Play interactive tour

Edit tour

Linux Analysis Report HF6zp1MUDf

Overview

General Information

Sample Name:	HF6zp1MUDf
Analysis ID:	534248
MD5:	4622a52d9fd968018ad4c7b4eecbe9c3
SHA1:	652c8242c20c98ce552d229ee40099cb1dcb4fb8
SHA256:	04178bd89bd252ad882bb9d38bc2be80288b7575270675c2587cfff4afefe8c2
Tags:	32armelfgafgyt
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534248
Start date:	05.12.2021
Start time:	18:53:59
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	HF6zp1MUDf
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal68.troj.lin@0/1@0/0

Process Tree

system is lnxubuntu20

HF6zp1MUDf (PID: 5212, Parent: 5108, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/HF6zp1MUDf

HF6zp1MUDf New Fork (PID: 5214, Parent: 5212)

HF6zp1MUDf New Fork (PID: 5216, Parent: 5214)

HF6zp1MUDf New Fork (PID: 5218, Parent: 5216)

HF6zp1MUDf New Fork (PID: 5219, Parent: 5216)

dash New Fork (PID: 5280, Parent: 4335)

rm (PID: 5280, Parent: 4335, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.VADrHQ3TP0 /tmp/tmp.sw5Tcf2iYj /tmp/tmp.Jn0ReUwJaA

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
HF6zp1MUDf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5214.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5218.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5212.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5216.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: HF6zp1MUDf

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: HF6zp1MUDf	Virustotal: Detection: 59%			Perma Link
Source: HF6zp1MUDf	ReversingLabs: Detection: 62%

Networking:

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 85.237.217.143 ports 42516,1,2,4,5,6

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:39244 -> 34.249.145.219:443

Source: global traffic

TCP traffic: 192.168.2.23:36272 -> 85.237.217.143:42516

Source: unknown	Network traffic detected: HTTP traffic on port 39244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.142.15
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143
Source: unknown	TCP traffic detected without corresponding DNS query: 85.237.217.143

Source: HF6zp1MUDf	String found in binary or memory: http://199.19.225.2/bins.sh;
Source: HF6zp1MUDf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: HF6zp1MUDf	String found in binary or memory: http://feedback.redkolibri.com/
Source: HF6zp1MUDf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: HF6zp1MUDf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: HF6zp1MUDf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: ELF static info symbol of initial sample

Name: TelnetScanner

Source: Initial sample

String containing 'busybox' found: busybox

Source: classification engine

Classification label: mal68.troj.lin@0/1@0/0

Source: /usr/bin/dash (PID: 5280)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.VADrHQ3TP0 /tmp/tmp.sw5Tcf2iYj /tmp/tmp.Jn0ReUwJaA

Jump to behavior

Source: submitted sample

Stderr: qemu: uncaught target signal 11 (Segmentation fault) - core dumped: exit code = 0

Source: /tmp/HF6zp1MUDf (PID: 5212)

Queries kernel information via 'uname':

