Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:	arm7.elf
Analysis ID:	1581689
MD5:	bb354e53a3da97a7dabfc7f147daf2a5
SHA1:	48e0aa38fac23c5d9fd965006cc09cf9fb70ea09
SHA256:	1caa1e6a4e3254502172011dc815b1cd5773815a1216f36d1a3089750cd4c140
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Executes the "iptables" command to insert, remove and/or manipulate rules

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "iptables" command used for managing IP filtering and manipulation

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581689
Start date and time:	2024-12-28 16:56:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm7.elf
Detection:	MAL
Classification:	mal64.spre.troj.linELF@0/17@4/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/arm7.elf
PID:	6240
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	listening dn0
Standard Error:

Process Tree

system is lnxubuntu20

arm7.elf (PID: 6240, Parent: 6167, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf

arm7.elf New Fork (PID: 6242, Parent: 6240)

arm7.elf New Fork (PID: 6372, Parent: 6242)

arm7.elf New Fork (PID: 6374, Parent: 6372)

sh (PID: 6374, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 6376, Parent: 6374)

iptables (PID: 6376, Parent: 6374, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

arm7.elf New Fork (PID: 6384, Parent: 6372)

sh (PID: 6384, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 6386, Parent: 6384)

busybox (PID: 6386, Parent: 6384, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

arm7.elf New Fork (PID: 6388, Parent: 6372)

sh (PID: 6388, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 6391, Parent: 6388)

arm7.elf New Fork (PID: 6392, Parent: 6372)

sh (PID: 6392, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 6398, Parent: 6392)

arm7.elf New Fork (PID: 6399, Parent: 6372)

sh (PID: 6399, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 6404, Parent: 6399)

busybox (PID: 6404, Parent: 6399, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

systemd New Fork (PID: 6245, Parent: 1)

dbus-daemon (PID: 6245, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6278, Parent: 1860)

pulseaudio (PID: 6278, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6287, Parent: 1)

systemd-logind (PID: 6287, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6293, Parent: 1)

rtkit-daemon (PID: 6293, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6349, Parent: 1)

polkitd (PID: 6349, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6354, Parent: 1)

agetty (PID: 6354, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6356, Parent: 1320)

Default (PID: 6356, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6357, Parent: 1320)

Default (PID: 6357, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6358, Parent: 1320)

Default (PID: 6358, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6359, Parent: 1)

gpu-manager (PID: 6359, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6360, Parent: 6359)

sh (PID: 6360, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6361, Parent: 6360)

grep (PID: 6361, Parent: 6360, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6362, Parent: 6359)

sh (PID: 6362, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6363, Parent: 6362)

grep (PID: 6363, Parent: 6362, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6364, Parent: 6359)

sh (PID: 6364, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6365, Parent: 6364)

grep (PID: 6365, Parent: 6364, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6368, Parent: 6359)

sh (PID: 6368, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6369, Parent: 6368)

grep (PID: 6369, Parent: 6368, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6370, Parent: 6359)

sh (PID: 6370, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6371, Parent: 6370)

grep (PID: 6371, Parent: 6370, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6377, Parent: 6359)

sh (PID: 6377, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6378, Parent: 6377)

grep (PID: 6378, Parent: 6377, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6387, Parent: 6359)

sh (PID: 6387, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6390, Parent: 6387)

grep (PID: 6390, Parent: 6387, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6405, Parent: 6359)

sh (PID: 6405, Parent: 6359, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6406, Parent: 6405)

grep (PID: 6406, Parent: 6405, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6409, Parent: 1)

generate-config (PID: 6409, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6410, Parent: 6409)

pkill (PID: 6410, Parent: 6409, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6411, Parent: 1)

gdm-wait-for-drm (PID: 6411, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6417, Parent: 1)

gdm3 (PID: 6417, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6421, Parent: 6417)

plymouth (PID: 6421, Parent: 6417, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6440, Parent: 6417)

gdm-session-worker (PID: 6440, Parent: 6417, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6444, Parent: 6440)

gdm-wayland-session (PID: 6444, Parent: 6440, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6446, Parent: 6444)

dbus-daemon (PID: 6446, Parent: 6444, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6448, Parent: 6446)

dbus-daemon New Fork (PID: 6449, Parent: 6448)

false (PID: 6449, Parent: 6448, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6450, Parent: 6444)

dbus-run-session (PID: 6450, Parent: 6444, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6451, Parent: 6450)

dbus-daemon (PID: 6451, Parent: 6450, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6452, Parent: 6417)

