Play interactive tour

Edit tour

Linux Analysis Report QWg2NTuodY

Overview

General Information

Sample Name:	QWg2NTuodY
Analysis ID:	511550
MD5:	8ccfc3df4a2b63c7944837c0e3e6bb6a
SHA1:	646f16d2fb1b0a5867b69bc1dc2b369275c244b3
SHA256:	fb117b5b9ba03f145f4342b65b6268b4378660bfdc9b38a00668a2d0fcacdf2c
Tags:	32armelfmirai
Infos:
Most interesting Screenshot:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Sample contains symbols with suspicious names

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511550
Start date:	29.10.2021
Start time:	09:36:20
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	QWg2NTuodY
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal52.lin@0/4@0/0

Process Tree

system is lnxubuntu20

QWg2NTuodY (PID: 5244, Parent: 5116, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/QWg2NTuodY

QWg2NTuodY New Fork (PID: 5246, Parent: 5244)

QWg2NTuodY New Fork (PID: 5248, Parent: 5246)

cleanup

Yara Overview

No yara matches

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: QWg2NTuodY	Virustotal: Detection: 24%			Perma Link
Source: QWg2NTuodY	ReversingLabs: Detection: 27%

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:56596 -> 45.95.169.120:455

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.169.120
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

System Summary:

Contains symbols with names commonly found in malware

Show sources

Source: ELF static info symbol of initial sample	Name: ackattack
Source: ELF static info symbol of initial sample	Name: attack_methods.c
Source: ELF static info symbol of initial sample	Name: httpgetattack
Source: ELF static info symbol of initial sample	Name: httpnullattack
Source: ELF static info symbol of initial sample	Name: httppatchattack
Source: ELF static info symbol of initial sample	Name: httppostattack
Source: ELF static info symbol of initial sample	Name: httpputattack
Source: ELF static info symbol of initial sample	Name: icmpechoattack
Source: ELF static info symbol of initial sample	Name: minecraftattack
Source: ELF static info symbol of initial sample	Name: pshattack

Source: ELF static info symbol of initial sample	Name: hexPayload
Source: ELF static info symbol of initial sample	Name: payload

Source: /tmp/QWg2NTuodY (PID: 5248)	SIGKILL sent: pid: 2256, result: successful
Source: /tmp/QWg2NTuodY (PID: 5248)	SIGKILL sent: pid: 2258, result: no such process
Source: /tmp/QWg2NTuodY (PID: 5248)	SIGKILL sent: pid: 5201, result: successful
Source: /tmp/QWg2NTuodY (PID: 5248)	SIGKILL sent: pid: 5202, result: successful
Source: /tmp/QWg2NTuodY (PID: 5248)	SIGKILL sent: pid: 5319, result: successful
Source: /tmp/QWg2NTuodY (PID: 5248)	SIGKILL sent: pid: 5324, result: successful

Source: classification engine

Classification label: mal52.lin@0/4@0/0

Source: QWg2NTuodY

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/5143/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/5143/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/5143/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/5143/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1582/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1582/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1582/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1582/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/3088/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/3088/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/3088/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/3088/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/230/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/230/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/230/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/230/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/110/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/110/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/110/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/110/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/231/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/231/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/231/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/231/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/111/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/111/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/111/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/111/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/232/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/232/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/232/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/232/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1579/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1579/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1579/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1579/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/112/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/112/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/112/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/112/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/233/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/233/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/233/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/233/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1699/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1699/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1699/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1699/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/113/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/113/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/113/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/113/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/234/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/234/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/234/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/234/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1335/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1335/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1335/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1335/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1698/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1698/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1698/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1698/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/114/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/114/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/114/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/114/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/235/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/235/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/235/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/235/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1334/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1334/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1334/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1334/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1576/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1576/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1576/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/1576/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/2302/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/2302/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/2302/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/2302/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/115/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/115/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/115/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/115/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/236/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/236/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/236/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/236/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/116/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/116/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/116/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/116/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/237/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/237/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/237/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/237/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/117/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/117/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/117/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/117/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/118/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/118/cmdline
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/118/status
Source: /tmp/QWg2NTuodY (PID: 5248)	File opened: /proc/118/status

Source: /tmp/QWg2NTuodY (PID: 5244)

Queries kernel information via 'uname':

