dash New Fork (PID: 6263, Parent: 4331)

cat (PID: 6263, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.NA12ehSwW9

dash New Fork (PID: 6264, Parent: 4331)

head (PID: 6264, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6265, Parent: 4331)

tr (PID: 6265, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6266, Parent: 4331)

cut (PID: 6266, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6267, Parent: 4331)

cat (PID: 6267, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.NA12ehSwW9

dash New Fork (PID: 6268, Parent: 4331)

head (PID: 6268, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6269, Parent: 4331)

tr (PID: 6269, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6270, Parent: 4331)

cut (PID: 6270, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6271, Parent: 4331)

rm (PID: 6271, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.NA12ehSwW9 /tmp/tmp.LhvMiYHory /tmp/tmp.i3CCLNAnoB

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: meow.arm7.elf

ReversingLabs: Detection: 42%

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.23:33498 -> 64.137.31.246:6860

Source: /tmp/meow.arm7.elf (PID: 6221)

Socket: 127.0.0.1:45295

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 64.137.31.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: add_attack
Source: ELF static info symbol of initial sample	Name: attack_add_pid
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_remove_id
Source: ELF static info symbol of initial sample	Name: attack_start
Source: ELF static info symbol of initial sample	Name: attack_stop
Source: ELF static info symbol of initial sample	Name: attacks_ack
Source: ELF static info symbol of initial sample	Name: attacks_gre

Source: meow.arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: classification engine

Classification label: mal52.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 6262)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.NA12ehSwW9 /tmp/tmp.LhvMiYHory /tmp/tmp.i3CCLNAnoB			Jump to behavior
Source: /usr/bin/dash (PID: 6271)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.NA12ehSwW9 /tmp/tmp.LhvMiYHory /tmp/tmp.i3CCLNAnoB			Jump to behavior

Source: /tmp/meow.arm7.elf (PID: 6221)

Queries kernel information via 'uname':