Default (PID: 6452, Parent: 6417, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6453, Parent: 6417)

Default (PID: 6453, Parent: 6417, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6423, Parent: 1)

accounts-daemon (PID: 6423, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6433, Parent: 6423)

language-validate (PID: 6433, Parent: 6423, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6436, Parent: 6433)

language-options (PID: 6436, Parent: 6433, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6437, Parent: 6436)

sh (PID: 6437, Parent: 6436, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6438, Parent: 6437)

locale (PID: 6438, Parent: 6437, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6439, Parent: 6437)

grep (PID: 6439, Parent: 6437, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: arm7.elf

ReversingLabs: Detection: 26%

Source: /usr/bin/pulseaudio (PID: 6278)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Networking

Executes the "iptables" command to insert, remove and/or manipulate rules

Source: /bin/sh (PID: 6376)

Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: /bin/sh (PID: 6376)

Iptables executable: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /tmp/arm7.elf (PID: 6240)	Socket: 127.0.0.1:8345	Jump to behavior
Source: /tmp/arm7.elf (PID: 6372)	Socket: 0.0.0.0:26721	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6417)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6446)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 94.16.114.254
Source: unknown	UDP traffic detected without corresponding DNS query: 94.16.114.254

Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com
Source: global traffic	DNS traffic detected: DNS query: secure-network-rebirthltd.ru

Source: unknown

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37606
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 33, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 44, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 66, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 777, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 888, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 999, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 1111, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 2222, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 3333, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 5555, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 6666, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 7777, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 8888, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 9999, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 11111, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 22222, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 33333, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 44444, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 444447, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 66666, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 666665, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 666667, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 666669, result: no such process	Jump to behavior

Source: arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
Source: Initial sample	String containing 'busybox' found: busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
Source: Initial sample	String containing 'busybox' found: socketsetsockoptbindlisten1.1.1.1hi im here, i think/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPTbusybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPTbindtoipconnectpoll/proc/net/tcp/proc/0

Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 33, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 44, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 66, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 777, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 888, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 999, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 1111, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 2222, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 3333, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 5555, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 6666, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 7777, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 8888, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 9999, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 11111, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 22222, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 33333, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 44444, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 444447, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 66666, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 666665, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 666667, result: no such process	Jump to behavior
Source: /tmp/arm7.elf (PID: 6242)	SIGKILL sent: pid: 666669, result: no such process	Jump to behavior

Source: classification engine

Classification label: mal64.spre.troj.linELF@0/17@4/0

Persistence and Installation Behavior

Executes the "iptables" command to insert, remove and/or manipulate rules

Source: /bin/sh (PID: 6376)

Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6245)	File: /proc/6245/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6446)	File: /proc/6446/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6451)	File: /proc/6451/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 6287)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/seats/.#seat0xa0FxB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/users/.#127UMzc8z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/users/.#127M8t7bA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/seats/.#seat0SReakC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/users/.#127VdVUuB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/users/.#1270HaBNy	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6287)	File: /run/systemd/users/.#1276mnOJC	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6349)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6444)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6423)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6423)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6440/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6440/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6245/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6245/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6423/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6444/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6293/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/1389/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6349/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6245)	File opened: /proc/6417/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6354/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6354/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6226/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6349/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6349/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6247/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	File opened: /proc/122/cmdline	Jump to behavior

