Play interactive tour

Edit tour

Linux Analysis Report KKveTTgaAAsecNNaaaa.arm7

Overview

General Information

Sample Name:	KKveTTgaAAsecNNaaaa.arm7
Analysis ID:	518888
MD5:	97b077cb62ee38b844602b48cfe02d73
SHA1:	a800c58b51de800550e7ca30a20fedb94115a76f
SHA256:	d6378301896dfeba58f24d5bd1b71fa00ab98b954ec74424a61f9b3f992aac34
Tags:	Mirai
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Yara signature match

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	518888
Start date:	10.11.2021
Start time:	03:57:43
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	KKveTTgaAAsecNNaaaa.arm7
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.troj.linARM7@0/4@0/0
Warnings:	Show All Report size exceeded maximum capacity and may have missing network information. TCP Packets have been reduced to 100

Process Tree

system is lnxubuntu20

KKveTTgaAAsecNNaaaa.arm7 (PID: 5224, Parent: 5116, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/KKveTTgaAAsecNNaaaa.arm7

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5245, Parent: 5224)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5246, Parent: 5224)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5249, Parent: 5246)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5252, Parent: 5246)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5256, Parent: 5246)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5258, Parent: 5246)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5260, Parent: 5246)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5265, Parent: 5260)

KKveTTgaAAsecNNaaaa.arm7 New Fork (PID: 5261, Parent: 5246)

systemd New Fork (PID: 5267, Parent: 1)

journalctl (PID: 5267, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5282, Parent: 1)

systemd-journald (PID: 5282, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

xfce4-session New Fork (PID: 5285, Parent: 1900)

xfsettingsd (PID: 5285, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5292, Parent: 5285)

xfce4-session New Fork (PID: 5293, Parent: 1900)

xfsettingsd (PID: 5293, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5296, Parent: 5293)

xfce4-session New Fork (PID: 5297, Parent: 1900)

xfsettingsd (PID: 5297, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5300, Parent: 5297)

xfce4-session New Fork (PID: 5301, Parent: 1900)

xfsettingsd (PID: 5301, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5306, Parent: 5301)

xfce4-session New Fork (PID: 5307, Parent: 1900)

xfsettingsd (PID: 5307, Parent: 1900, MD5: d7ae7090131cf73e021f6c89515f984b) Arguments: xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4

xfsettingsd New Fork (PID: 5310, Parent: 5307)

systemd New Fork (PID: 5315, Parent: 1)

journalctl (PID: 5315, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
KKveTTgaAAsecNNaaaa.arm7	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
KKveTTgaAAsecNNaaaa.arm7	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5258.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
5252.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5224.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5246.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
5245.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5258.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5252.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
5256.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5246.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5249.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
5249.1.000000002095a7a8.00000000414f653d.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x1c0fc:$xo1: Dfs`eeh&<'9 0x1c174:$xo1: Dfs`eeh&<'9 0x1c1e8:$xo1: Dfs`eeh&<'9 0x1c258:$xo1: Dfs`eeh&<'9 0x1c2a4:$xo1: Dfs`eeh&<'9
5256.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
5245.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
5224.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x3b90:$xo1: Dfs`eeh&<'9 0x3c10:$xo1: Dfs`eeh&<'9 0x3c88:$xo1: Dfs`eeh&<'9 0x3d00:$xo1: Dfs`eeh&<'9 0x3d50:$xo1: Dfs`eeh&<'9
Process Memory Space: KKveTTgaAAsecNNaaaa.arm7 PID: 5224	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x115a:$xo1: Dfs`eeh&<'9 0x11d0:$xo1: Dfs`eeh&<'9 0x1244:$xo1: Dfs`eeh&<'9 0x12b3:$xo1: Dfs`eeh&<'9 0x1320:$xo1: Dfs`eeh&<'9 0x1395:$xo1: Dfs`eeh&<'9 0x1408:$xo1: Dfs`eeh&<'9 0x1476:$xo1: Dfs`eeh&<'9 0x14c0:$xo1: Dfs`eeh&<'9 0x1568:$xo1: Dfs`eeh&<'9
Click to see the 10 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: KKveTTgaAAsecNNaaaa.arm7	Virustotal: Detection: 40%			Perma Link
Source: KKveTTgaAAsecNNaaaa.arm7	ReversingLabs: Detection: 51%

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.35.57.194:23 -> 192.168.2.23:34110
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.35.57.194:23 -> 192.168.2.23:34110
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:60806
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 153.92.122.185:23 -> 192.168.2.23:37038
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 153.92.122.185:23 -> 192.168.2.23:37038
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:60894
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 184.100.204.75:23 -> 192.168.2.23:57168
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 184.100.204.75:23 -> 192.168.2.23:57168
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:39292
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:52992
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:32834
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53038
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53062
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53080
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53100
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53118
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53140
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53162
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53184
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53198
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53218
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53236
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:33060
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:39590
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53246
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53260
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53274
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53278
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53286
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53292
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53294
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.104.255.62:23 -> 192.168.2.23:56344
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.104.255.62:23 -> 192.168.2.23:56344
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53296
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53298
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.35.57.194:23 -> 192.168.2.23:34676
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.35.57.194:23 -> 192.168.2.23:34676
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 189.164.242.209:23 -> 192.168.2.23:57306
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 189.164.242.209:23 -> 192.168.2.23:57306
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53302
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53306
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:33156
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53308
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53310
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53314
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52394
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53318
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53320
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53322
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52394
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53326
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53332
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53336
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:39698
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53338
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53344
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52418
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 153.92.122.185:23 -> 192.168.2.23:37650
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 153.92.122.185:23 -> 192.168.2.23:37650
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53348
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.104.255.62:23 -> 192.168.2.23:56402
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.104.255.62:23 -> 192.168.2.23:56402
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53354
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52418
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:37768
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53356
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53360
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53362
Source: Traffic	Snort IDS: 716 INFO TELNET access 91.122.214.192:23 -> 192.168.2.23:53366
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:37768
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 189.164.242.209:23 -> 192.168.2.23:57376
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 189.164.242.209:23 -> 192.168.2.23:57376
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52448
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:33216
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52448
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:39748
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:37840
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52600
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:37840
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52600
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.104.255.62:23 -> 192.168.2.23:56518
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.104.255.62:23 -> 192.168.2.23:56518
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 184.100.204.75:23 -> 192.168.2.23:57834
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 184.100.204.75:23 -> 192.168.2.23:57834
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:38000
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:33428
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52674
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52674
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:38000
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:40018
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 189.164.242.209:23 -> 192.168.2.23:57600
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 189.164.242.209:23 -> 192.168.2.23:57600
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52814
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:38176
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52814
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.104.255.62:23 -> 192.168.2.23:56788
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.104.255.62:23 -> 192.168.2.23:56788
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:38176
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:33684
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:52946
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:40220
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:52946
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:38322
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:38322
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:53024
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 189.164.242.209:23 -> 192.168.2.23:57930
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 189.164.242.209:23 -> 192.168.2.23:57930
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:53024
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.104.255.62:23 -> 192.168.2.23:57014
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.104.255.62:23 -> 192.168.2.23:57014
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:40368
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:38450
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:53146
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:33930
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:38450
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:53146
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 24.35.57.194:23 -> 192.168.2.23:35444
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 24.35.57.194:23 -> 192.168.2.23:35444
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 153.92.122.185:23 -> 192.168.2.23:38458
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 153.92.122.185:23 -> 192.168.2.23:38458
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:53280
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:38640
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.255.95.252:23 -> 192.168.2.23:40560
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.180.85.182:23 -> 192.168.2.23:34064
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:53280
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:38640
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 188.104.255.62:23 -> 192.168.2.23:57302
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 188.104.255.62:23 -> 192.168.2.23:57302
Source: Traffic	Snort IDS: 716 INFO TELNET access 175.207.83.195:23 -> 192.168.2.23:53438
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 189.164.242.209:23 -> 192.168.2.23:58272
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 189.164.242.209:23 -> 192.168.2.23:58272
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.58.106.231:23 -> 192.168.2.23:38824
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 175.207.83.195:23 -> 192.168.2.23:53438
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.58.106.231:23 -> 192.168.2.23:38824