Jump to behavior

Source: meow.arm7.elf, 6221.1.00007ffed07e5000.00007ffed0806000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/meow.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/meow.arm7.elf
Source: meow.arm7.elf, 6221.1.000055a87bc10000.000055a87bd5f000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: meow.arm7.elf, 6221.1.000055a87bc10000.000055a87bd5f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: meow.arm7.elf, 6221.1.00007ffed07e5000.00007ffed0806000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
meow.arm7.elf	42%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
64.137.31.246	unknown	United States	61317	ASDETUKhttpwwwheficedcomGB	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	shngijernbh.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	linux_mips64el_softfloat.elf	Get hash	malicious	Chaos	Browse
	x.rar.elf	Get hash	malicious	Xmrig	Browse
	tyo2831qq.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	tyo2831qq.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	main_arm.elf	Get hash	malicious	Mirai	Browse
	dlr.x86.elf	Get hash	malicious	Okiru	Browse
	dlr.ppc.elf	Get hash	malicious	Unknown	Browse
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
	dlr.mpsl.elf	Get hash	malicious	Okiru	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	main_arm.elf	Get hash	malicious	Mirai	Browse
	dlr.x86.elf	Get hash	malicious	Okiru	Browse
	dlr.ppc.elf	Get hash	malicious	Unknown	Browse
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
	dlr.mpsl.elf	Get hash	malicious	Okiru	Browse
	.i.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dlr.sh4.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	dlr.x86.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	dlr.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	dlr.mips.elf	Get hash	malicious	Okiru	Browse	185.125.190.26
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	zmap.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
ASDETUKhttpwwwheficedcomGB	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	mips64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
	x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	181.214.231.152
AMAZON-02US	file.exe	Get hash	malicious	Stealc, Vidar	Browse	3.168.2.115
	https://u7990385.ct.sendgrid.net/ls/click?upn=u001.oZ6GXC16Ztdw1ob-2F3C5yow-2FsK2YC4S8s269h9OLgp-2FGcQesCtXDXKgCEAF90Sa3OUL2ncGoAKstQjRhddelr-2Bx3frrehyL8aaBbhAx-2Fm3uQTToUZwzw9vU-2BHl4N8-2FbXNOWh47xHSpNswH5B20hFc1rkwm1HkocouB6puE-2FnM91Ea9xIyldie1eyHQvDQGF6-2F1OUGSCOg8K-2Fk8REDXGncryLNWAkNll9tI4svh29XngoJuJcvPHIwWw07juA1Lr687mlf_LZJN6rqeZVHTY7vi7TysfnSOWUsKUPL2t2FWuf1mHJZyRrnfnXk5in-2FtsLaVkEL4z-2F5H1v5rdZCMtKV4-2B7XswPaXSOX44YEil-2BgQ6f1-2BLxpcwnoVslshbeFD8-2FSkDYUL5gsTS7cnhi8iHs4T9b6wzPIbVlUAEwQAwoGeUFJH5x3RAGtspzpDyRWDwHNrMMOluLHeocJQAj7iS1dnS-2B-2Fhpf21Fjpr9lUosnkGJYIkfG0KNsjglBmf2yQvwZsg0Wp706kciqJgB5pqtemV1qFgZLIL2K-2BsyRLGqv3bbeqv6LWX-2Fbn97e4q8h4LdJzfXKTxRJD2tMgj2k7Ls1BdPjLturPdeJvpG2db-2FhwENpXetZR7k21gPz6in5zk7zhcmgIkZssf1WUkdDcjfwIeY2HuQe6EHwacpAnjlFSG7cGBDYbRKnbjWz72QvhesvDQrxGZA-2F-2FwuD5CryGFeRAazVMLU-2FTUgYuXTJzCzL6qav9lYxCC-2Bwx97sSjci4FffUtDhPcIZfKCP-2Ff9rufbc-2FOdTD6VLIHU5lNW4k8Nb-2FWedSu8kS9RXhRxjWAbV4qYK-2F68HLgFHbzOrm6M-2FG6a-2BnVs9TkK9ei8xVDo6cAhkQYCxDYOCBJJC-2BfLWulZgQ85hdg59312Kv6zX2g11nE5GRn-2B6U-2B2tuv67vEmY8CUatMt7UrQHEhVlrPnXi1EamUHW4AGpMQfKBj0GXRdJxG0fD3Zx-2FiIXcDEoi3GhoWLQTKZU-2FWlBKJiyqDLjDXS6qRg1X-2Fsd3R5k7fswdpYLTizSHt12T6-2Bo0IoKg0cyJsPKBfoK9Uleu7f9wgtdH4RtvaMbk9-2Buqhl6zW9NHZET-2BbGJHqyqlBeTSBtTZM6ltHEDZrojb0Lhszq-2BKoSCsuyjzgKAFmmWSRMGxwsXoHHuV8LoFEZjuiOSkTWEP-2FvQ0ZaWfqnp81VXTEktfVY9Xmx-2FaHq5NRH3vqpZc6LNkkSHnpJBPIYA83Mw-3D-3D	Get hash	malicious	Unknown	Browse	35.163.144.222
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	dlr.arm6.elf	Get hash	malicious	Okiru	Browse	54.217.10.153
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	https://woobox.com/sf4hxr	Get hash	malicious	HTMLPhisher	Browse	52.217.197.137
	https://u7990385.ct.sendgrid.net/ls/click?upn=u001.oZ6GXC16Ztdw1ob-2F3C5yow-2FsK2YC4S8s269h9OLgp-2FGcQesCtXDXKgCEAF90Sa3OUL2ncGoAKstQjRhddelr-2Bx3frrehyL8aaBbhAx-2Fm3uQTToUZwzw9vU-2BHl4N8-2FbXNrXNM8F2aafYGXvb9twEoQeHC7ZwjccAi1SjLazzmL714x6k-2BjB-2FYwt496nNWzarkpA5xghtVvgqYssmknAftbQJOVkiDX5sql0puMOlG6Ca2eid008YPu-2FJJAayp-2BNXls84A_lhEpvcamcm95WhC017PRgRonrgi5omZ3brQwNa5yLk0xxDl3uLY9zV0ZhBwsp9AfIBgWj8srFe156S5Zns8ZjIc0B22GBm-2FhZ3msRvLKzUyGIuCFlA1E-2FK-2F4jc3IgU8qM5k5KxMmIwIRDSCQDvTZvmwB5zeTeqWWEJR7CvWSpeaqIj3hj5IgcRcoPBdptLYrUK3YLUsGuU0Nn50M3ArOROvseGYqZul0QkeqtDR41-2FsPFt-2Bw0YWW2P5gsCDH4XINxncIhICPIqlacC1ih-2B-2BRAhsouCrf5nolEyzWx0VnR2OrLuGwvR4-2BmBTgXGq5SQJ3CbNvM-2FaB5BLerpFqmqjPC-2FBlK6th1iVrhfmtBEFKLash-2FnkPpQ9qFxGwWTexJMh100AS4PilK2-2BJDfvjssuxk2jP-2BTagNOazV2F1Jk9Mugr3y7E9SivEGWyUbzdMThmnpVydb1qOFwMiocztErv1WWaB8B20Oa2SLt-2BLBsMdusfLwd3NNzPre6el-2F-2BIwBxDAqBb9JLV6vOLzfaD2L4-2BEuPbgzcrscVtaCNyARGoPUKi03imhTbJEcig8L4weEiABND5vwKtA-2FhKo5AjxecXMO22Vq7Og2y7v-2BJNgFB9rr-2Bm4W45XZxFP39Dqi18SUPOKX4pHFrdACciPinuj2QtBtIGNjV46-2Bve9hu0g1-2FpG1tOVv9Ebn32k-2Bl6CF6b6jzS3aTQvZkWKNIwLx5CoGs9uomn9yZPi6QaiSTeQkZ1uHupSYpVxbBCb-2FUyo6kMlbB0P27ShEzUFVY-2FpfPcfFofTKD4p7rklaM-2FIuG8-2F3ytR7SJ7I8GmSP8NTWs4vu3NTpV5MkgHfjeFoK-2BDQh6M7S2ys2qIf8m3qiLtFMHY6p7m4ep8JZqbC0axloFSX-2Fzbz51ZW-2BsyQEEbRqwx0S1i4lo9NhRXrfXOvn0A83bBDk31g9QfoWTGhHCjSEfuca9KJwe0GCABYAuqYeYHMc5qXhPv86r0l0ldRpwe39V9LJ5m6Go-3D	Get hash	malicious	Unknown	Browse	65.9.66.43
	https://hotmail.cdisaomiguel.com.br	Get hash	malicious	Unknown	Browse	18.245.31.5
	https://tas-pe.com/ahowe@europait.net#ahowe@europait.net	Get hash	malicious	HTMLPhisher	Browse	18.245.31.121
INIT7CH	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.x86.elf	Get hash	malicious	Okiru	Browse	109.202.202.202
	dlr.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	zmap.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dlr.mpsl.elf	Get hash	malicious	Okiru	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.977894591468298
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	meow.arm7.elf
File size:	166'947 bytes
MD5:	88d73a66357528223b9d2fffe7d273ba
SHA1:	3c33aa8d1b962ec6a107897d80d34a5d0b99899e
SHA256:	75a1199fbf8abd52bc957b07ff7574ddc98719272ad9f2f0d427178ac1c60967
SHA512:	09131d3b85160f16934cb07a6baf7885568c538c4981c8abaa6242e49e1c12bb996c1ed90dfc7ffd767a6653e87ac622a33d7f12499b1fd95d5657acaffbc7cd
SSDEEP:	3072:NUKrdTrzCwg+R36jf1LU45adrlgactjY9FlLCfrDNtVM/9zi1FaA:NBdTKdjf1LU4Irlgat3lLCfrDN7M/9Q1
TLSH:	B2F33B09EA50971BC2E127BEEA9B438E33338B48B7D7331549349BB53FC6B985D22115
File Content Preview:	.ELF..............(.........4...H.......4. ...(........p............................................................................ ...hS..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	131912
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x178a4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f994	0x17994	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f9a8	0x179a8	0x1cd0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21678	0x19678	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x21690	0x19690	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x297a8	0x197a8	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x297ac	0x197ac	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x297ac	0x197ac	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x297b0	0x197b0	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x297b4	0x197b4	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x297b8	0x197b8	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x29860	0x19860	0x268	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29ac8	0x19ac8	0x5048	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19ac8	0xbf8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a6c0	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1a800	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1aa13	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1ca56	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1d138	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1dfb0	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1e268	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1eb32	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1fcc1	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x20219	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2022f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x207d0	0x58a0	0x10	0x0		28	823	4
