Edit tour

Linux Analysis Report
boatnet.arm6.elf

Overview

General Information

Sample name:	boatnet.arm6.elf
Analysis ID:	1636839
MD5:	9e80b39a4f5a7d7a2da84fc88516762a
SHA1:	288434eed84afa51219a5b5ab24ccb0f9e3ecf4d
SHA256:	fb32199bbd61069f25e7c6b6134305f99787755374163eedc6d95c1167cbad77
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636839
Start date and time:	2025-03-13 07:56:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	boatnet.arm6.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/boatnet.arm6.elf
PID:	6264
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

boatnet.arm6.elf (PID: 6264, Parent: 6188, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/boatnet.arm6.elf

boatnet.arm6.elf New Fork (PID: 6266, Parent: 6264)

boatnet.arm6.elf New Fork (PID: 6267, Parent: 6264)

boatnet.arm6.elf New Fork (PID: 6269, Parent: 6264)

xfce4-panel New Fork (PID: 6275, Parent: 2063)

wrapper-2.0 (PID: 6275, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6276, Parent: 2063)

wrapper-2.0 (PID: 6276, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6277, Parent: 2063)

wrapper-2.0 (PID: 6277, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6278, Parent: 2063)

wrapper-2.0 (PID: 6278, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6293, Parent: 6278)

xfpm-power-backlight-helper (PID: 6293, Parent: 6278, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6281, Parent: 2063)

wrapper-2.0 (PID: 6281, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6282, Parent: 2063)

wrapper-2.0 (PID: 6282, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6295, Parent: 6294)

xfconfd (PID: 6295, Parent: 6294, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6303, Parent: 1860)

xfce4-notifyd (PID: 6303, Parent: 1860, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

dash New Fork (PID: 6310, Parent: 4331)

rm (PID: 6310, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WgWRX0mPSu /tmp/tmp.gxqGrmrmJu /tmp/tmp.b9TnYv0RL3

dash New Fork (PID: 6311, Parent: 4331)

rm (PID: 6311, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WgWRX0mPSu /tmp/tmp.gxqGrmrmJu /tmp/tmp.b9TnYv0RL3

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
boatnet.arm6.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
boatnet.arm6.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
boatnet.arm6.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
boatnet.arm6.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x15328:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
boatnet.arm6.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x14d4c:$x1: POST /cdn-cgi/ 0x15b48:$s1: LCOGQGPTGP
boatnet.arm6.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x14d4c:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x15328:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x14d4c:$x1: POST /cdn-cgi/ 0x15b48:$s1: LCOGQGPTGP
6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x14d4c:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x15328:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x14d4c:$x1: POST /cdn-cgi/ 0x15b48:$s1: LCOGQGPTGP
6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x14d4c:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x15328:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x14d4c:$x1: POST /cdn-cgi/ 0x15b48:$s1: LCOGQGPTGP
6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x14d4c:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: boatnet.arm6.elf PID: 6264	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.arm6.elf PID: 6264	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.arm6.elf PID: 6264	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x33f7:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.arm6.elf PID: 6267	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.arm6.elf PID: 6267	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x233f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2353:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2367:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x237b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x238f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2407:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x242f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2443:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.arm6.elf PID: 6267	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2bae:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: boatnet.arm6.elf PID: 6269	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: boatnet.arm6.elf PID: 6269	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xab2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xada:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.arm6.elf PID: 6269	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1335:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 22 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: boatnet.arm6.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: boatnet.arm6.elf	Virustotal: Detection: 64%			Perma Link
Source: boatnet.arm6.elf	ReversingLabs: Detection: 73%

Source: global traffic

TCP traffic: 192.168.2.23:57780 -> 5.181.159.16:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.159.16
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.159.16
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.159.16
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.159.16
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.159.16
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 5.181.159.16
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39258
Source: unknown	Network traffic detected: HTTP traffic on port 39258 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: boatnet.arm6.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.arm6.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.arm6.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.arm6.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: boatnet.arm6.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.arm6.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_cfnull
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_dns
Source: ELF static info symbol of initial sample	Name: attack_method_greeth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6303, result: successful	Jump to behavior