Source: /tmp/arm7.elf (PID: 6374)	Shell command executed: /bin/sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/arm7.elf (PID: 6384)	Shell command executed: /bin/sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/arm7.elf (PID: 6388)	Shell command executed: /bin/sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/arm7.elf (PID: 6392)	Shell command executed: /bin/sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/arm7.elf (PID: 6399)	Shell command executed: /bin/sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6360)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6362)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6364)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6368)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6370)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6377)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6387)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6437)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6361)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6363)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6365)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6369)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6371)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6378)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6390)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6406)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6439)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /bin/sh (PID: 6376)

Iptables executable: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6410)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /tmp/arm7.elf (PID: 6242)

Reads from proc file: /proc/stat

Jump to behavior

Source: /sbin/agetty (PID: 6354)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6417)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6417)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6423)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6423)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6359)

Log file created: /var/log/gpu-manager.log

Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6359)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6278)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6410)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/arm7.elf (PID: 6240)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/busybox (PID: 6386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6404)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6278)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6359)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6440)	Queries kernel information via 'uname':	Jump to behavior

Source: arm7.elf, 6240.1.0000559380a39000.0000559380baf000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.elf, 6240.1.00007fffae45c000.00007fffae47d000.rw-.sdmp	Binary or memory string: Jx86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 6240.1.0000559380a39000.0000559380baf000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 6240.1.00007fffae45c000.00007fffae47d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6423)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm7.elf	26%	ReversingLabs	Linux.Backdoor.Gafgyt

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
secure-network-rebirthltd.ru	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	yakuza.mips.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Gafgyt	Browse
	arm5.elf	Get hash	malicious	Gafgyt	Browse
	arm6.elf	Get hash	malicious	Gafgyt	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	yakuza.mips.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Gafgyt	Browse
	arm5.elf	Get hash	malicious	Gafgyt	Browse
	arm6.elf	Get hash	malicious	Gafgyt	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	45.200.149.186-boatnet.arm-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	yakuza.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
CANONICAL-ASGB	yakuza.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
CANONICAL-ASGB	yakuza.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
INIT7CH	yakuza.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6449/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:F:F
MD5:	242D015613C4A74ECAD1B1CB1C2DC813
SHA1:	15A816931A8D0968EA51550FC5AAFA4DE3A92C72
SHA-256:	FCB6CF42A22FA2EA75FA9C87AE41A50B0A69FBB1DE74F4F68316DB078D51AA58
SHA-512:	C63884C6AF41E420D8E61DE80149C5E5FAFB46F7056C545D2F292F7BC6A7DC55A28DB34F08DF415990FC09DF914FC734A4F90964363366FE7052A344CE4AE4EE
Malicious:	false
Reputation:	low
Preview:	6417.

/run/systemd/seats/.#seat0SReakC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0xa0FxB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1270HaBNy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.299507273356801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA4wT1vNTXzxk9H206qodFSc:SbFuFyL3BVgdL87iesnAiRJg1uFKt6r5
MD5:	D01414E0F9DE0E4AD376F9A5552838B6
SHA1:	3442C4D0CAC8143C52EF26FC50F0740DD38487FA
SHA-256:	130DB962E43635669EB57565DD4F2464C8D8E603DDDE6AA5A2EB5CDB6F421394
SHA-512:	C1410F16CB15989E30870ACEB6257807EC6D8315A971EACB33E287B73C9AC606D7C0C56C2439895E6793304730FF290B0DD6512C67322EC498A5FD1F4D6FC3D6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735401436934129.MONOTONIC=441038940.LAST_SESSION_TIMESTAMP=441106177.