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic	TCP traffic: 192.168.2.23:49932 -> 107.174.241.209:60420
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 211.165.123.94:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 164.53.222.48:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 193.61.246.86:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 73.248.193.68:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 78.84.158.160:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 9.84.194.6:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 9.226.22.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 79.86.110.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 208.252.145.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 150.92.20.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 142.35.231.140:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 95.176.231.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 32.175.85.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 174.129.142.177:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 101.173.20.36:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 189.55.244.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 163.210.124.94:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 69.227.227.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 170.248.134.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 18.195.163.49:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 218.5.73.107:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 69.135.128.71:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 164.188.126.47:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 170.112.22.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 202.105.22.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 211.124.189.144:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 176.169.16.168:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 39.197.80.65:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 145.32.250.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 105.156.129.211:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 200.136.225.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 61.161.50.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 90.213.64.130:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 191.188.181.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 71.105.168.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 164.122.2.17:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 13.92.146.170:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 126.37.180.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 159.204.192.142:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 180.114.13.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 189.242.186.65:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 157.71.103.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 67.82.33.130:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 190.216.176.34:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 19.130.209.70:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 125.190.141.59:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 78.74.252.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 185.213.239.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 91.102.99.119:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 60.169.204.176:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 42.1.169.108:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 96.229.50.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 142.170.234.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 221.15.182.45:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 193.227.249.88:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 133.80.82.217:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 54.133.1.74:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 103.186.177.3:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 107.207.52.223:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 67.236.132.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 119.103.204.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 149.247.126.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 122.220.49.48:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 41.32.112.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 156.255.229.189:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 58.189.70.5:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 125.219.173.9:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 92.5.60.9:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 197.187.212.205:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 106.166.68.177:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 75.132.140.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 162.80.242.125:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 209.213.187.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 125.192.124.60:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 42.189.191.181:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 158.136.5.82:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 2.69.252.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 115.197.163.150:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 59.122.48.106:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 85.15.76.115:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 141.219.232.251:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 171.195.10.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 169.143.161.154:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 113.153.129.0:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 191.248.70.231:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 147.189.5.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 155.255.159.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 24.208.210.148:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 190.254.179.51:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 41.236.75.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 119.154.83.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 36.242.252.124:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 111.57.93.125:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 159.185.16.38:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 198.200.76.222:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 111.142.98.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 144.65.32.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 135.241.8.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 121.113.210.36:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 147.45.165.210:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 195.115.55.238:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 84.138.4.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 116.0.179.12:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 101.205.167.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 90.235.124.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 120.134.204.60:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 144.60.231.26:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 212.209.170.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 179.247.65.193:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 35.22.237.209:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 217.2.136.111:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 218.231.143.16:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 110.20.66.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 38.14.24.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 168.125.194.45:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 62.160.241.108:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 44.34.202.106:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 210.187.152.186:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 130.250.24.86:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 107.230.6.227:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.107.52.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 23.214.16.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 36.176.185.146:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 223.245.54.20:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 173.119.111.54:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 82.51.143.50:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 100.142.231.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 69.102.20.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 85.205.112.223:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 204.36.237.175:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 165.4.76.117:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 186.204.149.198:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 130.214.149.91:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 158.192.40.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 152.189.70.32:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 185.141.182.186:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 120.180.60.250:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 221.60.131.211:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 9.45.219.224:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 217.75.35.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 80.92.37.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 42.197.70.195:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 41.72.120.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 212.82.232.203:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 85.164.170.161:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 180.188.227.172:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 117.110.82.132:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 125.247.189.6:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 124.109.181.85:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 211.241.91.11:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 58.8.111.176:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 38.16.137.20:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 139.154.8.37:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 76.209.146.152:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 2.41.195.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 62.55.141.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 180.232.26.189:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 213.144.10.139:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 39.123.89.177:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 83.108.27.13:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 187.160.67.0:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 157.61.77.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 184.255.221.175:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 164.156.56.12:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 195.231.40.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 74.130.108.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 45.16.21.149:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 148.222.26.160:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 63.40.222.42:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 153.2.59.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 153.239.104.191:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 118.196.160.132:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 154.177.83.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 47.53.28.61:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 84.109.157.215:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 221.254.152.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.77.130.94:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 115.125.103.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 40.127.180.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 167.131.63.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 83.233.184.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 160.33.142.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.115.152.210:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 182.239.227.140:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 136.161.151.88:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 124.151.130.184:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 91.30.50.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 170.81.162.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 165.125.236.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 146.226.106.55:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 78.36.55.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 203.105.101.55:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 209.83.204.246:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 198.172.85.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 188.217.79.248:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 41.23.197.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 81.194.221.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 171.246.130.192:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 4.226.2.147:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 188.170.119.60:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 154.232.153.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 109.212.187.254:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 121.201.22.18:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 24.193.190.172:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 219.212.246.192:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 190.0.243.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 54.9.61.233:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 100.184.16.91:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 103.84.42.18:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 31.201.125.195:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 164.157.223.212:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 126.217.21.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.105.156.182:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 171.213.92.106:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 91.116.55.24:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 189.15.32.84:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 188.193.21.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 77.136.216.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 66.53.254.18:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 115.131.226.178:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 209.127.120.148:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 212.104.27.6:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 114.124.20.3:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 99.214.110.236:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 111.76.191.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 70.118.6.96:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 115.186.68.196:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 81.16.152.232:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 221.107.32.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 153.175.180.253:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 109.159.123.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 93.22.253.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 112.183.176.84:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 194.207.167.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 109.24.130.222:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 142.161.157.9:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 119.233.184.93:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 98.146.7.205:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 110.143.41.65:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 194.41.188.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 174.140.21.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 222.160.83.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 146.238.67.93:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 180.192.120.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 216.106.22.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 76.169.65.127:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 141.120.166.73:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 116.170.106.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 164.211.18.31:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 171.121.179.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 196.118.234.125:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 177.119.148.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 77.190.253.156:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 141.38.81.24:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 183.94.169.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 173.243.187.64:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 201.184.246.146:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 223.4.184.131:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 187.41.238.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 120.156.99.147:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 219.123.23.171:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 180.84.84.164:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 88.71.82.182:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 44.113.188.63:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 171.184.39.55:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 210.241.217.112:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 200.75.14.185:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 168.144.236.191:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 167.211.148.44:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 103.43.196.29:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 54.59.22.80:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 12.220.168.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 186.9.95.50:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 43.243.196.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 38.25.171.199:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 40.51.237.214:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 175.10.156.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 47.49.65.7:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 213.40.230.142:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 182.76.125.27:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 144.45.195.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.177.133.217:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 115.229.87.201:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 147.57.120.142:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 14.132.113.239:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 193.255.128.145:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 77.89.48.224:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 208.125.177.59:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 8.66.204.210:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 164.198.245.189:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 91.128.58.85:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 151.15.17.140:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 212.131.142.47:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 41.223.33.155:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 220.73.8.167:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 66.33.190.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 126.134.198.210:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 23.21.222.76:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 96.80.216.130:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 161.14.60.158:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 87.16.49.46:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 148.122.12.109:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 85.152.189.125:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 87.79.132.233:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 63.154.168.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 153.96.54.64:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 112.89.160.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 164.42.21.161:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 20.172.168.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 190.138.219.96:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 150.47.18.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 126.115.27.34:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 222.187.47.136:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 154.206.213.209:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 45.6.138.93:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 217.198.71.200:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 69.238.106.33:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 146.1.169.136:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 89.36.241.250:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 216.247.246.33:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 91.56.90.111:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 88.55.130.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 154.77.85.166:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 118.17.181.129:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 27.201.214.195:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 156.117.131.150:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 211.245.53.125:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 36.13.60.66:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 20.255.19.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 152.167.218.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 58.27.150.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 201.155.48.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 205.195.148.131:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 124.26.39.70:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 204.207.179.150:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 212.254.95.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 218.244.169.88:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 194.93.163.244:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 31.163.76.248:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 27.40.125.251:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 53.123.70.174:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 176.30.35.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 222.42.74.50:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 152.220.58.161:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 183.181.190.145:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 83.42.205.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 67.227.228.116:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 180.158.199.1:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 206.223.69.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 183.178.26.68:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 181.59.216.26:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 219.170.129.4:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 199.109.73.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 90.142.48.123:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 32.93.68.9:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 159.105.249.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 63.129.196.251:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 17.65.58.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 200.166.229.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 165.121.239.33:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 14.132.146.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 80.31.3.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 110.151.100.251:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 218.50.60.70:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 83.112.27.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 119.21.14.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 20.96.145.36:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 57.221.226.46:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 35.32.11.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 138.213.14.190:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 153.132.155.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 63.151.238.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 90.49.170.105:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 160.95.102.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 116.119.115.177:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 102.187.90.132:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 198.215.227.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 139.202.200.39:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 190.237.4.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 103.223.247.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 89.85.228.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 87.177.42.32:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 97.6.38.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 93.209.42.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 93.233.63.84:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 135.144.206.243:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 101.113.7.67:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 141.79.162.35:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 154.113.1.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 47.121.2.33:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 66.252.5.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 103.199.221.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 36.6.221.79:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 174.148.182.132:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 77.92.167.68:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 207.115.125.68:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 57.79.65.127:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 167.138.141.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 120.215.174.178:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 117.105.15.18:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 105.202.233.160:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 174.208.206.230:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.189.168.76:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 182.16.65.78:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 160.30.59.98:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 42.235.220.138:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 100.134.93.103:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 145.182.237.57:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 171.79.195.113:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 118.54.183.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 92.251.15.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 177.186.202.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 2.39.208.79:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 106.28.226.26:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 206.135.63.170:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 201.54.224.56:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 191.65.18.62:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 138.237.221.222:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 124.152.215.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 19.75.210.119:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 181.2.51.240:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 153.5.127.173:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 113.228.150.84:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 60.153.145.195:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 180.169.184.52:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 121.160.19.181:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 121.160.173.141:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 171.213.62.203:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 99.43.48.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 203.97.16.127:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 80.206.75.241:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 43.119.195.25:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 146.72.245.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 95.110.132.120:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 148.150.193.63:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 99.2.186.9:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 37.63.143.251:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 110.194.212.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 91.225.156.224:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 126.246.38.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 48.108.222.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 146.19.255.218:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 188.138.124.163:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 88.109.191.242:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 126.217.153.236:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 85.208.245.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 41.182.205.159:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 94.109.44.134:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 173.40.100.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 152.146.160.82:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 146.47.204.14:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 188.167.76.23:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 37.73.79.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 126.120.160.180:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 110.99.102.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 60.38.203.197:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 117.149.142.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 146.134.221.122:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 179.188.95.41:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 169.90.151.123:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 177.124.128.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 179.108.221.118:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 147.140.54.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 184.120.56.152:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 57.213.27.229:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 48.194.195.63:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 220.52.17.201:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 188.106.68.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 5.87.183.35:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 86.163.19.115:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 164.105.253.64:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 157.61.223.13:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 20.5.151.225:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 202.242.158.68:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 169.223.138.227:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 74.178.200.77:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 189.64.83.163:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 168.28.57.93:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 150.61.82.1:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 126.222.104.135:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 108.13.93.69:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 158.79.210.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 154.191.119.160:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 82.142.101.192:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 60.233.50.25:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 42.31.125.49:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 24.142.138.136:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 48.48.52.64:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 41.6.92.158:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 111.12.1.126:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 123.107.251.237:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 114.59.104.58:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 153.89.9.92:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 187.216.255.101:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 126.12.70.165:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 100.196.75.145:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 220.101.20.61:2323
Source: global traffic	TCP traffic: 192.168.2.23:11459 -> 206.185.227.113:2323
Source: global traffic	TCP traffic: 192.168.2.23:49859 -> 65.123.13.71:2323

Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5224)	Socket: 127.0.0.1::63841
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5246)	Socket: 0.0.0.0::23
Source: /lib/systemd/systemd-journald (PID: 5282)	Socket: <unknown socket type>:unknown

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 107.174.241.209
Source: unknown	TCP traffic detected without corresponding DNS query: 211.165.123.94
Source: unknown	TCP traffic detected without corresponding DNS query: 180.172.125.184
Source: unknown	TCP traffic detected without corresponding DNS query: 44.58.64.94
Source: unknown	TCP traffic detected without corresponding DNS query: 155.163.92.99
Source: unknown	TCP traffic detected without corresponding DNS query: 13.178.198.83
Source: unknown	TCP traffic detected without corresponding DNS query: 71.211.165.33
Source: unknown	TCP traffic detected without corresponding DNS query: 172.227.82.18
Source: unknown	TCP traffic detected without corresponding DNS query: 57.5.199.240
Source: unknown	TCP traffic detected without corresponding DNS query: 222.255.140.194
Source: unknown	TCP traffic detected without corresponding DNS query: 200.216.220.32
Source: unknown	TCP traffic detected without corresponding DNS query: 34.185.131.185
Source: unknown	TCP traffic detected without corresponding DNS query: 164.53.222.48
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.160.97
Source: unknown	TCP traffic detected without corresponding DNS query: 98.123.186.103
Source: unknown	TCP traffic detected without corresponding DNS query: 170.53.235.53
Source: unknown	TCP traffic detected without corresponding DNS query: 92.78.184.92
Source: unknown	TCP traffic detected without corresponding DNS query: 216.165.79.125
Source: unknown	TCP traffic detected without corresponding DNS query: 155.68.70.75
Source: unknown	TCP traffic detected without corresponding DNS query: 162.216.143.43
Source: unknown	TCP traffic detected without corresponding DNS query: 9.97.7.25
Source: unknown	TCP traffic detected without corresponding DNS query: 47.33.91.66
Source: unknown	TCP traffic detected without corresponding DNS query: 147.48.136.98
Source: unknown	TCP traffic detected without corresponding DNS query: 138.219.90.123
Source: unknown	TCP traffic detected without corresponding DNS query: 83.124.91.226
Source: unknown	TCP traffic detected without corresponding DNS query: 151.224.97.191
Source: unknown	TCP traffic detected without corresponding DNS query: 193.61.246.86
Source: unknown	TCP traffic detected without corresponding DNS query: 108.159.246.251
Source: unknown	TCP traffic detected without corresponding DNS query: 19.84.38.235
Source: unknown	TCP traffic detected without corresponding DNS query: 74.195.102.207
Source: unknown	TCP traffic detected without corresponding DNS query: 73.248.193.68
Source: unknown	TCP traffic detected without corresponding DNS query: 4.52.134.41
Source: unknown	TCP traffic detected without corresponding DNS query: 218.198.18.29
Source: unknown	TCP traffic detected without corresponding DNS query: 198.42.34.169
Source: unknown	TCP traffic detected without corresponding DNS query: 79.217.136.219
Source: unknown	TCP traffic detected without corresponding DNS query: 148.41.186.135
Source: unknown	TCP traffic detected without corresponding DNS query: 78.84.158.160
Source: unknown	TCP traffic detected without corresponding DNS query: 205.157.44.142
Source: unknown	TCP traffic detected without corresponding DNS query: 168.130.194.11
Source: unknown	TCP traffic detected without corresponding DNS query: 154.199.76.99
Source: unknown	TCP traffic detected without corresponding DNS query: 157.194.38.222
Source: unknown	TCP traffic detected without corresponding DNS query: 192.216.37.75
Source: unknown	TCP traffic detected without corresponding DNS query: 100.251.22.28
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.56.147
Source: unknown	TCP traffic detected without corresponding DNS query: 99.169.75.137
Source: unknown	TCP traffic detected without corresponding DNS query: 123.218.53.72
Source: unknown	TCP traffic detected without corresponding DNS query: 27.192.206.170
Source: unknown	TCP traffic detected without corresponding DNS query: 9.84.194.6
Source: unknown	TCP traffic detected without corresponding DNS query: 212.156.171.237

System Summary:

Contains symbols with names commonly found in malware

Show sources

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_http
Source: ELF static info symbol of initial sample	Name: attack_method_ovh
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start

Source: KKveTTgaAAsecNNaaaa.arm7, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5258.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5252.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5224.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5246.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5245.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5258.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5252.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5256.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5246.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5249.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5249.1.000000002095a7a8.00000000414f653d.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5256.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5245.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5224.1.00000000592e3fc5.000000008cecedc1.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: Process Memory Space: KKveTTgaAAsecNNaaaa.arm7 PID: 5224, type: MEMORYSTR	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =

Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 491, result: successful
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 2062, result: successful
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 2637, result: successful
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 5246, result: successful
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 5252, result: successful
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 5256, result: successful
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	SIGKILL sent: pid: 5258, result: unknown

Source: classification engine

Classification label: mal76.troj.linARM7@0/4@0/0

Source: KKveTTgaAAsecNNaaaa.arm7

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: /lib/systemd/systemd-journald (PID: 5282)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2033/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2033/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1582/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1582/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2275/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2275/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1612/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1612/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1579/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1579/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1699/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1699/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1335/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1335/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1698/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1698/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2028/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2028/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1334/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1334/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1576/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1576/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2302/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2302/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/3236/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/3236/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2025/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2025/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2146/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2146/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/912/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/912/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/759/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/759/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2307/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2307/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/918/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/918/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/5037/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/5037/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1594/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1594/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2285/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2285/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2281/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2281/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1349/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1349/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1623/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1623/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/761/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/761/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1622/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1622/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/884/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/884/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1983/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1983/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2038/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2038/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1586/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1586/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1465/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1465/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1344/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1344/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1860/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1860/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1463/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1463/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2156/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2156/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/800/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/800/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/801/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/801/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1629/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1629/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1627/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1627/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1900/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1900/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/5200/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/5200/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/491/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/491/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2294/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2294/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2050/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/2050/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1877/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1877/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/772/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/772/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1633/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1633/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1599/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1599/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1632/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1632/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1477/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/1477/numa_maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/774/maps
Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5258)	File opened: /proc/774/numa_maps

Source: /tmp/KKveTTgaAAsecNNaaaa.arm7 (PID: 5224)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 5282)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5292)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5296)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5300)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5306)	Queries kernel information via 'uname':
Source: /usr/bin/xfsettingsd (PID: 5310)	Queries kernel information via 'uname':

Source: KKveTTgaAAsecNNaaaa.arm7, 5224.1.000000005a53c05a.00000000156a5ccd.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: KKveTTgaAAsecNNaaaa.arm7, 5224.1.00000000b7ca5487.0000000083ab4a13.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/KKveTTgaAAsecNNaaaa.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/KKveTTgaAAsecNNaaaa.arm7
Source: KKveTTgaAAsecNNaaaa.arm7, 5224.1.000000005a53c05a.00000000156a5ccd.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: KKveTTgaAAsecNNaaaa.arm7, 5224.1.00000000b7ca5487.0000000083ab4a13.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: KKveTTgaAAsecNNaaaa.arm7, type: SAMPLE

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: KKveTTgaAAsecNNaaaa.arm7, type: SAMPLE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping1	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	System Information Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
KKveTTgaAAsecNNaaaa.arm7	40%	Virustotal		Browse
KKveTTgaAAsecNNaaaa.arm7	51%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
32.130.138.188	unknown	United States	2686	ATGS-MMD-ASUS	false
74.64.178.97	unknown	United States	12271	TWC-12271-NYCUS	false
80.67.177.26	unknown	France	20766	GITOYEN-MAIN-ASThemainAutonomousSystemofGitoyenParis	false
94.8.118.238	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
174.192.30.205	unknown	United States	22394	CELLCOUS	false
206.11.222.194	unknown	United States	5006	VOYANTUS	false
187.73.108.52	unknown	Brazil	53048	CELANTESERVICOSDETELECOMUNICACOESLTDA-EPPBR	false
177.9.11.112	unknown	Brazil	27699	TELEFONICABRASILSABR	false
17.227.111.52	unknown	United States	714	APPLE-ENGINEERINGUS	false
77.18.182.178	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
68.113.18.244	unknown	United States	20115	CHARTER-20115US	false
202.157.221.254	unknown	China	9892	ICONZ-WEBVISIONS-APIconz-WebvisionsPteLtdSG	false
154.22.18.26	unknown	United States	174	COGENT-174US	false
177.179.23.52	unknown	Brazil	7738	TelemarNorteLesteSABR	false
209.18.212.203	unknown	United States	5006	VOYANTUS	false
153.66.188.236	unknown	United States	14962	NCR-252US	false
211.76.120.111	unknown	Taiwan; Republic of China (ROC)	9924	TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi	false
9.164.35.227	unknown	United States	3356	LEVEL3US	false
146.93.50.19	unknown	United States	18709	BOTWUS	false
173.228.194.221	unknown	Puerto Rico	10396	COQUI-NETPR	false
139.145.68.30	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
223.63.116.214	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
108.133.84.119	unknown	United States	16509	AMAZON-02US	false
119.237.33.202	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
168.162.119.174	unknown	United States	38027	MOST-AS-APInformationCenterMinistryofSciandTechCN	false
31.233.178.41	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
82.103.70.71	unknown	Bulgaria	44179	TELERIK-ASBG	false
193.113.235.150	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
216.22.80.196	unknown	United States	25612	DSL-EXPRESSUS	false
39.182.141.160	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
74.215.11.114	unknown	United States	6181	FUSE-NETUS	false
91.37.40.147	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
85.158.71.233	unknown	United Kingdom	8190	MDNXGB	false
213.224.55.73	unknown	Belgium	6848	TELENET-ASBE	false
179.188.35.4	unknown	Brazil	27715	LocawebServicosdeInternetSABR	false
201.237.215.5	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
46.43.178.118	unknown	United Kingdom	39477	MUNDIO-MOBILEGB	false
106.37.167.226	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
2.122.196.76	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
1.192.168.89	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
14.201.87.45	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
197.167.121.151	unknown	Egypt	24863	LINKdotNET-ASEG	false
60.24.250.224	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
48.185.135.84	unknown	United States	2686	ATGS-MMD-ASUS	false
194.243.251.247	unknown	Italy	3269	ASN-IBSNAZIT	false
130.183.226.47	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
194.14.143.29	unknown	Sweden	2116	ASN-CATCHCOMNO	false
77.243.72.129	unknown	Malta	33874	VFM-ASVodafoneMaltaLtdASMT	false
53.74.124.133	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
31.25.41.102	unknown	Germany	41998	NETCOMBW-ASDE	false
20.175.0.166	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
183.139.110.16	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
12.85.179.33	unknown	United States	7018	ATT-INTERNET4US	false
47.99.128.220	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
165.48.116.46	unknown	United States	37053	RSAWEB-ASZA	false
99.91.69.28	unknown	United States	7018	ATT-INTERNET4US	false
150.252.25.10	unknown	United States	32601	ACUNET-2US	false
174.117.203.139	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
24.171.57.145	unknown	United States	20115	CHARTER-20115US	false
172.213.145.23	unknown	United States	18747	IFX18747US	false
192.81.147.169	unknown	United States	23500	EISUS	false
145.58.148.244	unknown	Netherlands	25182	PUBLIEKE-OMROEP-ASNPONederlandsePubliekeOmroepNL	false
78.113.7.231	unknown	France	8228	CEGETEL-ASFR	false
208.145.68.229	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
67.180.177.80	unknown	United States	7922	COMCAST-7922US	false
183.243.12.19	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	false
168.70.158.104	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
4.214.119.234	unknown	United States	3356	LEVEL3US	false
87.237.137.155	unknown	Russian Federation	39045	GAZTELECOM-ASRU	false
181.48.167.169	unknown	Colombia	14080	TelmexColombiaSACO	false
101.5.188.184	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
194.207.209.201	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	false
108.15.44.242	unknown	United States	701	UUNETUS	false
169.9.176.19	unknown	United States	203	CENTURYLINK-LEGACY-LVLT-203US	false
123.16.27.159	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
108.196.66.18	unknown	United States	7018	ATT-INTERNET4US	false
24.220.99.217	unknown	United States	11232	MIDCO-NETUS	false
188.16.229.238	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
89.10.128.163	unknown	Norway	15659	NEXTGENTELNEXTGENTELAutonomousSystemNO	false
207.137.32.222	unknown	United States	10708	SELECTNET-ASUS	false
114.73.201.99	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
44.83.70.248	unknown	United States	7377	UCSDUS	false
14.205.123.111	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
141.36.151.30	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
89.112.215.202	unknown	Russian Federation	3216	SOVAM-ASRU	false
196.226.4.147	unknown	Tunisia	37492	ORANGE-TN	false
133.14.221.158	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
182.98.16.40	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
90.201.25.146	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
182.133.95.249	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
95.145.47.99	unknown	United Kingdom	12576	EELtdGB	false
13.50.219.62	unknown	United States	16509	AMAZON-02US	false
65.206.5.153	unknown	United States	46578	AS46578US	false
91.142.254.66	unknown	Netherlands	21155	ASN-PROSERVEAmsterdamNL	false
34.217.158.253	unknown	United States	16509	AMAZON-02US	false
43.97.188.89	unknown	Japan	4249	LILLY-ASUS	false
166.74.232.253	unknown	United States	7018	ATT-INTERNET4US	false
161.156.204.166	unknown	United States	36351	SOFTLAYERUS	false
9.134.175.218	unknown	United States	3356	LEVEL3US	false
31.99.121.7	unknown	United Kingdom	12576	EELtdGB	false