Source: boatnet.arm6.elf	ELF static info symbol of initial sample: hexPayload
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: scanner.c
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: scanner_kill
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: scanner_pid

Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	SIGKILL sent: pid: 6303, result: successful	Jump to behavior

Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: boatnet.arm6.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: boatnet.arm6.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm6.elf PID: 6264, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm6.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm6.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm6.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm6.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.spre.troj.linELF@0/0@0/0

Source: boatnet.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: boatnet.arm6.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6295)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6295)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6295)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6295)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6303)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6303)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6303)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6303)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/4331/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/4444/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/4445/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/4446/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/4447/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6098/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6269/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6276/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6275/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/4530/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/6312/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /tmp/boatnet.arm6.elf (PID: 6266)	File opened: /proc/2074/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6310)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WgWRX0mPSu /tmp/tmp.gxqGrmrmJu /tmp/tmp.b9TnYv0RL3			Jump to behavior
Source: /usr/bin/dash (PID: 6311)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WgWRX0mPSu /tmp/tmp.gxqGrmrmJu /tmp/tmp.b9TnYv0RL3			Jump to behavior

Source: /tmp/boatnet.arm6.elf (PID: 6264)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 6303)	Queries kernel information via 'uname':	Jump to behavior

Source: boatnet.arm6.elf, 6264.1.000056436127c000.00005643613aa000.rw-.sdmp, boatnet.arm6.elf, 6267.1.000056436127c000.00005643613aa000.rw-.sdmp, boatnet.arm6.elf, 6269.1.000056436127c000.00005643613aa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: boatnet.arm6.elf, 6264.1.00007ffc80ece000.00007ffc80eef000.rw-.sdmp, boatnet.arm6.elf, 6267.1.00007ffc80ece000.00007ffc80eef000.rw-.sdmp, boatnet.arm6.elf, 6269.1.00007ffc80ece000.00007ffc80eef000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: boatnet.arm6.elf, 6264.1.000056436127c000.00005643613aa000.rw-.sdmp, boatnet.arm6.elf, 6267.1.000056436127c000.00005643613aa000.rw-.sdmp, boatnet.arm6.elf, 6269.1.000056436127c000.00005643613aa000.rw-.sdmp	Binary or memory string: 3)aCVP5)aCVP2)aCV!/etc/qemu-binfmt/arm
Source: boatnet.arm6.elf, 6264.1.00007ffc80ece000.00007ffc80eef000.rw-.sdmp, boatnet.arm6.elf, 6267.1.00007ffc80ece000.00007ffc80eef000.rw-.sdmp, boatnet.arm6.elf, 6269.1.00007ffc80ece000.00007ffc80eef000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/boatnet.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.arm6.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: boatnet.arm6.elf, type: SAMPLE
Source: Yara match	File source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.arm6.elf PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: boatnet.arm6.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: boatnet.arm6.elf PID: 6269, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: boatnet.arm6.elf, type: SAMPLE
Source: Yara match	File source: 6267.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6269.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6264.1.00007f2cb4017000.00007f2cb402e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: boatnet.arm6.elf PID: 6264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: boatnet.arm6.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: boatnet.arm6.elf PID: 6269, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
boatnet.arm6.elf	64%	Virustotal		Browse
boatnet.arm6.elf	74%	ReversingLabs	Linux.Backdoor.Mirai
boatnet.arm6.elf	100%	Avira	EXP/ELF.Gafgyt.Z.F