.strtab	STRTAB	0x0	0x26070	0x2bb3	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x19690	0x21690	0x21690	0x118	0x118	4.4993	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x197a8	0x197a8	6.0473	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x197a8	0x297a8	0x297a8	0x320	0x5368	3.7902	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x197ac	0x297ac	0x297ac	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f994	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f9a8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x21678	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21690	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x297a8	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x297ac	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x297ac	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x297b0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x297b4	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x297b8	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x29860	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x29ac8	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f994	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f9a0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x85c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x931c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x94a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x958c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa1b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa2ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa76c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbaac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1340c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1344c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1421c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1435c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1461c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1477c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1732c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1777c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1780c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1789c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1829c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1832c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1843c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1847c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1855c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1962c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a08c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c02c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c72c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c94c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1caa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d29c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d38c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d4d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d7b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d87c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x297b0	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x297ac	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x29864	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29868	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f9b0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x85b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x889c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8c5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8d54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x94a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29870	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x955c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x972c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa1b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29874	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fad8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa75c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29878	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2987c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29880	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29884	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fd30	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc3a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29888	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2988c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29890	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29894	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29898	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fd52	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xea84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2989c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x298a0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fda2	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298a4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fdbb	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x101ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x298ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x10760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fe3c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1177c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12c70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x130f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13270	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13404	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x205f4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13930	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13994	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13df8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1429c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14310	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14354	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1439c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14614	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14774	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1529c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x153e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x157a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298e8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29900	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29998	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1612c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x163e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20624	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x165d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16684	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x299ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x167cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16de8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1770c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17720	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x299c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18000	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1812c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18360	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x299d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x206b6	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x187ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x195e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x299dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x299d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a10	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ac0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20a18	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1ab44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b998	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a9c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1bbfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c004	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ac4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c5b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c7cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d27c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21630	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d4d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d5cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d7b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d878	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1e734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f0dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.0.3760	.symtab	0x1fad8	40	OBJECT	<unknown>	DEFAULT	4
C.1.3068	.symtab	0x1fe3c	3	OBJECT	<unknown>	DEFAULT	4
C.10.4028	.symtab	0x1fd82	16	OBJECT	<unknown>	DEFAULT	4
C.10.4028	.symtab	0x1fde3	12	OBJECT	<unknown>	DEFAULT	4
C.11.4029	.symtab	0x1fd6a	24	OBJECT	<unknown>	DEFAULT	4
C.11.4029	.symtab	0x1fdcf	20	OBJECT	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x20694	12	OBJECT	<unknown>	DEFAULT	4
C.12.4030	.symtab	0x1fd52	24	OBJECT	<unknown>	DEFAULT	4
C.12.4030	.symtab	0x1fdbb	20	OBJECT	<unknown>	DEFAULT	4
C.18.4049	.symtab	0x1fda2	25	OBJECT	<unknown>	DEFAULT	4
C.18.4064	.symtab	0x1fd42	16	OBJECT	<unknown>	DEFAULT	4
C.19.4074	.symtab	0x1fd32	16	OBJECT	<unknown>	DEFAULT	4
C.22.4095	.symtab	0x1fd30	2	OBJECT	<unknown>	DEFAULT	4
C.22.4927	.symtab	0x1f9b8	8	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x205f4	24	OBJECT	<unknown>	DEFAULT	4
C.7.4656	.symtab	0x1f9b0	8	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x206a0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x209b8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x209e8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x209c4	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x209dc	12	OBJECT	<unknown>	DEFAULT	4
