Edit tour

Linux Analysis Report
roze.armv4.elf

Overview

General Information

Sample name:	roze.armv4.elf
Analysis ID:	1574441
MD5:	c7ab3299bbb43f38048cd35209006d18
SHA1:	d4a1fe8a95308a25f187693b16b2214d8e0420f0
SHA256:	0463395ca3c8a0a7e50f0959e799d839affb2c24d9a0a039d7fd6ad192d3dc14
Tags:	elfGafgytuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574441
Start date and time:	2024-12-13 11:22:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	roze.armv4.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: roze.armv4.elf

Runtime Messages

Command:	/tmp/roze.armv4.elf
PID:	5519
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5506, Parent: 3670)

rm (PID: 5506, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.kpqbcNkbYa /tmp/tmp.rjvdf3rH3N /tmp/tmp.l6PwKND1wB

dash New Fork (PID: 5507, Parent: 3670)

rm (PID: 5507, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.kpqbcNkbYa /tmp/tmp.rjvdf3rH3N /tmp/tmp.l6PwKND1wB

roze.armv4.elf (PID: 5519, Parent: 5440, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/roze.armv4.elf

roze.armv4.elf New Fork (PID: 5521, Parent: 5519)

roze.armv4.elf New Fork (PID: 5523, Parent: 5521)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
roze.armv4.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
roze.armv4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
roze.armv4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1901c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1906c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
roze.armv4.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1d4f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5521.1.00007fc494017000.00007fc494037000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5521.1.00007fc494017000.00007fc494037000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5519.1.00007fc494017000.00007fc494037000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5521.1.00007fc494017000.00007fc494037000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1901c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1906c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5521.1.00007fc494017000.00007fc494037000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1d4f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5519.1.00007fc494017000.00007fc494037000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5519.1.00007fc494017000.00007fc494037000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1901c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1906c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5519.1.00007fc494017000.00007fc494037000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1d4f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: roze.armv4.elf PID: 5519	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: roze.armv4.elf PID: 5519	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1475c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x147fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1484c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1489c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x148b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x148c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x148d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: roze.armv4.elf PID: 5519	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17bf0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x17e5d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1aa8a:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: roze.armv4.elf PID: 5521	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: roze.armv4.elf PID: 5521	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10eb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10fe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ff8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1100c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: roze.armv4.elf PID: 5521	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14360:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x145cd:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x171fa:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: roze.armv4.elf

Avira: detected

Found malware configuration

Source: roze.armv4.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "37.44.238.73:8778"}

Multi AV Scanner detection for submitted file

Source: roze.armv4.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/roze.armv4.elf (PID: 5519)

Opens: /proc/net/route

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.15:47610 -> 37.44.238.73:8778

Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	TCP traffic detected without corresponding DNS query: 37.44.238.73
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: roze.armv4.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: roze.armv4.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: roze.armv4.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: roze.armv4.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: roze.armv4.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

System Summary

Malicious sample detected (through community Yara rule)

Source: roze.armv4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: roze.armv4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: roze.armv4.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: roze.armv4.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: roze.armv4.elf PID: 5521, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: roze.armv4.elf PID: 5521, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: httpattack

Source: roze.armv4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: roze.armv4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: roze.armv4.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: roze.armv4.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: roze.armv4.elf PID: 5521, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: roze.armv4.elf PID: 5521, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/0@2/0

Source: /usr/bin/dash (PID: 5506)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.kpqbcNkbYa /tmp/tmp.rjvdf3rH3N /tmp/tmp.l6PwKND1wB			Jump to behavior
Source: /usr/bin/dash (PID: 5507)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.kpqbcNkbYa /tmp/tmp.rjvdf3rH3N /tmp/tmp.l6PwKND1wB			Jump to behavior

Source: /tmp/roze.armv4.elf (PID: 5519)

Queries kernel information via 'uname':