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
5.181.159.16	unknown	Moldova Republic of	39798	MIVOCLOUDMD	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	NewAge3ATOmpsl.elf	Get hash	malicious	Unknown	Browse
	NewAge3ATOx86.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	zerarm5.elf	Get hash	malicious	Unknown	Browse
	zerm68k.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
5.181.159.16	camp.x86_64.elf	Get hash	malicious	Mirai	Browse
	camp.arm7.elf	Get hash	malicious	Mirai	Browse
	camp.sh4.elf	Get hash	malicious	Mirai	Browse
	camp.i686.elf	Get hash	malicious	Mirai	Browse
	camp.m68k.elf	Get hash	malicious	Mirai	Browse
	camp.spc.elf	Get hash	malicious	Mirai	Browse
	camp.ppc.elf	Get hash	malicious	Mirai	Browse
	camp.mpsl.elf	Get hash	malicious	Mirai	Browse
	camp.arm.elf	Get hash	malicious	Mirai	Browse
	camp.mips.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	boatnet.arc.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	i.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
MIVOCLOUDMD	mips.elf	Get hash	malicious	Mirai	Browse	5.252.177.18
	U0443.pdf.js	Get hash	malicious	RMSRemoteAdmin	Browse	194.180.158.11
	43 15.pdf.js	Get hash	malicious	RMSRemoteAdmin	Browse	194.180.158.11
	https://040030025.blob.core.windows.net/factura/index.html	Get hash	malicious	Phisher	Browse	185.225.19.22
	scan_doc_000_132.js	Get hash	malicious	NetSupport RAT	Browse	5.181.159.212
	Update 5581.js	Get hash	malicious	NetSupport RAT	Browse	5.181.159.62
	Payment_358.js	Get hash	malicious	NetSupport RAT	Browse	5.181.158.24
	Payment_368.js	Get hash	malicious	NetSupport RAT	Browse	5.181.158.24
	x86.elf	Get hash	malicious	Unknown	Browse	94.158.245.27
	I586.elf	Get hash	malicious	Mirai	Browse	5.252.176.73
INIT7CH	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
AMAZON-02US	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	SecuriteInfo.com.Win32.DropperX-gen.28100.31863.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76
	http://dynamic-freesia-zv7h9k.mystrikingly.com/	Get hash	malicious	Unknown	Browse	52.84.150.39
	na.elf	Get hash	malicious	Prometei	Browse	54.255.164.76

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.0447343629186445
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	boatnet.arm6.elf
File size:	121'733 bytes
MD5:	9e80b39a4f5a7d7a2da84fc88516762a
SHA1:	288434eed84afa51219a5b5ab24ccb0f9e3ecf4d
SHA256:	fb32199bbd61069f25e7c6b6134305f99787755374163eedc6d95c1167cbad77
SHA512:	2558a61c110c8279228c799bf6d2c4ef23d6b2c685674ba04e04abc0c490c54c616f6ff6cba7d365d14527b25ba9b383a2c18cf90e455a7b698ca735bc840d2f
SSDEEP:	3072:U0AT/hiRlBFrZt3q59LuRYLdp9JtV0//Offs/45Aw6c2:U0A7hiRlBFrZt3q59aYLdpDtVGOffJ6B
TLSH:	B3C32942B8828923C4C6177AB66E418D3322B7A593CF7312DE106F743FC665F0E76A95
File Content Preview:	.ELF..............(.....T...4...........4. ...(.....................tg..tg...............p...p...p.......)..........Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../..r.......p....-.@0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8154
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	98700
Section Header Size:	40
Number of Section Headers:	22
Header String Table Index:	19