C.9.4027	.symtab	0x1fd92	16	OBJECT	<unknown>	DEFAULT	4
C.9.4027	.symtab	0x1fdef	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x209d0	12	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0x13a78	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x13a94	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x18130	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x297b8	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1e4e8	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1e4ec	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1f19c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1e4e0	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1e524	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1f1c0	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1f960	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1e518	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1f130	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1f154	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1f178	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1e448	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1ea60	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1e494	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x299d0	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x206b6	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x297a8	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x297a8	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x299d0	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x17740	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x17724	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x299d4	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x13944	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x13068	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1af0c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1ba3c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x17740	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x13100	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x177d0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x17860	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1d4f0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x177d0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x177b4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x17860	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x17844	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1732c	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x148c8	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x148ec	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x148a4	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x17a78	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x17b48	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1d4f0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1d4d4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1ba54	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x18130	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x15ca0	296	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1421c	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c0c8	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x17740	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x13508	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x18ae8	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x18b1c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x187c0	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x142a4	116	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x131f4	64	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x13234	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x165e0	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x18b64	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x13100	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1ab60	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1a650	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1af0c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1a794	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1b038	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x18e94	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x16e64	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1b0d8	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1d5d0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1d5f4	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x18198	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1b110	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1af0c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1829c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x182c8	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x182dc	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x182f0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x18304	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x174b4	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1832c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x14318	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x18364	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x183a4	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x13ac0	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x13ab0	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x141f4	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1bc00	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x13f58	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x13be0	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x16208	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1c12c	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1bb60	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x13288	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x143a4	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1d560	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1d29c	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x139a0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1b660	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1d38c	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1d3b0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x139b0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x17f8c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x183b8	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x183fc	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1847c	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x13af0	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x13ae0	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x177d0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x136e8	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x174fc	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x15de0	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x160a0	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x17860	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x1385c	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x186d4	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x13304	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x14428	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x144e0	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x184dc	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x13388	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x145ac	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x14668	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1340c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x146f0	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x16300	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x18034	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1477c	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x147cc	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x147e0	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1344c	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x175ec	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x14738	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x18eb4	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x16130	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1b690	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1b780	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1b670	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1b670	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1b86c	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1b890	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x13a50	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1b8d4	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1b9a0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1b9f0	76	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x163ec	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x167f0	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1bb84	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x134d8	