Source: QWg2NTuodY, 5244.1.000000000c90265a.00000000cf845d69.rw-.sdmp	Binary or memory string: (cx86_64/usr/bin/qemu-arm/tmp/QWg2NTuodYSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/QWg2NTuodY
Source: QWg2NTuodY, 5244.1.00000000426ff3ca.00000000fedb44ba.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: QWg2NTuodY, 5244.1.000000000c90265a.00000000cf845d69.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: QWg2NTuodY, 5244.1.00000000426ff3ca.00000000fedb44ba.rw-.sdmp	Binary or memory string: qLV!/etc/qemu-binfmt/arm

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping1	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QWg2NTuodY	25%	Virustotal		Browse
QWg2NTuodY	27%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.95.169.120	unknown	Croatia (LOCAL Name: Hrvatska)	42864	GIGANET-HUGigaNetInternetServiceProviderCoHU	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/QWg2NTuodY
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.95.169.120	SL92Sz9pl2	Get hash	malicious	Browse
	YpKL484IG5	Get hash	malicious	Browse
	Y4W4j5QIqD	Get hash	malicious	Browse
	1TnmkstVG8	Get hash	malicious	Browse
	iksM5QEg2j	Get hash	malicious	Browse
109.202.202.202	6VLeGqFkPS	Get hash	malicious	Browse
	DL5blLw1ly	Get hash	malicious	Browse
	SL92Sz9pl2	Get hash	malicious	Browse
	YpKL484IG5	Get hash	malicious	Browse
	Y4W4j5QIqD	Get hash	malicious	Browse
	1TnmkstVG8	Get hash	malicious	Browse
	iksM5QEg2j	Get hash	malicious	Browse
	lGJEkz80oe	Get hash	malicious	Browse
	roV7kGaVr1	Get hash	malicious	Browse
	SecuriteInfo.com.Linux.Siggen.4218.298.3210	Get hash	malicious	Browse
	uPOWBxniTA	Get hash	malicious	Browse
	qy5unieRgR	Get hash	malicious	Browse
	sAzPpn6mKZ	Get hash	malicious	Browse
	AxadDC89j9	Get hash	malicious	Browse
	ZErnXU2XR1	Get hash	malicious	Browse
	sTHJvS5LPJ	Get hash	malicious	Browse
	THzHjYQ4z6	Get hash	malicious	Browse
	jC0B6sMh1d	Get hash	malicious	Browse
	JoLmvC65B7	Get hash	malicious	Browse
	AOaKSm1cij	Get hash	malicious	Browse
91.189.91.43	6VLeGqFkPS	Get hash	malicious	Browse
	DL5blLw1ly	Get hash	malicious	Browse
	SL92Sz9pl2	Get hash	malicious	Browse
	YpKL484IG5	Get hash	malicious	Browse
	Y4W4j5QIqD	Get hash	malicious	Browse
	1TnmkstVG8	Get hash	malicious	Browse
	iksM5QEg2j	Get hash	malicious	Browse
	lGJEkz80oe	Get hash	malicious	Browse
	roV7kGaVr1	Get hash	malicious	Browse
	SecuriteInfo.com.Linux.Siggen.4218.298.3210	Get hash	malicious	Browse
	uPOWBxniTA	Get hash	malicious	Browse
	qy5unieRgR	Get hash	malicious	Browse
	sAzPpn6mKZ	Get hash	malicious	Browse
	AxadDC89j9	Get hash	malicious	Browse
	ZErnXU2XR1	Get hash	malicious	Browse
	sTHJvS5LPJ	Get hash	malicious	Browse
	THzHjYQ4z6	Get hash	malicious	Browse
	jC0B6sMh1d	Get hash	malicious	Browse
	JoLmvC65B7	Get hash	malicious	Browse
	AOaKSm1cij	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CANONICAL-ASGB	6VLeGqFkPS	Get hash	malicious	Browse	91.189.91.42
	DL5blLw1ly	Get hash	malicious	Browse	91.189.91.42
	SL92Sz9pl2	Get hash	malicious	Browse	91.189.91.42
	YpKL484IG5	Get hash	malicious	Browse	91.189.91.42
	Y4W4j5QIqD	Get hash	malicious	Browse	91.189.91.42
	1TnmkstVG8	Get hash	malicious	Browse	91.189.91.42
	iksM5QEg2j	Get hash	malicious	Browse	91.189.91.42
	lGJEkz80oe	Get hash	malicious	Browse	91.189.91.42