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x14c8c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1cd3c	0x14d3c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1cd4c	0x14d4c	0x1a28	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x27000	0x17000	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x27004	0x17004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x27008	0x17008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2700c	0x1700c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x27010	0x17010	0x74	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x27084	0x17084	0x258	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x272dc	0x172dc	0x2710	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x172dc	0x904	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x17be0	0x60	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x17c40	0x204	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17e44	0x3c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17e80	0x1da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1805c	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x180b4	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x180c4	0xc7	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x184fc	0x39e0	0x10	0x0		21	528	4
.strtab	STRTAB	0x0	0x1bedc	0x1ca9	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x16774	0x16774	6.1628	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x17000	0x27000	0x27000	0x2dc	0x29ec	3.6822	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1cd3c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1cd4c	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x27000	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x27004	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x27008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2700c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x27010	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x27084	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x272dc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1cd3c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1cd48	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xade0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe85c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf50c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfbb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14db4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1572c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1689c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1692c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1712c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1723c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1737c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1743c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1784c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1910c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1914c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1928c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1954c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1987c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1989c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a85c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1add8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b43c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c65c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c74c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c99c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x80e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x8140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27004	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x8184	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xba48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc26c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeeec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfbb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1074c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27084	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x14b0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14db0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27088	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x2708c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x27090	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x15564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x157f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1582c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x158ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1598c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27094	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x17520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3cc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1781c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1787c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27098	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x188a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x270b0	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x19314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1948c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x270c8	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x27160	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x19628	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1978c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3e4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19a70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27174	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x19bd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a3ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a40c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2718c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x1a838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a87c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aeb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x271d4	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x271a0	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x1e75c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b9ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c7e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27198	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x27334	0	NOTYPE	<unknown>	DEFAULT	11
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x1e3cc	24	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x29348	4	OBJECT	<unknown>	DEFAULT	11
Laligned	.symtab	0x17958	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x17974	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1adac	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x27010	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x27198	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1e45a	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x27000	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x27000	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x27198	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_b	.symtab	0x2719c	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x17830	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x172a8	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1be10	300	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1723c	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x17da4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x17dc8	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x17d80	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1a344	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1a414	108	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1adac	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1914c	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x179c8	56	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1987c	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17a00	56	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c91c	76	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x1a898	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x17408	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1743c	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1b1ec	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1b220	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1aec4	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x17a38	56	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x27334	4	OBJECT	<unknown>	HIDDEN	11
__GI_exit	.symtab	0x19a78	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1b268	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1723c	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1bc04	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1b8e4	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1be10	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1b9c0	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1bf3c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1b41c	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1712c	52	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1a988	88	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1be10	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1ac90	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1a8cc	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1a8e0	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1aa4c	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1a85c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x170e8	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1c968	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x17a70	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x17208	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1a884	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x27338	4	OBJECT	<unknown>	HIDDEN	11
__GI_inet_addr	.symtab	0x179a0	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1c7ec	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x19798	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1737c	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1c74c	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x171d4	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1ccd8	100	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x17990	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17920	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1ccb4	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x17880	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1a754	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1ad24	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1acbc	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1acf0	52	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x17088	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x17604	172	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x17c54	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1928c	