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x18548	20	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x18ee8	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1c354	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1c3cc	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1c3a8	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1d4f0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x297b4	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x297b4	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1f19c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1f130	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1f154	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1f178	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1da08	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1e364	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1e364	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1e348	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1e3f4	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1da08	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1e37c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1e3c4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1e3dc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1e3ac	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1e394	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1e0a8	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1de18	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1d9fc	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1da04	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1dd64	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1dd3c	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1d8b8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1d9e4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1ddb8	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x180e0	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1dd18	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x12f40	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x1303c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1dda4	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1f0fc	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1f0f4	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1f0ec	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2a0a8	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x299ac	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2eb10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29ac8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29ac8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x17af4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x17740	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x17724	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1e2c4	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x299d4	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2c618	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x29860	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x180d4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x180c8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x13054	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1e0a8	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1d8b8	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x297b0	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x29860	0	OBJECT	<unknown>	HIDDEN	13
__end__	.symtab	0x2eb10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2a0a0	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1e2c4	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x13944	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x217a8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x21690	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x29b50	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1dd64	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x13068	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1af0c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x297b4	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x297b0	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1e3f4	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1ddb8	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1dd3c	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1dda4	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1dd18	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x16e64	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2ea8c	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2ea90	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x29b54	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x297ac	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1e2b4	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x181fc	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c20c	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x18304	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x174b4	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1ba3c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1e8a0	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1e988	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1f120	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1e91c	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1ea40	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1f128	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1f204	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1f918	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1eba4	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1e2b4	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x297b0	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x297ac	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1e2bc	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x17740	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x142a4	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x178d0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x17958	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x13100	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x16e64	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2ea94	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1847c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x177d0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x17860	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x14428	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x144e0	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x13388	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x145ac	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x14668	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1bdfc	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x18034	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2a09c	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x1d4f0	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x172c8	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x17230	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x1e2bc	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x15870	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x14910	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x298d0	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2e714	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x157c0	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1de18	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1e2c4	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x177d0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x177b4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2a0a4	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x297ac	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x297ac	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x299c8	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x299cc	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1c02c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x17a3c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x17a34	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x17a34	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x17a34	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x17a34	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x17860	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x17844	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x1732c	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1f104	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2a0ac	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x148c8	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x148ec	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x148a4	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1d490	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c120	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x299e8	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1c488	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1c4e0	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1d7b4	