Runtime Messages

Command:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	xXxSlicexXxxVEGA.
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
168.162.119.174	GaSBpMyVub	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ATGS-MMD-ASUS	sora.arm7	Get hash	malicious	Browse	48.235.60.188
	arm	Get hash	malicious	Browse	57.223.59.4
	sora.arm	Get hash	malicious	Browse	32.61.222.246
	KKveTTgaAAsecNNaaaa.arm	Get hash	malicious	Browse	32.130.149.32
	QaCRsRGMyb	Get hash	malicious	Browse	51.58.121.63
	27xJuvcfMM	Get hash	malicious	Browse	48.89.81.191
	x86_64	Get hash	malicious	Browse	48.37.111.204
	arm	Get hash	malicious	Browse	57.20.69.167
	arm6	Get hash	malicious	Browse	32.12.117.185
	arm5	Get hash	malicious	Browse	51.188.186.25
	GB0O1NUtmJ	Get hash	malicious	Browse	34.179.176.100
	4DrtSJOLjr	Get hash	malicious	Browse	57.237.59.102
	LAQh74RNEl	Get hash	malicious	Browse	51.3.107.12
	dYgJ72oG4f	Get hash	malicious	Browse	48.2.87.129
	Kz2SeJpaxw	Get hash	malicious	Browse	34.171.56.126
	O4aHLhCviL	Get hash	malicious	Browse	34.167.178.223
	fMGehkjmPv	Get hash	malicious	Browse	34.169.234.166
	RrK5IgZ6gZ	Get hash	malicious	Browse	34.189.194.230
	BKyU0T5xcw	Get hash	malicious	Browse	48.67.72.123
	skonwRkAlJ	Get hash	malicious	Browse	48.35.125.69
TWC-12271-NYCUS	KKveTTgaAAsecNNaaaa.arm	Get hash	malicious	Browse	24.161.67.215
	arm	Get hash	malicious	Browse	74.64.154.86
	Kz2SeJpaxw	Get hash	malicious	Browse	184.74.156.0
	BKyU0T5xcw	Get hash	malicious	Browse	74.66.47.4
	WcBBoVjwRf	Get hash	malicious	Browse	108.176.28.33
	7L38cWaJpW	Get hash	malicious	Browse	68.173.251.99
	F0ihkIMDf2	Get hash	malicious	Browse	74.66.251.2
	HdZIgkO5be	Get hash	malicious	Browse	76.15.160.88
	mips-20211103-0152	Get hash	malicious	Browse	74.68.239.29
	sora.arm	Get hash	malicious	Browse	76.15.147.55
	sora.x86	Get hash	malicious	Browse	69.193.221.4
	sora.arm	Get hash	malicious	Browse	72.225.180.234
	arH2Af5qoc	Get hash	malicious	Browse	172.254.73.194
	mxHkqAIYT0	Get hash	malicious	Browse	74.73.236.181
	apep.x86	Get hash	malicious	Browse	64.131.165.111
	8MPbeDAwwZ	Get hash	malicious	Browse	98.15.243.192
	Xs0PMn85CN	Get hash	malicious	Browse	158.222.252.117
	Tsunami.x86	Get hash	malicious	Browse	98.15.44.70
	x86	Get hash	malicious	Browse	67.243.222.223
	Z7QqCH0bak	Get hash	malicious	Browse	24.215.190.164
GITOYEN-MAIN-ASThemainAutonomousSystemofGitoyenParis	tqQd9hibj0	Get hash	malicious	Browse	80.67.177.32
	YazlX01sZD	Get hash	malicious	Browse	185.57.124.10
	uooJsVQqwu.exe	Get hash	malicious	Browse	80.67.172.162
	reservation.pdf.exe	Get hash	malicious	Browse	80.67.172.162

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/run/systemd/journal/streams/.#9:74909sRlrzC Download File
Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.513153612691522
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzfch7RS0Dkin9lsjq:SbFuFyLVIg1BG+f+MW7R9DB92ji4s
MD5:	493EADEDAFF8846E7E65936409B4FD43
SHA1:	0A4E5782838AEED27D0C24F26E97EAC56EF1D13E
SHA-256:	2BEB53BFDAF52CCF21ACA723E7C0229D1AFC5A3BF3D732C8B867D8C8EFE109CA
SHA-512:	9B1D70AD0644E4F306D2345677EAC4921054CC41C695FFDB801C1A03A939D585C1D570AC165A563342798B3D939AA76F5921AABBC2FEF5BFCF91A7D453DC9B49
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ff9ea6a588d47e48dbad25705ee2082.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74914GLndJA Download File
Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5429844560520385
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmznmoAtE2ySbMqjs77:SbFuFyLVIg1BG+f+MaoAlBgqji4s
MD5:	A21E5624C1F82E6338EFF7D1C3563F3F
SHA1:	942BA7D52BFC45952FC67D350D1C0D65A252B9F4
SHA-256:	B7C98E43BD7BF2D69353B8CD5B20300003D2E9032D94CFA9D06646C57003076D
SHA-512:	D7EC4FAE4DC64F2EFA7D7E1A9AA91A2F5A863BEA784C59FBCC2768BC36B619F19B2526BECB8DAA2329A5F94D44147E734A3FEA6FC0D74733D87E98D855B82996
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90296fa114e24c598f10d0ba3b6417d7.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal Download File
Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HloUes/:F3P
MD5:	8E8C353DEB42B1B3A5B5C477CC33AB10
SHA1:	0FD65C0619CAEF9A1B799F120BD5C3DBC2A0004A
SHA-256:	F6037E39F9A92665229FA2A5B9C73CB3008A157DC9B6B1C498087BE2048D39C8
SHA-512:	ED9CDAF353EF960E464A1B38904DF163947C739BE905F5217E97BF698DF77B8FDFD4FCA04D3D39DEA53BB9AF18687D1A17CEA9E006EBD23D1E3C53F2F5082928
Malicious:	false
Reputation:	low
Preview:	LPKSHHRH..................r..{I...#.M.....................................r..{I...#.M...........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal Download File
Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4226312153993532
Encrypted:	false
SSDEEP:	3:F31HlcY+UlXUY+Ml:F3MWk2l
MD5:	CDB365ADFB7A0DBF44976B2CE102EE0A
SHA1:	B68BDF749E6BE9FF34D74CED8B004B4B32FE376D
SHA-256:	DED77C2232BF98D09DDBA69894514CA325E33DA81E1E91E8A066A1063F2A3706
SHA-512:	4B0FB20C606829FFB88B19D4EF61D8CB43072411FE6BACBB8F2DB461DE695B7B541BB751EB0885C92FAB64AC6D60DF5B188A15E9020D043C4A48A3D571EF892A
Malicious:	false
Reputation:	low
Preview:	LPKSHHRH................5VI}D!N..-.NH...................................5VI}D!N..-.NH...........................................................................................................................................................