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x19630	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x171a0	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x17748	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1add8	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17aec	56	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17b24	60	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1a9e0	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x17160	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17b60	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x17b98	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x17348	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17bd8	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1954c	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1a7bc	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x17c70	68	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x17cb4	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x17cc8	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x173d0	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x19b30	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x17c1c	56	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x196c0	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1c65c	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1c570	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1c470	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1c470	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1c490	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17930	96	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1c520	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1c4d4	76	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1989c	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x19d28	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1c770	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x170fc	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1ad64	20	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x17314	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2700c	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x2700c	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x16f1c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x17048	24	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x16e08	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x16f04	24	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2732c	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x27174	24	OBJECT	<unknown>	DEFAULT	10
__bss_end__	.symtab	0x299ec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x272dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x272dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1a3c0	84	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x2719c	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x29344	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x27084	0	NOTYPE	<unknown>	DEFAULT	10
__default_rt_sa_restorer	.symtab	0x1a854	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1a848	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x17060	20	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x16f1c	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x27008	0	OBJECT	<unknown>	DEFAULT	7
__end__	.symtab	0x299ec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x27324	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x17830	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1e774	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1e774	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2731c	4	OBJECT	<unknown>	HIDDEN	11
__fcntl_nocancel	.symtab	0x172a8	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1be10	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2700c	0	NOTYPE	<unknown>	HIDDEN	7
__fini_array_start	.symtab	0x27008	0	NOTYPE	<unknown>	HIDDEN	7
__frame_dummy_init_array_entry	.symtab	0x27004	0	OBJECT	<unknown>	DEFAULT	6
__getdents	.symtab	0x1a8f4	148	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c99c	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1a85c	40	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x27008	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x27004	0	NOTYPE	<unknown>	HIDDEN	6
__libc_accept	.symtab	0x179c8	56	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x17408	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x17a38	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1723c	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1712c	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1ccd8	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1acf0	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x17088	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x171a0	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17aec	56	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17b24	60	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x17160	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17b60	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x17b98	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1a7bc	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x27320	4	OBJECT	<unknown>	DEFAULT	11
__libc_write	.symtab	0x17314	52	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x18d1c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x17dec	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x27098	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x2966c	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x18c6c	176	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x27328	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x27004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x27004	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x27190	4	OBJECT	<unknown>	DEFAULT	10
__progname_full	.symtab	0x27194	4	OBJECT	<unknown>	DEFAULT	10
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x1a308	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1a300	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1a300	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1a300	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1a300	8	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__rtld_fini	.symtab	0x27330	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x17da4	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x17dc8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x17d80	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x271e0	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x1cae0	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1cb38	180	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1b7ac	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x1e75c	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x1cbec	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1cc1c	152	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1b8b4	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x271e4	4	OBJECT	<unknown>	DEFAULT	10
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1ad78	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x1a344	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1a414	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1a480	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2718c	4	OBJECT	<unknown>	HIDDEN	10
__udivsi3	.symtab	0x16e08	252	FUNC	<unknown>	HIDDEN	2
__xstat32_conv	.symtab	0x1ab2c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1aa60	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x1abd8	184	FUNC	<unknown>	HIDDEN	2
_bss_end__	.symtab	0x299ec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x1c8e4	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x299e4	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x299e8	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x272dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x299ec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x27334	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x1adac	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1cd3c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x27344	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x27338	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8094	0	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x1bfe0	0	FUNC	<unknown>	HIDDEN	2
_pthread_cleanup_pop_restore	.symtab	0x1a318	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1a310	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x29664	8	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8154	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1b43c	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1b744	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x271e8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x271a0	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x1ba7c	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x27340	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x271b8	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x2733c	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x271ec	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x1b7e0	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x271d0	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x198b8	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1914c	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x179c8	56	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0x14b14	24	FUNC	<unknown>	DEFAULT	2
antidebug.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x1987c	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1987c	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app_cfnull	.symtab	0x8190	3296	FUNC	<unknown>	DEFAULT	2
attack_app_http	.symtab	0x8e70	8048	FUNC	<unknown>	DEFAULT	2
attack_get_opt_int	.symtab	0xb1c0	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0xb154	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0xade0	92	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0xb230	2188	FUNC	<unknown>	DEFAULT	2
attack_method_dns	.symtab	0x130f8	1724	FUNC	<unknown>	DEFAULT	2
attack_method_greeth	.symtab	0x10750	1684	FUNC	<unknown>	DEFAULT	2
attack_method_greip	.symtab	0xeef0	1564	FUNC	<unknown>	DEFAULT	2
attack_method_hexflood	.symtab	0xc7b0	688	FUNC	<unknown>	DEFAULT	2
attack_method_nfo	.symtab	0x10de4	2192	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x137b4	1668	FUNC	<unknown>	DEFAULT	2
attack_method_ovh	.symtab	0xf50c	1708	FUNC	<unknown>	DEFAULT	2
attack_method_ovhdrop	.symtab	0x11b34	820	FUNC	<unknown>	DEFAULT	2
attack_method_raw	.symtab	0xe85c	1684	FUNC	<unknown>	DEFAULT	2
attack_method_std	.symtab	0xc510	672	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0x121c4	736	FUNC	<unknown>	DEFAULT	2
attack_method_stdplain	.symtab	0x118d8	604	FUNC	<unknown>	DEFAULT	2
attack_method_tcp	.symtab	0xcd14	1708	FUNC	<unknown>	DEFAULT	2
attack_method_tcpxmas	.symtab	0x124a4	1972	FUNC	<unknown>	DEFAULT	2
attack_method_udpbypass	.symtab	0x11674	612	FUNC	<unknown>	DEFAULT	2