	roV7kGaVr1	Get hash	malicious	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.4218.298.3210	Get hash	malicious	Browse	91.189.91.42
	uPOWBxniTA	Get hash	malicious	Browse	91.189.91.42
	qy5unieRgR	Get hash	malicious	Browse	91.189.91.42
	sAzPpn6mKZ	Get hash	malicious	Browse	91.189.91.42
	AxadDC89j9	Get hash	malicious	Browse	91.189.91.42
	ZErnXU2XR1	Get hash	malicious	Browse	91.189.91.42
	sTHJvS5LPJ	Get hash	malicious	Browse	91.189.91.42
	THzHjYQ4z6	Get hash	malicious	Browse	91.189.91.42
	jC0B6sMh1d	Get hash	malicious	Browse	91.189.91.42
	JoLmvC65B7	Get hash	malicious	Browse	91.189.91.42
	AOaKSm1cij	Get hash	malicious	Browse	91.189.91.42
GIGANET-HUGigaNetInternetServiceProviderCoHU	SL92Sz9pl2	Get hash	malicious	Browse	45.95.169.120
	YpKL484IG5	Get hash	malicious	Browse	45.95.169.120
	Y4W4j5QIqD	Get hash	malicious	Browse	45.95.169.120
	1TnmkstVG8	Get hash	malicious	Browse	45.95.169.120
	iksM5QEg2j	Get hash	malicious	Browse	45.95.169.120
	RicwIfIHLK	Get hash	malicious	Browse	45.95.169.115
	aIY7AxjUMc	Get hash	malicious	Browse	45.95.169.115
	DtJmFQxtNC	Get hash	malicious	Browse	45.95.169.115
	Wm4CzOCmNY	Get hash	malicious	Browse	45.95.169.115
	vunWUzXJvC	Get hash	malicious	Browse	45.95.169.115
	52xhBHy9Wz	Get hash	malicious	Browse	45.95.169.115
	YGvwG0iCDE	Get hash	malicious	Browse	45.95.169.115
	dbd5O0RUTq	Get hash	malicious	Browse	45.95.169.115
	fHVDVj0pzO	Get hash	malicious	Browse	45.95.169.115
	eZPk7Fg5w7	Get hash	malicious	Browse	45.95.169.115
	ph5PjoFBpj	Get hash	malicious	Browse	45.95.169.115
	xugAk5haat	Get hash	malicious	Browse	45.95.169.115
	0jEbWQtzs0	Get hash	malicious	Browse	45.95.169.115
	8g3tc5SWwB	Get hash	malicious	Browse	92.52.211.220
	7okgnZjK06	Get hash	malicious	Browse	45.95.169.115
INIT7CH	6VLeGqFkPS	Get hash	malicious	Browse	109.202.202.202
	DL5blLw1ly	Get hash	malicious	Browse	109.202.202.202
	SL92Sz9pl2	Get hash	malicious	Browse	109.202.202.202
	YpKL484IG5	Get hash	malicious	Browse	109.202.202.202
	Y4W4j5QIqD	Get hash	malicious	Browse	109.202.202.202
	1TnmkstVG8	Get hash	malicious	Browse	109.202.202.202
	iksM5QEg2j	Get hash	malicious	Browse	109.202.202.202
	lGJEkz80oe	Get hash	malicious	Browse	109.202.202.202
	roV7kGaVr1	Get hash	malicious	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.4218.298.3210	Get hash	malicious	Browse	109.202.202.202
	uPOWBxniTA	Get hash	malicious	Browse	109.202.202.202
	qy5unieRgR	Get hash	malicious	Browse	109.202.202.202
	sAzPpn6mKZ	Get hash	malicious	Browse	109.202.202.202
	AxadDC89j9	Get hash	malicious	Browse	109.202.202.202
	ZErnXU2XR1	Get hash	malicious	Browse	109.202.202.202
	sTHJvS5LPJ	Get hash	malicious	Browse	109.202.202.202
	THzHjYQ4z6	Get hash	malicious	Browse	109.202.202.202
	jC0B6sMh1d	Get hash	malicious	Browse	109.202.202.202
	JoLmvC65B7	Get hash	malicious	Browse	109.202.202.202
	AOaKSm1cij	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/tmp/qemu-open.4AsbT2 (deleted) Download File
Process:	/tmp/QWg2NTuodY
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:Tgwlp8l:Tgi0
MD5:	3137826A40C0086AEB81114DDE86EC0A
SHA1:	69A3BD3EAAD81D71569A9A69018F555FF4691F16
SHA-256:	DFAC4119D24C778493775F0EC16AB75B23D07E1540F42568DEEB16D3EE39291D
SHA-512:	8FF26184B8D77E357630EF6CCB145074849B4C8A7E3F0147C58930BC3A7DCF4BD5D18C5FFADB73B1C69B979159C4AFD344318EFB0CE6BE3F9DC16C66820D4693
Malicious:	false
Reputation:	low
Preview:	/tmp/QWg2NTuodY.