Static File Info

General
File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.047291053932471
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	KKveTTgaAAsecNNaaaa.arm7
File size:	183778
MD5:	97b077cb62ee38b844602b48cfe02d73
SHA1:	a800c58b51de800550e7ca30a20fedb94115a76f
SHA256:	d6378301896dfeba58f24d5bd1b71fa00ab98b954ec74424a61f9b3f992aac34
SHA512:	e38ca5850103064dd717f8cfe32a242ac57a79c94934f431a101e1eb66129bd0a4199bb81282bfef4cd52a60af0024f785f8070c2adbb836fb54efda03f8fdea
SSDEEP:	3072:4K7JIQs2tpbPiYltZ4m0Or8AkNaKCu9rniQhdVCNHL6TcnfM/9jfcmvXwJRJob:dFs8pbPiYTZLGNaKCu9rnThor6TcfM/X
File Content Preview:	.ELF..............(.........4....C......4. ...(........p.....V...V.......................................................................5..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	148432
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1b7b0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x238a0	0x1b8a0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x238b0	0x1b8b0	0x1de8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x25698	0x1d698	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x256b0	0x1d6b0	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2d7c8	0x1d7c8	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2d7cc	0x1d7cc	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2d7cc	0x1d7cc	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2d7d0	0x1d7d0	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2d7d4	0x1d7d4	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2d7d8	0x1d7d8	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2d880	0x1d880	0x23c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2dabc	0x1dabc	0x32a8	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1dabc	0xc88	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1e748	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1e888	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ea9b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x20ade	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x211c0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x22038	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x222f0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x22bba	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x23d49	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x242a1	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x242b7	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x24858	0x58d0	0x10	0x0		28	815	4
.strtab	STRTAB	0x0	0x2a128	0x2cba	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1d6b0	0x256b0	0x256b0	0x118	0x118	1.8647	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1d7c8	0x1d7c8	3.4016	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1d7c8	0x2d7c8	0x2d7c8	0x2f4	0x359c	2.4019	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
TLS	0x1d7cc	0x2d7cc	0x2d7cc	0x0	0x8	0.0000	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x238a0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x238b0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x25698	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x256b0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2d7c8	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2d7cc	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2d7cc	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2d7d0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2d7d4	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2d7d8	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2d880	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2dabc	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x238a0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x238ac	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb87c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcdd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd97c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1176c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12224	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15de8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1608c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1705c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1798c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1817c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1819c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1950c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1976c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1994c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b97c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d02c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d96c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1daac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e48c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2029c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x203c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20dd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2181c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21d24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x221c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2243c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2265c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2294c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2296c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22ab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x230cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2386c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d7d0	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d7cc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9108	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa24c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa80c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc41c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd404	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd95c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd99c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d880	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d884	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d888	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d88c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d890	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d894	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d898	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d89c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d8a0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d8a4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xe3e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe9a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1172c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d8a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d8ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d8b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d8b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11e14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12360	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x127c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1291c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23c50	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x23c59	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15de4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d8b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15f48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d8bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x17890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1797c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17af8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1808c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2433c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1849c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d8c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d8c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18c90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x243a0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18f44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d9a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x243a8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x195fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2442c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19be0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19fe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a170	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d9ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1ae24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b684	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d9c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b8a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d9dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2da74	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1bb6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24f98	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1c030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2da88	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c22c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cc18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cfd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d060	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d3f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d444	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d7f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2daa0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1d8b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d8e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d9dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1daa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dbd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dce8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ddf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e05c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e40c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eda0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1efec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f9c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25650	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1fed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20284	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x203c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20b0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20bfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ce8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20f28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x211d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x212e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2143c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21624	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x2daac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x25026	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2dab4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x25326	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x25004	12	OBJECT	<unknown>	DEFAULT	4
C.43.5768	.symtab	0x23c59	3	OBJECT	<unknown>	DEFAULT	4
C.44.5769	.symtab	0x23c50	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x2433c	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x25010	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x24354	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x24378	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x25628	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x2436c	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x24360	12	OBJECT	<unknown>	DEFAULT	4
KillProccess	.symtab	0x12370	644	FUNC	<unknown>	DEFAULT	2
LOCAL_ADDR	.symtab	0x30624	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x196e8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x19704	0	NOTYPE	<unknown>	DEFAULT	2
MapBuffer	.symtab	0x12088	412	FUNC	<unknown>	DEFAULT	2
NumaMapBuffer	.symtab	0x12224	332	FUNC	<unknown>	DEFAULT	2
SelfBuffer	.symtab	0x2db18	4	OBJECT	<unknown>	DEFAULT	14
_Exit	.symtab	0x1d9e0	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2d7d8	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x223f4	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x223f8	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x230a8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x223ec	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x22430	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x230cc	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x2386c	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x22424	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x2303c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x23060	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x23084	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x22354	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x2296c	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x223a0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2daac	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x25026	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2dab4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x25326	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2d7c8	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2d7c8	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2daac	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2dab4	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x1cf60	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1cf44	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2dab0	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2dab8	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x1817c	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x17800	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x2029c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x19934	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1cf60	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x17898	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1cff0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1d110	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1d080	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1cff0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1cfd4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1d110	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1d0f4	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1a308	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1a32c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1a2e4	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1d328	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1d3f8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1d080	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1d064	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1994c	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1d9e0	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1b6e0	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x19be8	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1be2c	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x19c5c	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x21298	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1cf60	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x17d40	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1e398	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1e3cc	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1e070	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x19ce4	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1c040	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1e548	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x17898	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1fef0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1f9e0	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x2029c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1fb24	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x203c8	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1e878	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1c874	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1950c	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x21444	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x21468	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1da48	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x19544	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x2029c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1db4c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1db78	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1db8c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1dba0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1dbb4	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1ccd8	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1dbdc	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x19d58	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1dc14	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1dc54	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x19b7c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x20dd0	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1bc48	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x179a0	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x19adc	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x17a80	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x19de4	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x21898	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x20920	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x19600	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x19610	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x20a10	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x20a34	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x19620	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1d83c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1dc68	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1dcac	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1dd2c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1cff0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x17f20	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1cd20	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1b820	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1bae0	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1d110	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x18094	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1df84	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x17afc	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x19e68	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x19f20	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1dd8c	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x17b80	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x19fec	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1a0a8	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x17c04	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1a130	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1bd40	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1d8e4	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1a1bc	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1a20c	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1a220	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x17c44	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1ce10	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1a178	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x181d0	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1bb70	216	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x19a58	132	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x19720	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x20b14	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x20c04	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x20900	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x20900	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x19748	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x20cf0	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x196c0	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1976c	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x20d34	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x20d84	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x19838	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1be4c	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1c250	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x19b00	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x17cd0	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1ddf8	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x17d00	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x18204	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1e414	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1e48c	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1e468	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1d080	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2d7d4	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2d7d4	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x230a8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x2303c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x23060	