/run/systemd/users/.#1276mnOJC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.446793696975809
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6wJg1uFKt6rSc:qgFq30dABibBxgoKIr5
MD5:	C2A017DA5B6D03E3CD861B8987356F2A
SHA1:	A334DAA37458A6FF29117A178CCD7C32715F9CC3
SHA-256:	62F40BE7EDAF69E5A44ED9BEC2539F288BB8CADFFC14F152690CF73778F34F74
SHA-512:	8E2B8143A12B469BF53CD327C5D9CDA885587D3F6893B1D050C4A670BA7F9675DF7B6EF835FE3E6189276598C69D17F384B0E6B7276D1A145523D1AF934A3720
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12344.REALTIME=1735401436934129.MONOTONIC=441038940.LAST_SESSION_TIMESTAMP=441106177.

/run/systemd/users/.#127M8t7bA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297753979495689
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6N/QgTg1uFqnQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE/QCgoqnjthQHtPYb
MD5:	BEABEE5572A9EA80E917A6BADC89F3CB
SHA1:	E75A694048B2711C02D9E1406CE9F2454A17B4CA
SHA-256:	314022593A0AE74361CE6EE05236A21F9529708FB90C98704750A16110B36B98
SHA-512:	D5B5EC696549187260945C0780D3E9ABC8B9ADF328980575D0A6318D5A7944201EF69A094B057F4FA89E87FC2199A07287FD36BE380DBD26D9D51599A99BE408
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12282.REALTIME=1735401436934129.MONOTONIC=441038940.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127UMzc8z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VdVUuB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297753979495689
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6N/QgTg1uFqnQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE/QCgoqnjthQHtPYb
MD5:	BEABEE5572A9EA80E917A6BADC89F3CB
SHA1:	E75A694048B2711C02D9E1406CE9F2454A17B4CA
SHA-256:	314022593A0AE74361CE6EE05236A21F9529708FB90C98704750A16110B36B98
SHA-512:	D5B5EC696549187260945C0780D3E9ABC8B9ADF328980575D0A6318D5A7944201EF69A094B057F4FA89E87FC2199A07287FD36BE380DBD26D9D51599A99BE408
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12282.REALTIME=1735401436934129.MONOTONIC=441038940.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:E:E
MD5:	A77B2EF124339C31F42546DE2182B473
SHA1:	A3EDF693861CB230F48502007A4AC936B9E43898
SHA-256:	82C34918A2A0F2A8747DC48F457D849E3822B73B3253BE5A357EBCEFA115B798
SHA-512:	A86DF6684B3FAD8B044AD4D80660CE67D372FF162B7CE9B390E206129516684B1A33752FD9FE71A674890A9F3100088C74AA03C8A9CE1A5525DD35C25C54E1B1
Malicious:	false
Preview:	6278.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:RlSsXlXEWtl/7VT1l:T+yl55
MD5:	89ABE676C99D097E487C59FC9E15BC5E
SHA1:	5A6787FB65705F352A4F08D46BEA04830687BFC6
SHA-256:	CB8380B5425747E8DDB53F8C04D6896A40FF05BF0F5540E7DDDB09A63F959587
SHA-512:	3513D135B5512256990D422F2CEB7DD07B6C6AEF215A15D988DF53CA447CE2D9CFFC410AD63E6B3584F1DAFCE634F8CF8798FFA3448B72350F3835132426380A
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................pgM.......................................

/var/lib/AccountsService/users/gdm.YIHVZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:RlSsXlXEWtl/7VT1l:T+yl55
MD5:	89ABE676C99D097E487C59FC9E15BC5E
SHA1:	5A6787FB65705F352A4F08D46BEA04830687BFC6
SHA-256:	CB8380B5425747E8DDB53F8C04D6896A40FF05BF0F5540E7DDDB09A63F959587
SHA-512:	3513D135B5512256990D422F2CEB7DD07B6C6AEF215A15D988DF53CA447CE2D9CFFC410AD63E6B3584F1DAFCE634F8CF8798FFA3448B72350F3835132426380A
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................pgM.......................................