attack_method_udphex	.symtab	0xca60	692	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0xaf38	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0xae3c	252	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0xd3c0	1784	FUNC	<unknown>	DEFAULT	2
attack_tcp_bypass	.symtab	0xe1b0	1708	FUNC	<unknown>	DEFAULT	2
attack_tcp_legit	.symtab	0xdab8	1784	FUNC	<unknown>	DEFAULT	2
attack_tcp_socket	.symtab	0x11e68	860	FUNC	<unknown>	DEFAULT	2
attack_tcp_stomp	.symtab	0xbabc	1972	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0xfbb8	1888	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_custom	.symtab	0x12c58	1184	FUNC	<unknown>	DEFAULT	2
attack_udp_plain	.symtab	0xc270	672	FUNC	<unknown>	DEFAULT	2
attack_udp_vse	.symtab	0x10318	1080	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x27318	4	OBJECT	<unknown>	DEFAULT	11
bind	.symtab	0x17a00	56	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1c91c	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x17cc8	184	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x18784	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x13e38	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x13e88	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x1784c	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x1a898	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x17408	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x1743c	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4959	.symtab	0x272dc	1	OBJECT	<unknown>	DEFAULT	11
conn_table	.symtab	0x29364	4	OBJECT	<unknown>	DEFAULT	11
connect	.symtab	0x17a38	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x27324	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x27334	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x19a78	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fclose	.symtab	0x1b268	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1723c	108	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x27088	4	OBJECT	<unknown>	DEFAULT	10
fd_serv	.symtab	0x2708c	4	OBJECT	<unknown>	DEFAULT	10
fd_to_DIR	.symtab	0x17534	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x176b0	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1bc04	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1b8e4	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1be10	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1b9c0	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1bf3c	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x1b41c	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1712c	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x80f4	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x18ed0	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1a988	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x1b8e4	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1be10	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1ac90	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x1a8cc	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1a8e0	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x1aa4c	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x1a85c	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x170e8	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x17074	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1c968	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x17a70	56	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x17aa8	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x17208	52	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1a884	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x27338	4	OBJECT	<unknown>	DEFAULT	11
hexPayload	.symtab	0x27084	4	OBJECT	<unknown>	DEFAULT	10
index	.symtab	0x1c65c	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x179a0	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x1c7ec	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x193e8	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x19798	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1737c	84	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1c74c	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x171d4	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_init	.symtab	0x13f2c	3048	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x29350	4	OBJECT	<unknown>	DEFAULT	11
killer_realpath	.symtab	0x2934c	4	OBJECT	<unknown>	DEFAULT	11
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x1ccd8	100	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x14db4	1892	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x17e64	2336	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x1910c	64	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x17990	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x17920	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x1ccb4	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x17880	156	FUNC	<unknown>	DEFAULT	2
methods	.symtab	0x272fc	4	OBJECT	<unknown>	DEFAULT	11
methods_len	.symtab	0x272f8	1	OBJECT	<unknown>	DEFAULT	11
mmap	.symtab	0x1a754	104	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x1ad24	64	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x1acbc	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x270b0	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x270c8	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x1acf0	52	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nprocessors_onln	.symtab	0x19bdc	332	FUNC	<unknown>	DEFAULT	2
object.4967	.symtab	0x272e0	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x17088	96	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x17604	172	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x27304	1	OBJECT	<unknown>	DEFAULT	11
program_invocation_name	.symtab	0x27194	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name	.symtab	0x27190	4	OBJECT	<unknown>	DEFAULT	10
ptrace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
raise	.symtab	0x17c54	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x19274	24	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alphastr	.symtab	0x155dc	336	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x15574	104	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x15518	92	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0x1572c	220	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1928c	164	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1e3e4	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x19630	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x270e0	128	OBJECT	<unknown>	DEFAULT	10
read	.symtab	0x171a0	52	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir	.symtab	0x17748	232	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x1add8	236	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x188b8	948	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x17aec	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x17b24	60	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolve_cnc_addr	.symtab	0x14b2c	72	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x27090	4	OBJECT	<unknown>	DEFAULT	10
rindex	.symtab	0x1c520	80	FUNC	<unknown>	DEFAULT	2
rsck	.symtab	0x29368	4	OBJECT	<unknown>	DEFAULT	11
rsck_out	.symtab	0x29370	4	OBJECT	<unknown>	DEFAULT	11
sbrk	.symtab	0x1a9e0	108	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanner_kill	.symtab	0x15808	40	FUNC	<unknown>	DEFAULT	2
scanner_pid	.symtab	0x2936c	4	OBJECT	<unknown>	DEFAULT	11
select	.symtab	0x17160	64	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x17b60	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x17b98	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x17348	52	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x17bd8	68	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x19330	184	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1954c	228	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x1a7bc	136	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x17c70	68	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x17cb4	20	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x17cc8	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x173d0	56	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x19b30	172	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x17c1c	56	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x194a8	164	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x194a8	164	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x196c0	216	FUNC	<unknown>	DEFAULT	2
srv_addr	.symtab	0x29354	16	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x271dc	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x271d4	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x271d8	4	OBJECT	<unknown>	DEFAULT	10
strchr	.symtab	0x1c65c	240	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x1c570	236	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1c470	28	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1c470	28	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x1c490	68	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strlen	.symtab	0x17930	96	FUNC	<unknown>	DEFAULT	2
strrchr	.symtab	0x1c520	80	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x1c4d4	76	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1989c	28	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x19d28	1496	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysv_signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table	.symtab	0x29374	752	OBJECT	<unknown>	DEFAULT	11
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x15994	3808	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x27094	4	OBJECT	<unknown>	DEFAULT	10
table_lock_val	.symtab	0x15854	160	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x15830	36	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x158f4	160	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1c770	124	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x170fc	48	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x1ad64	20	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x27160	20	OBJECT	<unknown>	DEFAULT	10
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x16998	316	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x16d0c	252	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x16ad4	148	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x168e4	36	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x1692c	108	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x16bf8	128	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x1689c	72	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x16b68	144	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x16874	40	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x16c78	148	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x16908	36	FUNC	<unknown>	DEFAULT	2
w	.symtab	0x27314	4	OBJECT	<unknown>	DEFAULT	11
watchdog_maintain	.symtab	0x14b74	576	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x27300	4	OBJECT	<unknown>	DEFAULT	11
write	.symtab	0x17314	52	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x27308	4	OBJECT	<unknown>	DEFAULT	11
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
y	.symtab	0x2730c	4	OBJECT	<unknown>	DEFAULT	11
z	.symtab	0x27310	4	OBJECT	<unknown>	DEFAULT	11