Jump to behavior

Source: roze.armv4.elf, 5519.1.00007fffe6083000.00007fffe60a4000.rw-.sdmp, roze.armv4.elf, 5521.1.00007fffe6083000.00007fffe60a4000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/roze.armv4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/roze.armv4.elf
Source: roze.armv4.elf, 5519.1.0000560f71d0f000.0000560f71e3d000.rw-.sdmp, roze.armv4.elf, 5521.1.0000560f71d0f000.0000560f71e3d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: roze.armv4.elf, 5519.1.00007fffe6083000.00007fffe60a4000.rw-.sdmp, roze.armv4.elf, 5521.1.00007fffe6083000.00007fffe60a4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: roze.armv4.elf, 5519.1.0000560f71d0f000.0000560f71e3d000.rw-.sdmp, roze.armv4.elf, 5521.1.0000560f71d0f000.0000560f71e3d000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: roze.armv4.elf, type: SAMPLE
Source: Yara match	File source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: roze.armv4.elf, type: SAMPLE
Source: Yara match	File source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roze.armv4.elf PID: 5519, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: roze.armv4.elf PID: 5521, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: roze.armv4.elf, type: SAMPLE
Source: Yara match	File source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: roze.armv4.elf, type: SAMPLE
Source: Yara match	File source: 5521.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5519.1.00007fc494017000.00007fc494037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roze.armv4.elf PID: 5519, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: roze.armv4.elf PID: 5521, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "37.44.238.73:8778"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
roze.armv4.elf	66%	ReversingLabs	Linux.Trojan.Gafgyt
roze.armv4.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
37.44.238.73:8778	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	roze.armv4.elf	false	high
http://www.billybobbot.com/crawler/)	roze.armv4.elf	false	high
http://fast.no/support/crawler.asp)	roze.armv4.elf	false	high
http://feedback.redkolibri.com/	roze.armv4.elf	false	high
http://www.baidu.com/search/spider.htm)	roze.armv4.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
37.44.238.73	unknown	France		49434	HARMONYHOSTING-ASFR	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
37.44.238.73	roze.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.armv5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.armv6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	roze.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	roze.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	nshsh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	roze.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	roze.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	0x86d.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HARMONYHOSTING-ASFR	roze.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.armv5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.armv6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73
	roze.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.44.238.73

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	6.147511973710487
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	roze.armv4.elf
File size:	171'215 bytes
MD5:	c7ab3299bbb43f38048cd35209006d18
SHA1:	d4a1fe8a95308a25f187693b16b2214d8e0420f0
SHA256:	0463395ca3c8a0a7e50f0959e799d839affb2c24d9a0a039d7fd6ad192d3dc14
SHA512:	0215692ce1a90181e2d995f36f084ca8c898888776d9a8713b801c604465929b4fa0ea02a761588a867b688af765b2281ca58668d39859acb16dbb301b1cd80e
SSDEEP:	3072:Bdy8WoZAeDfivrlIsFZjgdc0xkWQLz+5hij7seUmSQnNbGUBn:f6vpu1xkWQf+5hij71UmSQnNbGUBn
TLSH:	FBF31824F5408267C2D327FAA69E838D3F3557E223D733145A389FB02FC2B952D66964
File Content Preview:	.ELF...a..........(.........4....#......4. ...(..........................................................i..........Q.td..................................-...L."....^..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	140172
Section Header Size:	40
Number of Section Headers:	21
Header String Table Index:	18