/tmp/qemu-open.BwtYb0 (deleted) Download File
Process:	/tmp/QWg2NTuodY
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:Tgwlp8l:Tgi0
MD5:	3137826A40C0086AEB81114DDE86EC0A
SHA1:	69A3BD3EAAD81D71569A9A69018F555FF4691F16
SHA-256:	DFAC4119D24C778493775F0EC16AB75B23D07E1540F42568DEEB16D3EE39291D
SHA-512:	8FF26184B8D77E357630EF6CCB145074849B4C8A7E3F0147C58930BC3A7DCF4BD5D18C5FFADB73B1C69B979159C4AFD344318EFB0CE6BE3F9DC16C66820D4693
Malicious:	false
Reputation:	low
Preview:	/tmp/QWg2NTuodY.

/tmp/qemu-open.DkXuq2 (deleted) Download File
Process:	/tmp/QWg2NTuodY
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:Tgwlp8l:Tgi0
MD5:	3137826A40C0086AEB81114DDE86EC0A
SHA1:	69A3BD3EAAD81D71569A9A69018F555FF4691F16
SHA-256:	DFAC4119D24C778493775F0EC16AB75B23D07E1540F42568DEEB16D3EE39291D
SHA-512:	8FF26184B8D77E357630EF6CCB145074849B4C8A7E3F0147C58930BC3A7DCF4BD5D18C5FFADB73B1C69B979159C4AFD344318EFB0CE6BE3F9DC16C66820D4693
Malicious:	false
Reputation:	low
Preview:	/tmp/QWg2NTuodY.

/tmp/qemu-open.zdnyA3 (deleted) Download File
Process:	/tmp/QWg2NTuodY
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:Tgwlp8l:Tgi0
MD5:	3137826A40C0086AEB81114DDE86EC0A
SHA1:	69A3BD3EAAD81D71569A9A69018F555FF4691F16
SHA-256:	DFAC4119D24C778493775F0EC16AB75B23D07E1540F42568DEEB16D3EE39291D
SHA-512:	8FF26184B8D77E357630EF6CCB145074849B4C8A7E3F0147C58930BC3A7DCF4BD5D18C5FFADB73B1C69B979159C4AFD344318EFB0CE6BE3F9DC16C66820D4693
Malicious:	false
Reputation:	low
Preview:	/tmp/QWg2NTuodY.