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x23084	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x21914	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x22270	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x22270	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x22254	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x22300	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x21914	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x22288	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x222d0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x222e8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x222b8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x222a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x21fb4	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x21d24	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x21908	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x21910	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x21c70	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x21c48	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x176a8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x177d4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x21cc4	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x1d990	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x21c24	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x17594	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x17690	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x21cb0	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x23008	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x23000	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x22ff8	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x300dc	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2da88	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x30d64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2dabc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2dabc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1d3a4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1cf60	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1cf44	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x221d0	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2dab0	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2dab8	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x30620	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2d880	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x1d984	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1d978	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x177ec	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x21fb4	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x176a8	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2d7d0	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x30d64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x300d4	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x221d0	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x1817c	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x257c8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x256b0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2fb84	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x21c70	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x17800	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x2029c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2d7d4	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2d7d0	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x22300	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x21cc4	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x21c48	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x21cb0	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x21c24	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x1c874	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x30d30	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x30d34	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2fb88	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2d7cc	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x221c0	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1daac	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x212fc	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1dbb4	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1ccd8	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x19934	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x227ac	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x22894	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x2302c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x22828	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x2294c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x23034	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x23110	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x23824	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x22ab0	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x221c0	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2d7d0	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2d7cc	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x221c8	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x19be8	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1cf60	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x19ce4	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1d180	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1d208	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x17898	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1c874	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x30d38	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1dd2c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1cff0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1d110	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x19e68	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x19f20	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x17b80	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x19fec	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1a0a8	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x20fcc	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1d8e4	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x300d0	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x1d080	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x1cc40	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x221c8	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1b2b0	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1a350	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2d9ac	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x309b8	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x1b200	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x21d24	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x221d0	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x1cff0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1cfd4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x300d8	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2d7cc	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2d7cc	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2daa4	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2daa8	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x211fc	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1d2ec	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1d2e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1d2e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1d2e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1d2e4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x1d110	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1d0f4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x23010	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x300e0	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x1a308	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1a32c	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1a2e4	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x21858	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x212f0	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2d8d0	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x21628	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1e898	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x21680	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1edd4	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x21748	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x2181c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x21778	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1ef14	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x184b8	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2d8d4	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x21910	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x19ba4	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x19ca0	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x19e24	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x19ed8	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x19fa8	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x1a05c	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1d8b8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1dcec	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1d9a0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x17b3c	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x20fa8	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x1d328	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1d3f8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1d450	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2daa0	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x17594	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x1d080	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x1d064	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x1994c	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1ded8	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1de0c	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2fb74	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x30d64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x184e8	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x30960	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x30988	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2d9a8	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x21208	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x21240	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x30d5c	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x30d60	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x30d50	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x30d4c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x30d54	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x30d44	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x20f40	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x30d40	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x30d58	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x30d48	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x30d3c	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2dabc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x30d64	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x1d9e0	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x238a0	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2db74	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1853c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1f1ec	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1eff0	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x20470	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x18cb4	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x18f9c	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x18d54	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x18d98	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x18f48	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1d2fc	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1d2f4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1d96c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x309b0	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1e974	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x182d4	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2d8d8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2db54	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1fc40	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2db70	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2db60	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2db6c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x2d8dc	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x18354	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2d8c0	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x1be68	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1f064	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x2443c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1f090	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x185c0	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1b6e0	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x19be8	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_auth_entry	.symtab	0x127c8	352	FUNC	<unknown>	DEFAULT	2
anti_gdb_entry	.symtab	0x10c34	24	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x1be2c	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1be2c	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0xa4dc	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0xa470	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0xa0fc	92	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0xa54c	748	FUNC	<unknown>	DEFAULT	2
attack_method_http	.symtab	0x81d0	7980	FUNC	<unknown>	DEFAULT	2
attack_method_ovh	.symtab	0x1176c	1708	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0xa254	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0xa158	252	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0xa838	1784	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0xaf30	1708	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_dns	.symtab	0xbd68	1724	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2021 03:58:27.564837933 CET	42836	443	192.168.2.23	91.189.91.43
Nov 10, 2021 03:58:27.822999001 CET	49932	60420	192.168.2.23	107.174.241.209
Nov 10, 2021 03:58:27.830581903 CET	49859	2323	192.168.2.23	211.165.123.94
Nov 10, 2021 03:58:27.830648899 CET	49859	23	192.168.2.23	180.172.125.184
Nov 10, 2021 03:58:27.830682039 CET	49859	23	192.168.2.23	44.58.64.94
Nov 10, 2021 03:58:27.830758095 CET	49859	23	192.168.2.23	155.163.92.99
Nov 10, 2021 03:58:27.830755949 CET	49859	23	192.168.2.23	13.178.198.83
Nov 10, 2021 03:58:27.830764055 CET	49859	23	192.168.2.23	71.211.165.33
Nov 10, 2021 03:58:27.830770016 CET	49859	23	192.168.2.23	172.227.82.18
Nov 10, 2021 03:58:27.830811024 CET	49859	23	192.168.2.23	166.17.110.145
Nov 10, 2021 03:58:27.830812931 CET	49859	23	192.168.2.23	57.5.199.240
Nov 10, 2021 03:58:27.830826044 CET	49859	23	192.168.2.23	222.255.140.194
Nov 10, 2021 03:58:27.830833912 CET	49859	23	192.168.2.23	200.216.220.32
Nov 10, 2021 03:58:27.830843925 CET	49859	23	192.168.2.23	34.185.131.185
Nov 10, 2021 03:58:27.830856085 CET	49859	2323	192.168.2.23	164.53.222.48
Nov 10, 2021 03:58:27.830857992 CET	49859	23	192.168.2.23	41.85.160.97
Nov 10, 2021 03:58:27.830868006 CET	49859	23	192.168.2.23	98.123.186.103
Nov 10, 2021 03:58:27.830871105 CET	49859	23	192.168.2.23	170.53.235.53
Nov 10, 2021 03:58:27.830893040 CET	49859	23	192.168.2.23	92.78.184.92
Nov 10, 2021 03:58:27.830925941 CET	49859	23	192.168.2.23	216.165.79.125
Nov 10, 2021 03:58:27.830935955 CET	49859	23	192.168.2.23	155.68.70.75
Nov 10, 2021 03:58:27.830943108 CET	49859	23	192.168.2.23	162.216.143.43
Nov 10, 2021 03:58:27.830951929 CET	49859	23	192.168.2.23	9.97.7.25
Nov 10, 2021 03:58:27.830956936 CET	49859	23	192.168.2.23	47.33.91.66
Nov 10, 2021 03:58:27.830976963 CET	49859	23	192.168.2.23	147.48.136.98
Nov 10, 2021 03:58:27.830981016 CET	49859	23	192.168.2.23	138.219.90.123
Nov 10, 2021 03:58:27.830991030 CET	49859	23	192.168.2.23	83.124.91.226
Nov 10, 2021 03:58:27.831003904 CET	49859	23	192.168.2.23	151.224.97.191
Nov 10, 2021 03:58:27.831018925 CET	49859	2323	192.168.2.23	193.61.246.86
Nov 10, 2021 03:58:27.831018925 CET	49859	23	192.168.2.23	108.159.246.251
Nov 10, 2021 03:58:27.831027031 CET	49859	23	192.168.2.23	19.84.38.235
Nov 10, 2021 03:58:27.831041098 CET	49859	23	192.168.2.23	74.195.102.207
Nov 10, 2021 03:58:27.831043005 CET	49859	2323	192.168.2.23	73.248.193.68
Nov 10, 2021 03:58:27.831059933 CET	49859	23	192.168.2.23	4.52.134.41
Nov 10, 2021 03:58:27.831065893 CET	49859	23	192.168.2.23	218.198.18.29
Nov 10, 2021 03:58:27.831068039 CET	49859	23	192.168.2.23	198.42.34.169
Nov 10, 2021 03:58:27.831073046 CET	49859	23	192.168.2.23	79.217.136.219
Nov 10, 2021 03:58:27.831084013 CET	49859	23	192.168.2.23	148.41.186.135
Nov 10, 2021 03:58:27.831093073 CET	49859	23	192.168.2.23	110.218.221.172
Nov 10, 2021 03:58:27.831095934 CET	49859	2323	192.168.2.23	78.84.158.160
Nov 10, 2021 03:58:27.831110954 CET	49859	23	192.168.2.23	205.157.44.142
Nov 10, 2021 03:58:27.831116915 CET	49859	23	192.168.2.23	168.130.194.11
Nov 10, 2021 03:58:27.831135988 CET	49859	23	192.168.2.23	154.199.76.99
Nov 10, 2021 03:58:27.831140995 CET	49859	23	192.168.2.23	157.194.38.222
Nov 10, 2021 03:58:27.831141949 CET	49859	23	192.168.2.23	192.216.37.75
Nov 10, 2021 03:58:27.831166983 CET	49859	23	192.168.2.23	100.251.22.28
Nov 10, 2021 03:58:27.831171989 CET	49859	23	192.168.2.23	92.255.56.147
Nov 10, 2021 03:58:27.831193924 CET	49859	23	192.168.2.23	99.169.75.137
Nov 10, 2021 03:58:27.831201077 CET	49859	23	192.168.2.23	123.218.53.72
Nov 10, 2021 03:58:27.831202984 CET	49859	23	192.168.2.23	27.192.206.170
Nov 10, 2021 03:58:27.831213951 CET	49859	2323	192.168.2.23	9.84.194.6
Nov 10, 2021 03:58:27.831222057 CET	49859	23	192.168.2.23	212.156.171.237
Nov 10, 2021 03:58:27.831232071 CET	49859	23	192.168.2.23	116.227.34.249
Nov 10, 2021 03:58:27.831232071 CET	49859	23	192.168.2.23	89.147.12.202
Nov 10, 2021 03:58:27.831278086 CET	49859	23	192.168.2.23	113.248.229.119
Nov 10, 2021 03:58:27.831295967 CET	49859	23	192.168.2.23	79.144.86.198
Nov 10, 2021 03:58:27.831295967 CET	49859	23	192.168.2.23	32.134.253.211
Nov 10, 2021 03:58:27.831284046 CET	49859	23	192.168.2.23	123.32.222.101
Nov 10, 2021 03:58:27.831311941 CET	49859	23	192.168.2.23	101.141.159.60
Nov 10, 2021 03:58:27.831319094 CET	49859	23	192.168.2.23	67.209.3.127
Nov 10, 2021 03:58:27.831321955 CET	49859	23	192.168.2.23	126.176.210.4
Nov 10, 2021 03:58:27.831326962 CET	49859	23	192.168.2.23	105.196.119.160
Nov 10, 2021 03:58:27.831331968 CET	49859	23	192.168.2.23	105.73.194.225
Nov 10, 2021 03:58:27.831340075 CET	49859	23	192.168.2.23	223.174.202.24
Nov 10, 2021 03:58:27.831341982 CET	49859	23	192.168.2.23	12.224.153.206
Nov 10, 2021 03:58:27.831346989 CET	49859	23	192.168.2.23	1.134.100.187
Nov 10, 2021 03:58:27.831347942 CET	49859	2323	192.168.2.23	9.226.22.225
Nov 10, 2021 03:58:27.831353903 CET	49859	23	192.168.2.23	99.45.41.238
Nov 10, 2021 03:58:27.831370115 CET	49859	23	192.168.2.23	70.182.125.170
Nov 10, 2021 03:58:27.831378937 CET	49859	23	192.168.2.23	114.30.117.237
Nov 10, 2021 03:58:27.831384897 CET	49859	23	192.168.2.23	169.200.235.113
Nov 10, 2021 03:58:27.831389904 CET	49859	23	192.168.2.23	99.40.61.174
Nov 10, 2021 03:58:27.831391096 CET	49859	23	192.168.2.23	107.250.205.148
Nov 10, 2021 03:58:27.831398010 CET	49859	23	192.168.2.23	124.239.86.37
Nov 10, 2021 03:58:27.831403971 CET	49859	23	192.168.2.23	24.176.160.124
Nov 10, 2021 03:58:27.831409931 CET	49859	23	192.168.2.23	19.12.211.228
Nov 10, 2021 03:58:27.831418037 CET	49859	23	192.168.2.23	93.215.229.75
Nov 10, 2021 03:58:27.831429958 CET	49859	23	192.168.2.23	62.14.58.119
Nov 10, 2021 03:58:27.831435919 CET	49859	23	192.168.2.23	186.83.30.253
Nov 10, 2021 03:58:27.831442118 CET	49859	23	192.168.2.23	203.108.141.11
Nov 10, 2021 03:58:27.831442118 CET	49859	2323	192.168.2.23	79.86.110.99
Nov 10, 2021 03:58:27.831449986 CET	49859	2323	192.168.2.23	208.252.145.73
Nov 10, 2021 03:58:27.831454992 CET	49859	23	192.168.2.23	212.173.102.135
Nov 10, 2021 03:58:27.831456900 CET	49859	23	192.168.2.23	74.185.117.245
Nov 10, 2021 03:58:27.831461906 CET	49859	23	192.168.2.23	91.194.11.201
Nov 10, 2021 03:58:27.831476927 CET	49859	23	192.168.2.23	8.147.166.247
Nov 10, 2021 03:58:27.831485033 CET	49859	23	192.168.2.23	222.125.150.9
Nov 10, 2021 03:58:27.831497908 CET	49859	23	192.168.2.23	88.199.167.218
Nov 10, 2021 03:58:27.831506014 CET	49859	23	192.168.2.23	178.232.29.223
Nov 10, 2021 03:58:27.831516027 CET	49859	23	192.168.2.23	206.36.16.90
Nov 10, 2021 03:58:27.831538916 CET	49859	23	192.168.2.23	64.60.163.56
Nov 10, 2021 03:58:27.831541061 CET	49859	23	192.168.2.23	212.243.89.243
Nov 10, 2021 03:58:27.831553936 CET	49859	23	192.168.2.23	14.9.225.201
Nov 10, 2021 03:58:27.831557035 CET	49859	23	192.168.2.23	194.185.111.97
Nov 10, 2021 03:58:27.831558943 CET	49859	2323	192.168.2.23	150.92.20.67
Nov 10, 2021 03:58:27.831562996 CET	49859	23	192.168.2.23	58.93.47.99
Nov 10, 2021 03:58:27.831573009 CET	49859	23	192.168.2.23	104.248.235.204
Nov 10, 2021 03:58:27.831579924 CET	49859	23	192.168.2.23	110.176.3.16
Nov 10, 2021 03:58:27.831583977 CET	49859	23	192.168.2.23	121.177.165.165
Nov 10, 2021 03:58:27.831585884 CET	49859	2323	192.168.2.23	142.35.231.140