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x17844	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f8f4	0x178f4	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f908	0x17908	0x7db8	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x28000	0x20000	0x4	0x0	0x3	WA	0	0	4
.ctors	PROGBITS	0x28004	0x20004	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x2800c	0x2000c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x28014	0x20014	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x28018	0x20018	0x36c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x28384	0x20384	0x6664	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x20384	0xc40	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x20fc8	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x210e8	0x70d	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x217f5	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x218a9	0x978	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x22224	0xa0	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x222c4	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x222d4	0xb8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x226d4	0x4eb0	0x10	0x0		20	701	4
.strtab	STRTAB	0x0	0x27584	0x274b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1f6c0	0x1f6c0	6.3305	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x20000	0x28000	0x28000	0x384	0x69e8	3.9545	0x6	RW	0x8000	.eh_frame .ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f8f4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f908	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x28000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x28004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2800c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x28014	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x28018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x28384	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f8f4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f900	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f904	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x836c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x889c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x961c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xada8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xccc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd84c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf11c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf27c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1497c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1607c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1636c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1665c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1681c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1782c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1792c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1904c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1930c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b57c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b80c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ceb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e66c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e95c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28004	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x2800c	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1f8e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28028	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8364	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8498	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8500	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8888	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22258	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xab20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xada4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb8b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xccc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd2cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf594	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1052c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13be0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x28	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x48	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x50	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x70	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x14e58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28124	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x26010	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2812c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x26310	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1502c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1503c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28134	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x26610	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26644	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15ab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15afc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28270	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2664c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16364	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x266d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16664	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1686c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28274	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x177e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1791c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2828c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x17994	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x282a4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x17c10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2723c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17ff0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28350	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x18134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18264	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18928	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1896c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28368	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x18d8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19274	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x272c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x193d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e5c8	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x193e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x272f4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1aa5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aaf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b55c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b738	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c184	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cdf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d178	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28374	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1ddec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28376	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x273a0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1e2a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ec24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28378	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x273c0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x78	0	NOTYPE	<unknown>	DEFAULT	16
$d	.symtab	0x98	0	NOTYPE	<unknown>	DEFAULT	16
C.1.3461	.symtab	0x272c8	24	OBJECT	<unknown>	DEFAULT	4
C.108.5472	.symtab	0x22258	48	OBJECT	<unknown>	DEFAULT	4
C.141.5784	.symtab	0x226cc	24	OBJECT	<unknown>	DEFAULT	4
C.196.6396	.symtab	0x22d28	12	OBJECT	<unknown>	DEFAULT	4
C.197.6397	.symtab	0x22cb8	92	OBJECT	<unknown>	DEFAULT	4
C.199.6504	.symtab	0x236f0	1144	OBJECT	<unknown>	DEFAULT	4
C.202.6541	.symtab	0x252b4	24	OBJECT	<unknown>	DEFAULT	4
C.205.6572	.symtab	0x254d4	24	OBJECT	<unknown>	DEFAULT	4
C.216.6711	.symtab	0x2572c	1128	OBJECT	<unknown>	DEFAULT	4
C.257.7011	.symtab	0x25c98	96	OBJECT	<unknown>	DEFAULT	4
C.261.7059	.symtab	0x25e2c	36	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x10294	668	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0xe5d4	448	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x16248	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x16264	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x283b8	16384	OBJECT	<unknown>	DEFAULT	10
Randhex	.symtab	0xf27c	444	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0xd00c	356	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0xf598	1668	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0xe794	372	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0xe908	372	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xd170	356	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0xccc4	420	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0xd84c	3464	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xb498	336	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa9a8	380	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0xb748	372	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9dac	1224	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0xefbc	352	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x14b74	40	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x28008	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x28004	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x28124	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x26010	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x28378	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x273c0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2812c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x26310	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x28010	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x2800c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x28000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x28000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x28124	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower	.symtab	0x28378	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper	.symtab	0x2812c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_b	.symtab	0x28128	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x2837c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x28130	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x14e90	12	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x14b10	100	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1ae18	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x16560	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x193e0	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14aac	100	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x16aac	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x16ad0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x16a88	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x188cc	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x18970	76	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x16574	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14b74	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1782c	256	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x17e48	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c18c	56	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x14bc8	44	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x18edc	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x14bf4	44	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1904c	212	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x19710	48	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x19740	52	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x193ec	804	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x16874	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2e5c8	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x1c0d4	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1c1e0	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x17ff4	156	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x19890	368	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14aac	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1ac48	464	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1a9b0	188	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1ae18	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1aa6c	156	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1af48	148	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x19a00	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x14c20	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x16048	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1c9d4	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1c9e0	312	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1c20c	80	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1607c	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1ae18	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14c4c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x18f08	8	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x18f10	8	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x18f18	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1681c	8	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x16824	80	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1b9b0	664	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1e300	764	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1e5fc	112	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x18f20	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x14c74	8	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14c7c	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x168a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x18f38	8	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2e5cc	4	OBJECT	<unknown>	HIDDEN	10