Static File Info

General
File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.929303283087755
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	QWg2NTuodY
File size:	110137
MD5:	8ccfc3df4a2b63c7944837c0e3e6bb6a
SHA1:	646f16d2fb1b0a5867b69bc1dc2b369275c244b3
SHA256:	fb117b5b9ba03f145f4342b65b6268b4378660bfdc9b38a00668a2d0fcacdf2c
SHA512:	538df89b9b3f8f3a10a3b4bb224ab381b2ecd5dc661cf67171cd8aa9f9a151193a676af62c49d0f7bc8c14892a7412f8db20c61d839235f8b1dd4af942ca8769
SSDEEP:	1536:VDncDo5kWexdJ8MsLYxvNloxil8dYJqmifFWkOzw/98LmlUHklc1o4:+mI/J8M2+8dsqmaFWtM/9EB/B
File Content Preview:	.ELF..............(.........4...8H......4. ...(........p8...8V..8V..................................P...P...............P...P...P...x...\|S..............T...T...T...................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	84024
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0xce0c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x14efc	0xcefc	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x14f0c	0xcf0c	0x714	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x15620	0xd620	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x15638	0xd638	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x1d750	0xd750	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x1d754	0xd754	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x1d754	0xd754	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x1d758	0xd758	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1d75c	0xd75c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x1d760	0xd760	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x1d808	0xd808	0x13c0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x1ebc8	0xebc8	0x3f04	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0xebc8	0x886	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0xf450	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0xf510	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0xf723	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x11446	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x11ad8	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x124a0	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x12758	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x13022	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x141b1	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x14709	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1471f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x14cc0	0x4120	0x10	0x0		28	580	4
.strtab	STRTAB	0x0	0x18de0	0x2059	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0xd638	0x15638	0x15638	0x118	0x118	1.5060	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0xd750	0xd750	3.1555	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0xd750	0x1d750	0x1d750	0x1478	0x537c	1.8678	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
TLS	0xd754	0x1d754	0x1d754	0x0	0x8	0.0000	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x14efc	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x14f0c	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x15620	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x15638	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x1d750	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1d754	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x1d754	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x1d758	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1d75c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1d760	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x1d808	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x1ebc8	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x14efc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x14f08	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x941c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x94dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x96a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa86c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbde8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbfa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc60c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc85c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc89c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xccb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdda8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf58c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf9e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1011c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1015c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1031c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1175c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11db8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1218c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1226c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1287c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1295c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1399c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1410c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1465c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1466c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1476c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d758	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d754	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x880c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x899c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x92a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x940c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x94d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x96a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa7e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb178	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb48c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb500	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xba24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbb40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbdd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1e9d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1e9d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xbe48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbedc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbfa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc154	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc2f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15248	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc79c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc7e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd63c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xd784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9f0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xde48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdfc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea08	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1eaa0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xe10c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15260	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe5d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe684	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eab4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xe7cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xede8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf3f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf8cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf9e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfde0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eacc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xfea0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1010c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1038c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eae4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1eae0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x119f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11da0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12184	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x123c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x124b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1285c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1294c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1304c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1368c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x13c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14644	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x1ead8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x152ee	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x152cc	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x15248	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x152d8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x15614	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x155f0	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x15608	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x155fc	12	OBJECT	<unknown>	DEFAULT	4
CurrentArrayNumber	.symtab	0x216c0	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0xc588	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xc5a4	0	NOTYPE	<unknown>	DEFAULT	2
TotalKilled	.symtab	0x21e48	4	OBJECT	<unknown>	DEFAULT	14
TotalSaved	.symtab	0x22278	4	OBJECT	<unknown>	DEFAULT	14