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 11
• 3778 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 07:57:19.875523090 CET	57780	3778	192.168.2.23	5.181.159.16
Mar 13, 2025 07:57:19.880366087 CET	3778	57780	5.181.159.16	192.168.2.23
Mar 13, 2025 07:57:19.880419970 CET	57780	3778	192.168.2.23	5.181.159.16
Mar 13, 2025 07:57:19.901736975 CET	57780	3778	192.168.2.23	5.181.159.16
Mar 13, 2025 07:57:19.907332897 CET	3778	57780	5.181.159.16	192.168.2.23
Mar 13, 2025 07:57:19.907366037 CET	57780	3778	192.168.2.23	5.181.159.16
Mar 13, 2025 07:57:19.912064075 CET	3778	57780	5.181.159.16	192.168.2.23
Mar 13, 2025 07:57:22.375587940 CET	43928	443	192.168.2.23	91.189.91.42
Mar 13, 2025 07:57:25.387286901 CET	57780	3778	192.168.2.23	5.181.159.16
Mar 13, 2025 07:57:25.436516047 CET	3778	57780	5.181.159.16	192.168.2.23
Mar 13, 2025 07:57:38.723381996 CET	443	39258	34.249.145.219	192.168.2.23
Mar 13, 2025 07:57:38.724334955 CET	39258	443	192.168.2.23	34.249.145.219
Mar 13, 2025 07:57:38.729105949 CET	443	39258	34.249.145.219	192.168.2.23
Mar 13, 2025 07:57:41.289567947 CET	3778	57780	5.181.159.16	192.168.2.23
Mar 13, 2025 07:57:41.289625883 CET	57780	3778	192.168.2.23	5.181.159.16
Mar 13, 2025 07:57:42.852824926 CET	43928	443	192.168.2.23	91.189.91.42
Mar 13, 2025 07:57:42.852826118 CET	42516	80	192.168.2.23	109.202.202.202
Mar 13, 2025 07:58:23.807224035 CET	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: boatnet.arm6.elf PID: 6264, Parent PID: 6188