__GI_htonl	.symtab	0x16714	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x16700	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x167f8	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1b8c0	240	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x167ec	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x16768	132	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1d2c0	620	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1cf80	512	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x17d80	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x14ca8	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x16668	32	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x14e44	24	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14cf8	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1e714	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1b470	244	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x16150	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1e780	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1b564	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1b57c	220	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x16160	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x18d98	96	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c25c	48	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x18f40	44	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x18f6c	44	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x16748	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x16734	20	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x14d24	92	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x191dc	156	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1e66c	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1bc48	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x17930	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x17c14	140	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1cd4c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x14d80	44	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1930c	212	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x168fc	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x18f98	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14dac	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x16928	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x16954	52	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x14ddc	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x16988	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x17b4c	200	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x18df8	116	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x169e4	164	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x18ff0	48	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x18090	168	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x14e9c	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x169b8	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x14ecc	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x17ca0	224	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1e698	80	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1ebac	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x16280	236	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1b658	232	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x16200	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x16200	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1636c	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1b740	64	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1e790	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x16220	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1cdfc	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x16390	216	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1b880	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1b780	68	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1b7c4	72	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x16468	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1665c	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1b80c	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x17e54	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x18250	1528	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x16688	120	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x14e08	8	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x14e5c	52	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1e6e8	44	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x18e80	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x14f00	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x19020	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x14e10	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x19774	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x197e4	172	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x197c4	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x14e18	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x28014	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x28014	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x1ee1c	736	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f7ec	20	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f7ec	20	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f7d0	48	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f864	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1ee1c	736	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f800	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f83c	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f850	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f828	20	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f814	20	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f538	516	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1f210	808	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1ee10	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1ee18	740	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1f150	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1f124	44	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1ecd0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv0	.symtab	0x14a60	4	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1edf8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1f1a4	108	FUNC	<unknown>	HIDDEN	2
__aeabi_ldiv0	.symtab	0x14a60	4	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1f0fc	40	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x147a0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x14898	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1f190	128	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2e5c0	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x28350	24	OBJECT	<unknown>	DEFAULT	9
__bss_end__	.symtab	0x2e9e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x28384	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x28384	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x18938	56	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1e23c	124	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x1f74c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x28128	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x2837c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x28130	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2e5d0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x28018	0	NOTYPE	<unknown>	DEFAULT	9
__decode_dotted	.symtab	0x1d52c	244	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1e8a8	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x18e70	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x18e6c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x14a60	4	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f538	516	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1ecd0	296	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1d620	1936	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1f8b8	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x2801c	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1ec28	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1e7c0	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1e95c	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2e9e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2e5b8	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x1f74c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x14e90	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x18ea4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2e5b0	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x1f150	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x14b10	100	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1ae18	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	6
__fixunsdfsi	.symtab	0x1f864	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1f1a4	108	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1f124	44	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1f190	128	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1f0fc	40	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x1f73c	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1e2b8	72	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c874	352	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x18f20	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x16560	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x1f73c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x193e0	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	6
__ledf2	.symtab	0x1f744	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x14bf4	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x16874	44	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x14aac	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x14c20	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1e714	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x18f6c	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x14d24	92	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x14d80	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x168fc	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x14dac	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x16928	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x16954	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x18df8	116	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2e5b4	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x18c5c	316	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x14e10	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x14e18	44	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x273a0	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1f744	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x17454	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x16af4	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x28274	24	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x2e654	888	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x173b0	164	FUNC	<unknown>	DEFAULT	2
__modsi3	.symtab	0x1497c	228	FUNC	<unknown>	HIDDEN	2
__muldf3	.symtab	0x1f210	808	FUNC	<unknown>	HIDDEN	2
__muldi3	.symtab	0x14a64	72	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2e9dc	4	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2e9e0	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x1f74c	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x1e9b8	12	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1de30	1036	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2e5bc	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x28004	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x2836c	4	OBJECT	<unknown>	DEFAULT	9
__progname_full	.symtab	0x28370	4	OBJECT	<unknown>	DEFAULT	9
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x1889c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x18894	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x18894	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x18894	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x18894	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1e9c4	488	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2e9d4	4	OBJECT	<unknown>	HIDDEN	10