_Exit	.symtab	0x1015c	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x1d760	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x13a50	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x13a54	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x14704	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x13a48	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x13a8c	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x14728	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x14ec8	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x13a80	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x14698	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x146bc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x146e0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x139b0	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x13fc8	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x139fc	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x1ead8	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x152ee	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x1d750	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x1d750	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x1ead8	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0xf550	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0xf534	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x1eadc	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0xff90	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x11db8	300	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0xf550	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x10028	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0xf5e0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0xf700	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0xf670	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0xf5e0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0xf5c4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0xf700	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0xf6e4	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0xcc68	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0xcc8c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0xcc44	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0xf918	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0xf9e8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0xf670	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0xf654	24	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1015c	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0xdc80	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0xe3cc	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0xc760	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x12c4c	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xf550	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xc060	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x10abc	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x10af0	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x10794	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xc7e8	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0xe5e0	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x10b38	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x10028	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x11a0c	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x114fc	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x11db8	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x11640	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x11ee4	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x10e68	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xee64	972	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x101c4	100	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x11db8	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x102c8	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x102f4	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x10308	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1031c	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x10330	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xf2c8	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x10358	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x10390	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x103d0	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0xc738	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x123c4	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0xe1e8	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x12cb0	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x12324	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xbea8	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0xc85c	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x136d4	112	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x11f90	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x11fa0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x135c0	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xc4a0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0xfe2c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x12d90	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x103e4	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x10464	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xf5e0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xc240	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0xf310	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0xddc0	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0xe080	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x135e4	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xf700	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0xc3b4	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x106a8	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0xbf24	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xc8e0	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x104c4	108	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xc994	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0xca50	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xbf64	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0xe2e0	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0xfed4	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0xcb1c	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0xcb6c	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xcb80	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0xbfa4	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0xf400	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xcad8	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0xe110	216	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0xc5c0	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x11fb0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x120a0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xc540	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xc540	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xc5e8	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1218c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xc560	96	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x122e4	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x121d0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x12220	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xc60c	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xc708	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1226c	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0xe3ec	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0xe7f0	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x12348	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xc030	48	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xf670	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x1d75c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x1d75c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x14704	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x14698	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x146bc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x146e0	36	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x13858	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x13984	24	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0xff80	8	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x13744	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x13840	24	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x14664	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1465c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x14654	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x1f150	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x1eab4	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x22acc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x1ebc8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x1ebc8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0xf994	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0xf550	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0xf534	24	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1eadc	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x216b4	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x1d808	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0xff74	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0xff68	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x1399c	20	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x13858	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x1d758	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x22acc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x1f148	4	OBJECT	<unknown>	DEFAULT	14
__exidx_end	.symtab	0x15750	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x15638	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x1ebf8	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0xff90	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x11db8	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x1d75c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x1d758	0	NOTYPE	<unknown>	HIDDEN	10
__fork	.symtab	0xee64	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x22a98	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x22a9c	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x1ebfc	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x1d754	0	OBJECT	<unknown>	DEFAULT	9
__getdents	.symtab	0x10228	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x12dd4	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x10330	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0xf2c8	72	FUNC	<unknown>	DEFAULT	2
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x13e08	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x13ef0	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x14688	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x13e84	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x13fa8	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x14690	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1476c	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x14e80	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1410c	1352	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x1d758	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x1d754	0	NOTYPE	<unknown>	HIDDEN	9