General

Start time (UTC):	06:57:18
Start date (UTC):	13/03/2025
Path:	/tmp/boatnet.arm6.elf
Arguments:	/tmp/boatnet.arm6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: boatnet.arm6.elf PID: 6266, Parent PID: 6264

General

Start time (UTC):	06:57:18
Start date (UTC):	13/03/2025
Path:	/tmp/boatnet.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: boatnet.arm6.elf PID: 6267, Parent PID: 6264

General

Start time (UTC):	06:57:18
Start date (UTC):	13/03/2025
Path:	/tmp/boatnet.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: boatnet.arm6.elf PID: 6269, Parent PID: 6264

General

Start time (UTC):	06:57:18
Start date (UTC):	13/03/2025
Path:	/tmp/boatnet.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6275, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6275, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: xfce4-panel PID: 6276, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6276, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6277, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6277, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Truncated

File Read

Directory Enumerated

Directory Created

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6278, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6278, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6293, Parent PID: 6278

General

Start time (UTC):	06:57:28
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

Directory Enumerated

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfpm-power-backlight-helper PID: 6293, Parent PID: 6278

General

Start time (UTC):	06:57:28
Start date (UTC):	13/03/2025
Path:	/usr/sbin/xfpm-power-backlight-helper
Arguments:	/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
File size:	14656 bytes
MD5 hash:	3d221ad23f28ca3259f599b1664e2427

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: xfce4-panel PID: 6281, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6281, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Directory Created

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xfce4-panel PID: 6282, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: wrapper-2.0 PID: 6282, Parent PID: 2063

General

Start time (UTC):	06:57:24
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dbus-daemon PID: 6295, Parent PID: 6294

General

Start time (UTC):	06:57:28
Start date (UTC):	13/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfconfd PID: 6295, Parent PID: 6294

General

Start time (UTC):	06:57:28
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
File size:	112880 bytes
MD5 hash:	4c7a0d6d258bb970905b19b84abcd8e9

File Activities

File Opened

File Read

Directory Created

Process Activities

Prctl Requested

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: systemd PID: 6303, Parent PID: 1860

General

Start time (UTC):	06:57:31
Start date (UTC):	13/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: xfce4-notifyd PID: 6303, Parent PID: 1860

General

Start time (UTC):	06:57:31
Start date (UTC):	13/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
File size:	112872 bytes
MD5 hash:	eee956f1b227c1d5031f9c61223255d1

File Activities

File Opened

File Read

Directory Enumerated

Directory Created

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dash PID: 6310, Parent PID: 4331

General

Start time (UTC):	06:57:37
Start date (UTC):	13/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6310, Parent PID: 4331

General

Start time (UTC):	06:57:37
Start date (UTC):	13/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.WgWRX0mPSu /tmp/tmp.gxqGrmrmJu /tmp/tmp.b9TnYv0RL3
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6311, Parent PID: 4331

General

Start time (UTC):	06:57:37
Start date (UTC):	13/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6311, Parent PID: 4331

General

Start time (UTC):	06:57:37
Start date (UTC):	13/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.WgWRX0mPSu /tmp/tmp.gxqGrmrmJu /tmp/tmp.b9TnYv0RL3
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report boatnet.arm6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: boatnet.arm6.elf PID: 6264, Parent PID: 6188

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: boatnet.arm6.elf PID: 6266, Parent PID: 6264

General

File Activities

File Opened

File Read

Directory Enumerated

Linux Analysis Report
boatnet.arm6.elf