__resolv_attempts	.symtab	0x28377	1	OBJECT	<unknown>	HIDDEN	9
__resolv_lock	.symtab	0x2e5d8	24	OBJECT	<unknown>	DEFAULT	10
__resolv_timeout	.symtab	0x28376	1	OBJECT	<unknown>	HIDDEN	9
__rtld_fini	.symtab	0x2e5c4	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2e9d8	4	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2e9e4	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x16aac	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x16ad0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x16a88	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x28140	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x1cb18	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x19a0c	212	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1cb74	192	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x19dcc	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x15030	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4591	.symtab	0x26610	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x1cc34	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1cd1c	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1cc60	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x19f04	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x150f8	44	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x28144	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x1ee18	740	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x1c1c4	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x18eb0	44	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x188cc	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x18970	76	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x189bc	672	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x28368	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x147a0	248	FUNC	<unknown>	HIDDEN	2
__umodsi3	.symtab	0x148b0	204	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x18e80	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x16574	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1c59c	728	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1c28c	784	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2e3c0	10	OBJECT	<unknown>	DEFAULT	10
_bss_end__	.symtab	0x2e9e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x15124	80	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2e5fc	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_handler	.symtab	0x2e624	40	OBJECT	<unknown>	HIDDEN	10
_custom_printf_spec	.symtab	0x28270	4	OBJECT	<unknown>	HIDDEN	9
_dl_aux_init	.symtab	0x1c168	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2e9cc	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2e9d0	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x28384	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2e9e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2e5c8	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x14b74	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1f8f4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2c3c0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x15174	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1a210	1952	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2e5cc	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1a008	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1afe0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x15850	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x15b08	1344	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x158e8	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x15920	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x15abc	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x188ac	32	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x188a4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2e64c	8	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x19ae0	748	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x14fb4	124	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x28148	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x2814c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x1ab08	320	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2c3bc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x28164	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2c3b8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x28180	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x15040	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2817c	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x17e5c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1a07c	64	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x266e0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1a0bc	340	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x151f4	1628	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1782c	256	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x14b9c	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0xcb64	352	FUNC	<unknown>	DEFAULT	2
atcp	.symtab	0xc430	1844	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x17e48	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x17e48	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
audp	.symtab	0xbe28	1544	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x16130	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2e5ac	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1c18c	56	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x169e4	164	FUNC	<unknown>	DEFAULT	2
buf.2915	.symtab	0x2e3d0	16	OBJECT	<unknown>	DEFAULT	10
buf.5468	.symtab	0x2e3e0	440	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x16140	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x2811c	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1f8ec	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1bc60	268	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x14bc8	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x18edc	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x14bf4	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x1904c	212	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x28028	4	OBJECT	<unknown>	DEFAULT	9
completed.4916	.symtab	0x28384	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x16874	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x961c	640	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9a40	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x28118	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x28024	0	NOTYPE	<unknown>	DEFAULT	9
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2e5b8	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2e5c8	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x1c0d4	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x1c1e0	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x17ff4	156	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x272f4	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x19890	368	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x14aac	100	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x19120	188	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8504	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x19278	148	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1ac48	464	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1a9b0	188	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1ae18	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1aa6c	156	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1af48	148	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x272e0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x19a00	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x28018	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x28380	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x14c20	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x16048	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x175fc	520	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1c9d4	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1c9d4	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1c9e0	312	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1c20c	80	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0xa274	1844	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x1607c	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0x10ac8	28	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x925c	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x85d4	712	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0x10ae4	204	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x84a4	96	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1a9b0	188	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1ae18	304	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x14c4c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x18f08	8	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x18f10	8	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x18f18	8	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1681c	8	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x16824	80	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1b9b0	664	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1e300	764	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1e5fc	112	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x18f20	24	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x14c74	8	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14c7c	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x168a0	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x168cc	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x18f38	8	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x283a4	4	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2e5cc	4	OBJECT	<unknown>	DEFAULT	10
hoste.5467	.symtab	0x2e598	20	OBJECT	<unknown>	DEFAULT	10
htonl	.symtab	0x16714	32	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x16700	20	FUNC	<unknown>	DEFAULT	2
httpattack	.symtab	0xd2d4	1400	FUNC	<unknown>	DEFAULT	2
i.4554	.symtab	0x28120	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x16280	236	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x167f8	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1b8c0	240	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x167ec	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x16768	132	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1d2c0	620	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:23:39.127533913 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:23:39.248718023 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:23:39.248799086 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:23:39.251368046 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:23:39.373378992 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:23:43.243567944 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:23:43.243880987 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:23:43.476196051 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:23:43.476485968 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:24:43.250942945 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:24:43.251198053 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:24:43.442620993 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:24:43.442954063 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:25:43.258059978 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:25:43.258285046 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:25:43.449706078 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:25:43.449848890 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:26:43.266068935 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:26:43.266316891 CET	47610	8778	192.168.2.15	37.44.238.73
Dec 13, 2024 11:26:43.457938910 CET	8778	47610	37.44.238.73	192.168.2.15
Dec 13, 2024 11:26:43.458151102 CET	47610	8778	192.168.2.15	37.44.238.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 11:26:22.028233051 CET	47783	53	192.168.2.15	1.1.1.1
Dec 13, 2024 11:26:22.028290987 CET	53676	53	192.168.2.15	1.1.1.1
Dec 13, 2024 11:26:22.166651011 CET	53	53676	1.1.1.1	192.168.2.15
Dec 13, 2024 11:26:22.166670084 CET	53	47783	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 11:26:22.028233051 CET	192.168.2.15	1.1.1.1	0xe23f	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:26:22.028290987 CET	192.168.2.15	1.1.1.1	0x9ee6	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 11:26:22.166670084 CET	1.1.1.1	192.168.2.15	0xe23f	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 13, 2024 11:26:22.166670084 CET	1.1.1.1	192.168.2.15	0xe23f	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 5506, Parent PID: 3670