System Behavior

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5224 Parent PID: 5116

General

Start time:	03:58:22
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	/tmp/KKveTTgaAAsecNNaaaa.arm7
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5245 Parent PID: 5224

General

Start time:	03:58:22
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5246 Parent PID: 5224

General

Start time:	03:58:22
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5249 Parent PID: 5246

General

Start time:	03:58:22
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5252 Parent PID: 5246

General

Start time:	03:58:22
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5256 Parent PID: 5246

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5258 Parent PID: 5246

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5260 Parent PID: 5246

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5265 Parent PID: 5260

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5261 Parent PID: 5246

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/tmp/KKveTTgaAAsecNNaaaa.arm7
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: systemd PID: 5267 Parent PID: 1

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: journalctl PID: 5267 Parent PID: 1

General

Start time:	03:58:26
Start date:	10/11/2021
Path:	/usr/bin/journalctl
Arguments:	/usr/bin/journalctl --smart-relinquish-var
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Analysis Process: systemd PID: 5282 Parent PID: 1

General

Start time:	03:58:27
Start date:	10/11/2021
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: systemd-journald PID: 5282 Parent PID: 1

General

Start time:	03:58:27
Start date:	10/11/2021
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Analysis Process: xfce4-session PID: 5285 Parent PID: 1900

General

Start time:	03:58:28
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5285 Parent PID: 1900

General

Start time:	03:58:28
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5292 Parent PID: 5285

General

Start time:	03:58:30
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5293 Parent PID: 1900

General

Start time:	03:58:30
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5293 Parent PID: 1900

General

Start time:	03:58:30
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5296 Parent PID: 5293

General

Start time:	03:58:32
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5297 Parent PID: 1900

General

Start time:	03:58:32
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5297 Parent PID: 1900

General

Start time:	03:58:32
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5300 Parent PID: 5297

General

Start time:	03:58:34
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5301 Parent PID: 1900

General

Start time:	03:58:34
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5301 Parent PID: 1900

General

Start time:	03:58:34
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5306 Parent PID: 5301

General

Start time:	03:58:36
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfce4-session PID: 5307 Parent PID: 1900

General

Start time:	03:58:36
Start date:	10/11/2021
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Analysis Process: xfsettingsd PID: 5307 Parent PID: 1900

General

Start time:	03:58:36
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	xfsettingsd --display :1.0 --sm-client-id 2eab19738-df3b-455c-ba97-1de80472a7b4
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: xfsettingsd PID: 5310 Parent PID: 5307

General

Start time:	03:58:38
Start date:	10/11/2021
Path:	/usr/bin/xfsettingsd
Arguments:	n/a
File size:	322136 bytes
MD5 hash:	d7ae7090131cf73e021f6c89515f984b

Analysis Process: systemd PID: 5315 Parent PID: 1

General

Start time:	03:58:40
Start date:	10/11/2021
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: journalctl PID: 5315 Parent PID: 1

General

Start time:	03:58:40
Start date:	10/11/2021
Path:	/usr/bin/journalctl
Arguments:	/usr/bin/journalctl --flush
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report KKveTTgaAAsecNNaaaa.arm7

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5224 Parent PID: 5116

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5245 Parent PID: 5224

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5246 Parent PID: 5224

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5249 Parent PID: 5246

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5252 Parent PID: 5246

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5256 Parent PID: 5246

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5258 Parent PID: 5246

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5260 Parent PID: 5246

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5265 Parent PID: 5260

General

Analysis Process: KKveTTgaAAsecNNaaaa.arm7 PID: 5261 Parent PID: 5246

General

Analysis Process: systemd PID: 5267 Parent PID: 1