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1c5bc	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1c6fc	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1d87c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1c72c	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1c7d0	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x195fc	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x299ec	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1da04	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x14260	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x143e4	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x14498	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x14568	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x1461c	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x18008	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1843c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x180f0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x13344	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1bdd8	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x17a78	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x17b48	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x17ba0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x299c4	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x12f40	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x1d4f0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x1d4d4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x1ba54	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x18628	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1855c	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_atoi	.symtab	0x12224	136	FUNC	<unknown>	DEFAULT	2
_bss_custom_printf_spec	.symtab	0x2c0d0	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2eb10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x1962c	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2ea98	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x2eac0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x29ac0	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1c038	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x29ac4	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x1c070	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2eb08	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2eb0c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2eafc	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2eaf8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2eb00	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2eaf0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1bd70	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2eaec	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2eb04	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2eaf4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2eae8	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x29ac8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2eb10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x18130	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1f994	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2a0d0	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x19680	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1caa8	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1c8ac	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1b1d0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x19df8	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1a0e0	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x19e98	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x19edc	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1a08c	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x17a4c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x17a44	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x180bc	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x2e70c	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x81d0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x18fb8	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x19418	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x299f0	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2a0b0	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1a8b0	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2a0cc	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2a0bc	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2a0c8	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x299f4	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x19498	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x299d8	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x16408	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1c920	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x20aac	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1c94c	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x19704	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x15ca0	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_attack	.symtab	0xa0f0	200	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x12dd0	168	FUNC	<unknown>	DEFAULT	2
attack_add_pid	.symtab	0x9730	156	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x94a8	228	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x29aec	80	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x9874	1072	FUNC	<unknown>	DEFAULT	2
attack_remove_id	.symtab	0x97cc	168	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x9ca4	368	FUNC	<unknown>	DEFAULT	2
attack_stop	.symtab	0x958c	420	FUNC	<unknown>	DEFAULT	2
attacks_ack	.symtab	0xa76c	1972	FUNC	<unknown>	DEFAULT	2
attacks_gre	.symtab	0xaf20	1504	FUNC	<unknown>	DEFAULT	2
attacks_icmp	.symtab	0xb500	1452	FUNC	<unknown>	DEFAULT	2
attacks_raknet	.symtab	0xbaac	2308	FUNC	<unknown>	DEFAULT	2
attacks_rand	.symtab	0xc3b0	1480	FUNC	<unknown>	DEFAULT	2
attacks_socket	.symtab	0xca0c	1780	FUNC	<unknown>	DEFAULT	2
attacks_std	.symtab	0xd100	1480	FUNC	<unknown>	DEFAULT	2
attacks_stomp	.symtab	0xd6c8	2768	FUNC	<unknown>	DEFAULT	2
attacks_tfo	.symtab	0xe198	2300	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 16:54:50.737741947 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:50.742938042 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:50.742996931 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:50.757637024 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:50.762860060 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:51.630599976 CET	43928	443	192.168.2.23	91.189.91.42
Nov 1, 2024 16:54:51.959388971 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:51.959525108 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:51.959702969 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:51.964724064 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:52.891731024 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:52.891900063 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:52.891962051 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:52.896770000 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:53.556452990 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:53.556544065 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:55.558198929 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:55.563205004 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:55.563283920 CET	33498	6860	192.168.2.23	64.137.31.246
Nov 1, 2024 16:54:55.568173885 CET	6860	33498	64.137.31.246	192.168.2.23
Nov 1, 2024 16:54:57.261734962 CET	42836	443	192.168.2.23	91.189.91.43
Nov 1, 2024 16:54:58.541699886 CET	42516	80	192.168.2.23	109.202.202.202
Nov 1, 2024 16:55:11.851746082 CET	43928	443	192.168.2.23	91.189.91.42
Nov 1, 2024 16:55:24.138041019 CET	42836	443	192.168.2.23	91.189.91.43
Nov 1, 2024 16:55:25.640575886 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:25.640598059 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:25.640608072 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:25.640619993 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:25.640768051 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.640768051 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.640768051 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.640768051 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.641801119 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.646625042 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:25.883294106 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:25.883423090 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.883573055 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:25.888482094 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:26.125252962 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:26.125361919 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:26.126439095 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:26.131589890 CET	443	33606	54.171.230.55	192.168.2.23
Nov 1, 2024 16:55:26.131628036 CET	33606	443	192.168.2.23	54.171.230.55
Nov 1, 2024 16:55:28.233474970 CET	42516	80	192.168.2.23	109.202.202.202
Nov 1, 2024 16:55:52.806133032 CET	43928	443	192.168.2.23	91.189.91.42