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.005377902248608
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.elf
File size:	216'293 bytes
MD5:	bb354e53a3da97a7dabfc7f147daf2a5
SHA1:	48e0aa38fac23c5d9fd965006cc09cf9fb70ea09
SHA256:	1caa1e6a4e3254502172011dc815b1cd5773815a1216f36d1a3089750cd4c140
SHA512:	e0653312da8c7cd419b021d3195ee03e541732f62e52ad29be870e9162ece6434c47d24039c6d001ff1068a463a0fac0ee396c6a9b8f4058017f28b432798463
SSDEEP:	6144:Sx3g96jICPaFrN6v0szKYnbslzcsfM/ROYaBK:C5jICPadN6v0sOMISsk/vaBK
TLSH:	1E242A45AA408F13C4D72BB9FB9F424533339B64D7E763069528ABB43F8779A4F62201
File Content Preview:	.ELF..............(.........4...........4. ...(........p............................................$...$...............$...$...$...T...0W..............(...(...(...................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	168372
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1e1e8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x262d8	0x1e2d8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x262e8	0x1e2e8	0x1f8c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x28274	0x20274	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x2828c	0x2028c	0x198	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x30424	0x20424	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x30428	0x20428	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x3042c	0x2042c	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x3042c	0x2042c	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x30430	0x20430	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x30434	0x20434	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x30438	0x20438	0xc4	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x304fc	0x204fc	0x27c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x30778	0x20778	0x53dc	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x20778	0x1228	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x219a0	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x21b20	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x21d5e	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x24805	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x2519f	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x2632c	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x26668	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x27124	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x2894e	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2907e	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x29094	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x29664	0x7590	0x10	0x0		29	1120	4
.strtab	STRTAB	0x0	0x30bf4	0x40f1	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x2028c	0x2828c	0x2828c	0x198	0x198	4.8097	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x20424	0x20424	6.1116	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x20424	0x30424	0x30424	0x354	0x5730	4.3474	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x20428	0x30428	0x30428	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x262d8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x262e8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x28274	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x2828c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x30424	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x30428	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x3042c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x3042c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x30430	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x30434	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x30438	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x304fc	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x30778	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x262d8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x262e4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa10c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb62c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb76c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xecac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1220c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1563c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1611c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1712c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17284	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1731c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1736c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1758c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1787c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1789c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1879c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1884c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1898c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1904c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1914c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1918c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1927c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1991c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a89c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aaa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b3e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b684	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e01c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f63c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f96c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f9d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fe28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fe80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ffa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2003c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2013c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x202b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x203c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2041c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x208b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x209ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x209c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x209d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x210b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x214a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x214c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x214f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x215d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x240c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x241ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2428c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2437c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2445c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2454c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2467c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x246cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x250a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x251ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2538c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2554c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x255a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2566c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2569c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2577c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x257ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25c08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x260a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x261e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30430	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3042c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x830c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x304fc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30500	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30504	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30508	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30528	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x8e94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb0bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x264d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xb61c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbb60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30534	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30554	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd4e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf44c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2670c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x26730	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1075c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26b1c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x109e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26f1c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1137c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26f52	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1367c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30560	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x26f7c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x30564	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x14e40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15634	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15dd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30578	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x16c34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x17570	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x18844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x188c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18984	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18abc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19360	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x195d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1982c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27118	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1994c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30584	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30580	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1a794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27188	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1aa48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30668	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x27190	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b0e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b67c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27220	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c014	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c08c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c30c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c37c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c44c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c500	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c54c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c5d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c61c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3066c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1d2d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d68c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30684	