General

Start time (UTC):	10:23:27
Start date (UTC):	13/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5506, Parent PID: 3670

General

Start time (UTC):	10:23:27
Start date (UTC):	13/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.kpqbcNkbYa /tmp/tmp.rjvdf3rH3N /tmp/tmp.l6PwKND1wB
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5507, Parent PID: 3670

General

Start time (UTC):	10:23:27
Start date (UTC):	13/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5507, Parent PID: 3670

General

Start time (UTC):	10:23:27
Start date (UTC):	13/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.kpqbcNkbYa /tmp/tmp.rjvdf3rH3N /tmp/tmp.l6PwKND1wB
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: roze.armv4.elf PID: 5519, Parent PID: 5440

General

Start time (UTC):	10:23:38
Start date (UTC):	13/12/2024
Path:	/tmp/roze.armv4.elf
Arguments:	/tmp/roze.armv4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: roze.armv4.elf PID: 5521, Parent PID: 5519

General

Start time (UTC):	10:23:38
Start date (UTC):	13/12/2024
Path:	/tmp/roze.armv4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: roze.armv4.elf PID: 5523, Parent PID: 5521

General

Start time (UTC):	10:23:38
Start date (UTC):	13/12/2024
Path:	/tmp/roze.armv4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report roze.armv4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 5506, Parent PID: 3670

General

Chronological Activities

Analysis Process: rm PID: 5506, Parent PID: 3670

General

Chronological Activities

Analysis Process: dash PID: 5507, Parent PID: 3670

General

Chronological Activities

Analysis Process: rm PID: 5507, Parent PID: 3670

General

Linux Analysis Report
roze.armv4.elf