__libc_close	.symtab	0xf550	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xc7e8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0xf770	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0xf7f8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x10028	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xee64	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x22aa0	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x10464	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xf5e0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xf700	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xc8e0	112	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xc994	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0xca50	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x12980	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0xfed4	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x1f144	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0xf670	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0xf230	152	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0xd850	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0xccb0	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x1e9d8	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x22720	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0xd7a0	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0xf5e0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0xf5c4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x1f14c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x1d754	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x1d754	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x1ead0	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x1ead4	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x12bb0	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0xf8dc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0xf8d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0xf8d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0xf8d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0xf8d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0xf700	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0xf6e4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1466c	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x1f154	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0xcc68	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xcc8c	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xcc44	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x13694	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x12ca4	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x1eaf0	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x12f1c	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x12f74	220	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x13050	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x13080	164	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x114cc	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x1eaf4	4	OBJECT	<unknown>	DEFAULT	13
__sys_connect	.symtab	0xc7a4	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0xc89c	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0xc950	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0xca04	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0xfea8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x10424	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1011c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__tls_get_addr	.symtab	0x1295c	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0xf918	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0xf9e8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0xfa40	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1eacc	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x13744	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0xf670	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0xf654	24	FUNC	<unknown>	DEFAULT	2
__xstat32_conv	.symtab	0x105fc	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x10530	204	FUNC	<unknown>	HIDDEN	2
_bss_end__	.symtab	0x22acc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x12bbc	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x12bf4	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x22ac4	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x22ac8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x22ab8	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x22ab4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x22abc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x22aac	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x128f4	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x22aa8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x22ac0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x22ab0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x22aa4	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x1ebc8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x22acc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x1015c	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x14efc	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x1f178	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x13130	0	FUNC	<unknown>	HIDDEN	2
_pthread_cleanup_pop_restore	.symtab	0xf8ec	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0xf8e4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0xff5c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x22718	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x10e88	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x112e8	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x1eaf8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x1f158	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1175c	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x1f174	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x1f164	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x1f170	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x1eafc	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x11368	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x1eae0	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0xe408	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0xdc80	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ackattack	.symtab	0x8540	280	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0xe3cc	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0xe3cc	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_methods.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x1ebf4	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0xc760	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x12c4c	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xcb80	196	FUNC	<unknown>	DEFAULT	2
buf	.symtab	0x222b4	1024	OBJECT	<unknown>	DEFAULT	14
calloc	.symtab	0xd660	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xf550	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0xc060	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cmdparse	.symtab	0xb508	1384	FUNC	<unknown>	DEFAULT	2
commandparsing	.symtab	0xba70	212	FUNC	<unknown>	DEFAULT	2
completed.5105	.symtab	0x1ebc8	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0xc7e8	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTries	.symtab	0x1e9d4	4	OBJECT	<unknown>	DEFAULT	13
connecthosts	.symtab	0x1e9c8	8	OBJECT	<unknown>	DEFAULT	13
connecting	.symtab	0xbb44	352	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
current_protect_values	.symtab	0x22054	4	OBJECT	<unknown>	DEFAULT	14
dec_buf	.symtab	0x216e2	512	OBJECT	<unknown>	DEFAULT	14
decrypt_for_recv	.symtab	0x9788	96	FUNC	<unknown>	DEFAULT	2
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dstring	.symtab	0x218e2	30	OBJECT	<unknown>	DEFAULT	14
encrypt_array	.symtab	0x97e8	5760	FUNC	<unknown>	DEFAULT	2
encrypter	.symtab	0x21900	1352	OBJECT	<unknown>	DEFAULT	14
encryption.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x1f148	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estring	.symtab	0x216c4	30	OBJECT	<unknown>	DEFAULT	14
exit	.symtab	0xe5e0	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fclose	.symtab	0x10b38	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x10028	244	FUNC	<unknown>	DEFAULT	2
fd	.symtab	0x22050	4	OBJECT	<unknown>	DEFAULT	14
fd_to_DIR	.symtab	0xc170	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0xc304	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x11a0c	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x114fc	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x11db8	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x11640	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x11ee4	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x10e68	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0xee64	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x1ec00	1348	OBJECT	<unknown>	DEFAULT	14
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0xda04	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x101c4	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
g	.symtab	0x1ebe8	4	OBJECT	<unknown>	DEFAULT	14
get_eit_entry	.symtab	0x13a98	544	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x114fc	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x11db8	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x102c8	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x102f4	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x10308	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x1031c	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x10330	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xf2c8	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xbe94	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x10358	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x10390	64	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x103d0	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	8