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1dd54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1decc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3069c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30734	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27da0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1e4dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e590	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30748	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e6d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ecf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f178	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f1d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f3c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f4fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f53c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f550	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f5e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f8ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f954	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f9c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fd70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fe20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fe78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ff98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2002c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20204	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2024c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30760	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2035c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x203bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x207bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30764	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x208b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20954	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20af4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20b5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20bac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20c88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21038	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21170	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x215d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21c4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x281b0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x22714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22e70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23274	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28214	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x237f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28240	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x23cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x240a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x241e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24374	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24a98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24ea0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2517c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25548	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2573c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x257e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30574	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x30770	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x27e86	0	NOTYPE	<unknown>	DEFAULT	4
C.0.2698	.symtab	0x264d0	36	OBJECT	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x27e0c	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x27118	24	OBJECT	<unknown>	DEFAULT	4
C.7.4228	.symtab	0x26f1c	54	OBJECT	<unknown>	DEFAULT	4
C.7.4248	.symtab	0x26730	44	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x27e18	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x2713c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x27160	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x28188	12	OBJECT	<unknown>	DEFAULT	4
C.7.6365	.symtab	0x27214	12	OBJECT	<unknown>	DEFAULT	4
C.8.4249	.symtab	0x2670c	36	OBJECT	<unknown>	DEFAULT	4
C.8.4287	.symtab	0x26f52	21	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x27154	12	OBJECT	<unknown>	DEFAULT	4
C.9.4204	.symtab	0x26b1c	1024	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x27148	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x35718	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x1b428	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x1b444	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x18ac0	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x30438	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x17324	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x17328	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x17fd8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1731c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x17360	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x17ffc	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1879c	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x17354	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x17f6c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x17f90	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x17fb4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x17284	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1789c	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x172d0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x30770	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x27e86	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x30424	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x30424	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x30770	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1f570	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1f554	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x30774	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x188f4	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x240c0	300	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x1b0e8	264	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1b780	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1f570	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1898c	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1f600	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1f720	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1f690	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x20834	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x16ad4	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x16ad8	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1f600	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1f5e4	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x30a5c	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x15c50	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x15ca4	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1f720	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1f704	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1f248	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1c7b4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1c7d8	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1c790	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x30a3c	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x202f4	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x203c4	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1f690	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1f674	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1b798	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x18ac0	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1db8c	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1c094	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1e2d8	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1c108	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x24e54	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x18b28	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1f570	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x194e0	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x20fc4	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x20ff8	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x20c9c	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1c190	116	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x18b60	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1e4ec	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x21174	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1898c	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x23d14	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x23804	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x240c0	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x23948	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x241ec	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x214a4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1edd4	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x19b64	48	FUNC	<unknown>	HIDDEN	2
__GI_fputc_unlocked	.symtab	0x1b0e8	264	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1b1f0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x25188	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x2538c	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x20854	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1b228	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x240c0	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x20958	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x20984	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x20998	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x209ac	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x18ba0	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1f3d0	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x18bdc	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1c204	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x18c14	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x209c0	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1c028	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x24718	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1bd8c	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1ba14	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1e0f4	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x209d4	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1b8a4	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x18c54	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x1c290	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x2577c	112	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x24ff4	172	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x250a0	232	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x2428c	240	FUNC	<unknown>	HIDDEN	2
__GI_memcmp	.symtab	0x1b2f0	44	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1b320	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1b330	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1b460	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x2437c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1b340	