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 1, 2024 16:55:25.640608072 CET	54.171.230.55	443	192.168.2.23	33606	CN=motd.ubuntu.com CN=R11, O=Let's Encrypt, C=US	CN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Oct 21 10:21:37 CEST 2024 Wed Mar 13 01:00:00 CET 2024	Sun Jan 19 09:21:36 CET 2025 Sat Mar 13 00:59:59 CET 2027
Nov 1, 2024 16:55:25.640608072 CET	54.171.230.55	443	192.168.2.23	33606	CN=R11, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027

System Behavior

Analysis Process: meow.arm7.elf PID: 6221, Parent PID: 6142

General

Start time (UTC):	15:54:50
Start date (UTC):	01/11/2024
Path:	/tmp/meow.arm7.elf
Arguments:	/tmp/meow.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: meow.arm7.elf PID: 6223, Parent PID: 6221

General

Start time (UTC):	15:54:50
Start date (UTC):	01/11/2024
Path:	/tmp/meow.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dash PID: 6262, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6262, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.NA12ehSwW9 /tmp/tmp.LhvMiYHory /tmp/tmp.i3CCLNAnoB
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6263, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6263, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.NA12ehSwW9
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6264, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6264, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6265, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6265, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6266, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6266, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6267, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6267, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.NA12ehSwW9
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6268, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6268, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6269, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6269, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6270, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6270, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6271, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6271, Parent PID: 4331

General

Start time (UTC):	15:55:25
Start date (UTC):	01/11/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.NA12ehSwW9 /tmp/tmp.LhvMiYHory /tmp/tmp.i3CCLNAnoB
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report meow.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

HTTPS Connections

System Behavior

Analysis Process: meow.arm7.elf PID: 6221, Parent PID: 6142

General

Chronological Activities

Analysis Process: meow.arm7.elf PID: 6223, Parent PID: 6221

General

Chronological Activities

Analysis Process: dash PID: 6262, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6262, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6263, Parent PID: 4331

General

Chronological Activities

Analysis Process: cat PID: 6263, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6264, Parent PID: 4331

General

Chronological Activities

Analysis Process: head PID: 6264, Parent PID: 4331

General

Linux Analysis Report
meow.arm7.elf