hexPayload	.symtab	0x1d808	1021	OBJECT	<unknown>	DEFAULT	13
httpgetattack	.symtab	0x9150	356	FUNC	<unknown>	DEFAULT	2
httpnullattack	.symtab	0x8cd4	396	FUNC	<unknown>	DEFAULT	2
httppatchattack	.symtab	0x8fec	356	FUNC	<unknown>	DEFAULT	2
httppostattack	.symtab	0x92b4	360	FUNC	<unknown>	DEFAULT	2
httpputattack	.symtab	0x8e60	396	FUNC	<unknown>	DEFAULT	2
icmpechoattack	.symtab	0x8a78	368	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x11fb0	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0xc738	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x123c4	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x1287c	120	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0xdf1c	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0xe1e8	248	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x12cb0	224	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x12324	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xbea8	56	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killedName	.symtab	0x22071	512	OBJECT	<unknown>	DEFAULT	14
killer	.symtab	0xb4b4	84	FUNC	<unknown>	DEFAULT	2
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_kill_by_deleted	.symtab	0xae68	356	FUNC	<unknown>	DEFAULT	2
killer_kill_by_group	.symtab	0xb18c	432	FUNC	<unknown>	DEFAULT	2
killer_kill_by_service	.symtab	0xafcc	448	FUNC	<unknown>	DEFAULT	2
killer_pid	.symtab	0x22274	4	OBJECT	<unknown>	DEFAULT	14
killer_realpath	.symtab	0x22058	25	OBJECT	<unknown>	DEFAULT	14
killer_save_by_sysproc	.symtab	0xb33c	376	FUNC	<unknown>	DEFAULT	2
l	.symtab	0x1ebe4	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_multiple_threads.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0xc85c	64	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x136d4	112	FUNC	<unknown>	DEFAULT	2
main	.symtab	0xbca4	324	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0xcd28	2360	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0xdc40	64	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x11f90	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x11fa0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x135c0	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0xc4a0	156	FUNC	<unknown>	DEFAULT	2
minecraftattack	.symtab	0x8734	220	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0xfe2c	124	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x12d90	68	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x103e4	64	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x1e9f0	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x1ea08	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x10464	96	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1358	.symtab	0x1ebf0	4	OBJECT	<unknown>	DEFAULT	14
nextip	.symtab	0x1ebec	4	OBJECT	<unknown>	DEFAULT	14
nprocessors_onln	.symtab	0xe6a4	332	FUNC	<unknown>	DEFAULT	2
object.5113	.symtab	0x1ebcc	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0xf5e0	100	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0xc240	196	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourPid	.symtab	0x222b0	4	OBJECT	<unknown>	DEFAULT	14
ourPidLen	.symtab	0x222a4	10	OBJECT	<unknown>	DEFAULT	14
packet	.symtab	0x216b8	4	OBJECT	<unknown>	DEFAULT	14
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
payload	.symtab	0x1dc08	3512	OBJECT	<unknown>	DEFAULT	13
pidPath	.symtab	0x21e4c	512	OBJECT	<unknown>	DEFAULT	14
portValue	.symtab	0x1e9c0	8	OBJECT	<unknown>	DEFAULT	13
pr-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0xbee0	68	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
program_invocation_name	.symtab	0x1ead4	4	OBJECT	<unknown>	DEFAULT	13
program_invocation_short_name	.symtab	0x1ead0	4	OBJECT	<unknown>	DEFAULT	13
pshattack	.symtab	0x8428	280	FUNC	<unknown>	DEFAULT	2
raise	.symtab	0xf310	240	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0xdda8	24	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_str	.symtab	0x216bc	4	OBJECT	<unknown>	DEFAULT	14
rand_string	.symtab	0x941c	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0xddc0	164	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x15260	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0xe080	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x1ea20	128	OBJECT	<unknown>	DEFAULT	13
rawmemchr	.symtab	0x135e4	176	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0xf700	100	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0xc3b4	232	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x106a8	236	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0xbf24	64	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x124bc	960	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0xc8e0	112	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
restore_core_regs	.symtab	0x1466c	28	FUNC	<unknown>	HIDDEN	2
rindex	.symtab	0x121d0	80	FUNC	<unknown>	DEFAULT	2
rp_len	.symtab	0x2204c	4	OBJECT	<unknown>	DEFAULT	14
savesysproc	.symtab	0x2227c	40	OBJECT	<unknown>	DEFAULT	14
sbrk	.symtab	0x104c4	108	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0xc994	112	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0xca50	136	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0xbf64	64	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0xde64	184	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0xe2e0	236	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0xfed4	136	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0xcb1c	80	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0xcb6c	20	FUNC	<unknown>	DEFAULT	2
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0xcb80	196	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0xbfa4	140	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0xf400	300	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sockFD	.symtab	0x1e9d0	4	OBJECT	<unknown>	DEFAULT	13
socket	.symtab	0xcad8	68	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0xdfdc	164	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0xdfdc	164	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0xe110	216	FUNC	<unknown>	DEFAULT	2
static_dtv	.symtab	0x21178	512	OBJECT	<unknown>	DEFAULT	14
static_map	.symtab	0x21680	52	OBJECT	<unknown>	DEFAULT	14
static_slotinfo	.symtab	0x21378	776	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x1eaec	4	OBJECT	<unknown>	DEFAULT	13
stdin	.symtab	0x1eae4	4	OBJECT	<unknown>	DEFAULT	13
stdout	.symtab	0x1eae8	4	OBJECT	<unknown>	DEFAULT	13
strcat	.symtab	0xc5c0	40	FUNC	<unknown>	DEFAULT	2
strcat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x11fb0	240	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x120a0	236	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0xc540	28	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0xc540	28	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0xc5e8	36	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcspn	.symtab	0x1218c	68	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
stringEnd	.symtab	0x226b4	100	OBJECT	<unknown>	DEFAULT	14
strlen	.symtab	0xc560	96	FUNC	<unknown>	DEFAULT	2
strpbrk	.symtab	0x122e4	64	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x121d0	80	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x12220	76	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0xc60c	252	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0xc708	48	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x1226c	120	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0xe3ec	28	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
synattack	.symtab	0x81d0	280	FUNC	<unknown>	DEFAULT	2
sysconf	.symtab	0xe7f0	1572	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x12348	124	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpattack	.symtab	0x8658	220	FUNC	<unknown>	DEFAULT	2
terrariaAttack	.symtab	0x8810	400	FUNC	<unknown>	DEFAULT	2
time	.symtab	0xc030	48	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 09:37:05.234884024 CEST	56596	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:05.287930012 CEST	455	56596	45.95.169.120	192.168.2.23
Oct 29, 2021 09:37:05.948533058 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 29, 2021 09:37:06.204663992 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 29, 2021 09:37:10.288929939 CEST	56598	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:10.341602087 CEST	455	56598	45.95.169.120	192.168.2.23
Oct 29, 2021 09:37:15.342643023 CEST	56600	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:15.386526108 CEST	455	56600	45.95.169.120	192.168.2.23
Oct 29, 2021 09:37:20.388345957 CEST	56602	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:20.433732033 CEST	455	56602	45.95.169.120	192.168.2.23
Oct 29, 2021 09:37:21.819647074 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 29, 2021 09:37:25.433851004 CEST	56604	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:25.482706070 CEST	455	56604	45.95.169.120	192.168.2.23
Oct 29, 2021 09:37:30.482923031 CEST	56606	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:31.483231068 CEST	56606	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:32.059185028 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 29, 2021 09:37:33.499087095 CEST	56606	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:36.154927969 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 29, 2021 09:37:37.690828085 CEST	56606	455	192.168.2.23	45.95.169.120
Oct 29, 2021 09:37:37.734814882 CEST	455	56606	45.95.169.120	192.168.2.23
Oct 29, 2021 09:38:02.777529955 CEST	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: QWg2NTuodY PID: 5244 Parent PID: 5116

General

Start time:	09:37:04
Start date:	29/10/2021
Path:	/tmp/QWg2NTuodY
Arguments:	/tmp/QWg2NTuodY
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: QWg2NTuodY PID: 5246 Parent PID: 5244

General

Start time:	09:37:04
Start date:	29/10/2021
Path:	/tmp/QWg2NTuodY
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: QWg2NTuodY PID: 5248 Parent PID: 5246

General

Start time:	09:37:04
Start date:	29/10/2021
Path:	/tmp/QWg2NTuodY
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report QWg2NTuodY

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Malware Analysis System Evasion:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: QWg2NTuodY PID: 5244 Parent PID: 5116

General

Analysis Process: QWg2NTuodY PID: 5246 Parent PID: 5244

General

Analysis Process: QWg2NTuodY PID: 5248 Parent PID: 5246

General