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x187d0	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x20ab4	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x18d44	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x18dc4	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1f600	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x196c0	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x19950	116	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x18e64	116	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x19b18	76	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x1b0e8	264	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1f418	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1dccc	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1df8c	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1f720	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x19834	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x20bb0	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x18f1c	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1c314	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1c3cc	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x20af8	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x190c8	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1c498	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1c554	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1914c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1c5dc	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1e1ec	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1884c	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1c668	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1c6b8	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1c6cc	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1918c	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x19b94	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1c624	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x214c4	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1e01c	216	FUNC	<unknown>	HIDDEN	2
__GI_sscanf	.symtab	0x1b010	48	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x19218	100	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x2445c	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x2454c	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1b3e0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1b3e0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1b484	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x24638	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1b400	96	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x1b4a8	272	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1b5b8	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x2467c	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x246cc	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1b684	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1e2f8	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1e6fc	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1b8c8	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x192bc	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x20b64	20	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x251ac	480	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x19ea8	324	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x22718	1896	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x19bc4	208	FUNC	<unknown>	HIDDEN	2
__GI_vsscanf	.symtab	0x1b040	168	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x20b78	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x192ec	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x21040	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x210b8	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x21094	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1f690	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x30434	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x30434	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x17fd8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x17f6c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x17f90	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x17fb4	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x257f8	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x26154	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x26154	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x26138	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2f	.symtab	0x26238	160	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x261e4	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x257f8	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x2616c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x261b4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x261cc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x2619c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x26184	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x25e98	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x25c08	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x257ec	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x257f4	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x25b54	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x25b2c	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1712c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x17258	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x25ba8	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x11e00	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x25b08	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x17018	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x17114	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x25b94	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x17f38	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x17f30	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x17f28	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x356fc	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x30748	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x35b54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x30778	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x30778	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x20370	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1ed70	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1f570	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1f554	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x260b4	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x30774	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x35704	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x304fc	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0x13688	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x188ec	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x188e0	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x30574	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x17270	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x25e98	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1712c	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x30430	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x35b54	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x356f4	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x260b4	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x12444	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1edd0	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x28424	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x2828c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x34c68	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x25b54	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x188f4	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x240c0	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x12e7c	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x30434	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x30430	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x261e4	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x25ba8	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x25b2c	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x25b94	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x25b08	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x11ccc	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x3573c	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x35b20	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x35b24	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x34c6c	4	OBJECT	<unknown>	HIDDEN	15
__fputc_unlocked	.symtab	0x1b0e8	264	FUNC	<unknown>	DEFAULT	2
__frame_dummy_init_array_entry	.symtab	0x3042c	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0x135e4	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x137b8	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x260a4	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x208b8	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x24eac	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x18ba0	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1f3d0	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1b780	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x176dc	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x177c4	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x17f5c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x17758	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1787c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x17f64	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x18040	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x18754	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x179e0	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x260a4	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x30430	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x3042c	0	NOTYPE	<unknown>	HIDDEN	10
__init_scan_cookie	.symtab	0x22e9c	108	FUNC	<unknown>	HIDDEN	2
__init_sched_fifo_prio	.symtab	0x16480	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x35734	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x260ac	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x1c094	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1f570	100	FUNC	<unknown>	DEFAULT	2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 16:56:54.295125008 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 16:56:58.609658003 CET	37606	443	192.168.2.23	162.213.35.24
Dec 28, 2024 16:56:58.609751940 CET	443	37606	162.213.35.24	192.168.2.23
Dec 28, 2024 16:56:58.609824896 CET	37606	443	192.168.2.23	162.213.35.24
Dec 28, 2024 16:56:59.670342922 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 16:57:00.438219070 CET	42516	80	192.168.2.23	109.202.202.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 16:56:57.724103928 CET	58673	53	192.168.2.23	1.1.1.1
Dec 28, 2024 16:56:57.724173069 CET	36388	53	192.168.2.23	1.1.1.1
Dec 28, 2024 16:56:57.954246044 CET	53	36388	1.1.1.1	192.168.2.23
Dec 28, 2024 16:56:57.964739084 CET	53	58673	1.1.1.1	192.168.2.23
Dec 28, 2024 16:56:58.450654030 CET	55206	53	192.168.2.23	1.1.1.1
Dec 28, 2024 16:56:58.591962099 CET	53	55206	1.1.1.1	192.168.2.23
Dec 28, 2024 16:57:02.000082970 CET	37741	53	192.168.2.23	94.16.114.254
Dec 28, 2024 16:57:02.001240969 CET	37741	53	192.168.2.23	94.16.114.254

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 16:56:57.724103928 CET	192.168.2.23	1.1.1.1	0x3099	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 16:56:57.724173069 CET	192.168.2.23	1.1.1.1	0xd031	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 16:56:58.450654030 CET	192.168.2.23	1.1.1.1	0x2cac	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 28, 2024 16:57:02.001240969 CET	192.168.2.23	94.16.114.254	0xf237	Standard query (0)	secure-network-rebirthltd.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 16:56:57.964739084 CET	1.1.1.1	192.168.2.23	0x3099	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 16:56:57.964739084 CET	1.1.1.1	192.168.2.23	0x3099	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

daisy.ubuntu.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	37606	162.213.35.24	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 15:57:04 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 15:57:04 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 15:57:04 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 15:57:05 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 15:57:05 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

System Behavior

Analysis Process: arm7.elf PID: 6240, Parent PID: 6167

General

Start time (UTC):	15:56:53
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	/tmp/arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:56:53
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/usr/sbin/iptables
Arguments:	iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
File size:	99296 bytes
MD5 hash:	1ab05fef765b6342cdfadaa5275b33af

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/busybox
Arguments:	/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Start time (UTC):	15:56:54
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	15:56:54
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Start time (UTC):	15:56:55
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:55
Start date (UTC):	28/12/2024
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Start time (UTC):	15:56:55
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:55
Start date (UTC):	28/12/2024
Path:	/usr/libexec/rtkit-daemon
Arguments:	/usr/libexec/rtkit-daemon
File size:	68096 bytes
MD5 hash:	df0cacf1db4ec95ac70f5b6e06b8ffd7

Start time (UTC):	15:56:56
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:56
Start date (UTC):	28/12/2024
Path:	/usr/lib/policykit-1/polkitd
Arguments:	/usr/lib/policykit-1/polkitd --no-debug
File size:	121504 bytes
MD5 hash:	8efc9b4b5b524210ad2ea1954a9d0e69

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/sbin/agetty
Arguments:	/sbin/agetty -o "-p -- \\u" --noclear tty2 linux
File size:	69000 bytes
MD5 hash:	3a374724ba7e863768139bdd60ca36f7

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:56:57
Start date (UTC):	28/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Start time (UTC):	15:57:03
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:57:03
Start date (UTC):	28/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:03
Start date (UTC):	28/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Start time (UTC):	15:57:04
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:57:04
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-wait-for-drm
Arguments:	/usr/lib/gdm3/gdm-wait-for-drm
File size:	14640 bytes
MD5 hash:	82043ba752c6930b4e6aaea2f7747545

Start time (UTC):	15:57:14
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:57:14
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	/usr/sbin/gdm3
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/plymouth
Arguments:	plymouth --ping
File size:	51352 bytes
MD5 hash:	87003efd8dad470042f5e75360a8f49f

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	"gdm-session-worker [pam/gdm-launch-environment]"
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	/usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --print-address 3 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	15:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --nofork --print-address 4 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	15:57:18
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:57:18
Start date (UTC):	28/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:18
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	15:57:18
Start date (UTC):	28/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	/usr/lib/accountsservice/accounts-daemon
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/share/language-tools/language-validate
Arguments:	/usr/share/language-tools/language-validate en_US.UTF-8
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/share/language-tools/language-validate
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/share/language-tools/language-options
Arguments:	/usr/share/language-tools/language-options
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/share/language-tools/language-options
Arguments:	-
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "locale -a \| grep -F .utf8 "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/locale
Arguments:	locale -a
File size:	58944 bytes
MD5 hash:	c72a78792469db86d91369c9057f20d2

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:57:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/grep
Arguments:	grep -F .utf8
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6449/oom_score_adj

/run/gdm3.pid

/run/systemd/seats/.#seat0SReakC

/run/systemd/seats/.#seat0xa0FxB

/run/systemd/users/.#1270HaBNy

/run/systemd/users/.#1276mnOJC

/run/systemd/users/.#127M8t7bA

/run/systemd/users/.#127UMzc8z

/run/systemd/users/.#127VdVUuB

/run/user/1000/pulse/pid

/run/utmp

/var/lib/AccountsService/users/gdm.YIHVZ2

/var/lib/ubuntu-drivers-common/last_gfx_boot

/var/log/gpu-manager.log

/var/log/wtmp

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

System Behavior

Linux Analysis Report
arm7.elf