Jump to behavior

Source: HF6zp1MUDf, 5212.1.000000001a70798a.0000000090d9a292.rw-.sdmp, HF6zp1MUDf, 5214.1.000000001a70798a.0000000090d9a292.rw-.sdmp, HF6zp1MUDf, 5216.1.000000001a70798a.0000000090d9a292.rw-.sdmp, HF6zp1MUDf, 5218.1.000000001a70798a.0000000090d9a292.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: HF6zp1MUDf, 5212.1.000000001a70798a.0000000090d9a292.rw-.sdmp, HF6zp1MUDf, 5214.1.000000001a70798a.0000000090d9a292.rw-.sdmp, HF6zp1MUDf, 5216.1.000000001a70798a.0000000090d9a292.rw-.sdmp, HF6zp1MUDf, 5218.1.000000001a70798a.0000000090d9a292.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: HF6zp1MUDf, 5212.1.000000005e0256ed.00000000bc153754.rw-.sdmp, HF6zp1MUDf, 5214.1.000000005e0256ed.00000000bc153754.rw-.sdmp, HF6zp1MUDf, 5216.1.000000005e0256ed.00000000bc153754.rw-.sdmp, HF6zp1MUDf, 5218.1.000000005e0256ed.00000000bc153754.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: HF6zp1MUDf, 5212.1.000000005e0256ed.00000000bc153754.rw-.sdmp, HF6zp1MUDf, 5214.1.000000005e0256ed.00000000bc153754.rw-.sdmp, HF6zp1MUDf, 5216.1.000000005e0256ed.00000000bc153754.rw-.sdmp, HF6zp1MUDf, 5218.1.000000005e0256ed.00000000bc153754.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/HF6zp1MUDfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/HF6zp1MUDf
Source: HF6zp1MUDf, 5218.1.000000005e0256ed.00000000bc153754.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: HF6zp1MUDf, type: SAMPLE
Source: Yara match	File source: 5214.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5218.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5212.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5216.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: HF6zp1MUDf, type: SAMPLE
Source: Yara match	File source: 5214.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5218.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5212.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5216.1.000000009e0c34d3.00000000292d5d9f.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	File Deletion1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
HF6zp1MUDf	60%	Virustotal		Browse
HF6zp1MUDf	62%	ReversingLabs	Linux.Trojan.Gafgyt
HF6zp1MUDf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe
http://199.19.225.2/bins.sh;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	HF6zp1MUDf	false		high
http://www.billybobbot.com/crawler/)	HF6zp1MUDf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	HF6zp1MUDf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	HF6zp1MUDf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	HF6zp1MUDf	false		high
http://199.19.225.2/bins.sh;	HF6zp1MUDf	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.245.142.15	unknown	United States	36352	AS-COLOCROSSINGUS	false
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
85.237.217.143	unknown	United Kingdom	21321	ARETI-ASGB	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/HF6zp1MUDf
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	[97m[[38;5;202mORBIT[97m] [38;5;202mArch: [97mARM4T [38;5;202mType: [97mLITTLE_ENDIAN
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.245.142.15	ub46olxdcc	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	HuA8rX5Gnk	Get hash	malicious	Browse
	D5MDE1XXvY	Get hash	malicious	Browse
34.249.145.219	Iif5nK0q3o	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse
	cbr.arm7	Get hash	malicious	Browse
	Wnr5TcxvdY	Get hash	malicious	Browse
	u11MddEYBm	Get hash	malicious	Browse
	9f3I2Oe9lb	Get hash	malicious	Browse
	5msGgwELt1	Get hash	malicious	Browse
	UdSVMqZRW5	Get hash	malicious	Browse
	beamer.x86-20211202-2350	Get hash	malicious	Browse
	beamer.arm-20211202-2350	Get hash	malicious	Browse
	PQPv91RexG	Get hash	malicious	Browse
	RIE3BrH6X4	Get hash	malicious	Browse
	tlKkI7uWcu	Get hash	malicious	Browse
	nbGnA0iX0e	Get hash	malicious	Browse
	VvUgZxfzqG	Get hash	malicious	Browse
	Vc90gP8W1b	Get hash	malicious	Browse
	tJaSWmeCjd	Get hash	malicious	Browse
	2MzNonluPU	Get hash	malicious	Browse
	jew.x86-20211122-1350	Get hash	malicious	Browse
85.237.217.143	cDHvd1tp2x	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	xyLAkjzDP1	Get hash	malicious	Browse
	p9aYSEPY1g	Get hash	malicious	Browse
	J7OXgvNcYx	Get hash	malicious	Browse
	iCJoZJ1iF0	Get hash	malicious	Browse
	kMDTne1K4H	Get hash	malicious	Browse
	7evGU3Z12H	Get hash	malicious	Browse
	O0eBrHuHOR	Get hash	malicious	Browse
	lp4eZYDISa	Get hash	malicious	Browse
	utCF3oKE7j	Get hash	malicious	Browse
	9xmBK8Yk7L	Get hash	malicious	Browse
	5C68yKuI05	Get hash	malicious	Browse
	OuTRctwVMc	Get hash	malicious	Browse
	3h8hGqSxeZ	Get hash	malicious	Browse
	wjEACpPKod	Get hash	malicious	Browse
	VKgKmk54vC	Get hash	malicious	Browse
109.202.202.202	ub46olxdcc	Get hash	malicious	Browse
	cDHvd1tp2x	Get hash	malicious	Browse
	TtG027KDqC	Get hash	malicious	Browse
	Iif5nK0q3o	Get hash	malicious	Browse
	TTOSJWnF92	Get hash	malicious	Browse
	N2MGGp7k8b	Get hash	malicious	Browse
	QwKoHC7f1c	Get hash	malicious	Browse
	iCRrgdO9hl	Get hash	malicious	Browse
	pvtH5neadB	Get hash	malicious	Browse
	My7DDV8cjV	Get hash	malicious	Browse
	7H8oT3jp4u	Get hash	malicious	Browse
	3Z3SEO82Tw	Get hash	malicious	Browse
	fhrRmQOge6	Get hash	malicious	Browse
	2k2LHrePaX	Get hash	malicious	Browse
	xMeY7xXFRE	Get hash	malicious	Browse
	HuA8rX5Gnk	Get hash	malicious	Browse
	D5MDE1XXvY	Get hash	malicious	Browse
	cbr.arm7	Get hash	malicious	Browse
	cbr.x86	Get hash	malicious	Browse
	cbr.arm	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-COLOCROSSINGUS	ub46olxdcc	Get hash	malicious	Browse	172.245.142.15
	TtG027KDqC	Get hash	malicious	Browse	172.245.142.15
	Iif5nK0q3o	Get hash	malicious	Browse	172.245.142.15
	TTOSJWnF92	Get hash	malicious	Browse	172.245.142.15
	N2MGGp7k8b	Get hash	malicious	Browse	172.245.142.15
	pvtH5neadB	Get hash	malicious	Browse	172.245.142.15
	My7DDV8cjV	Get hash	malicious	Browse	172.245.142.15
	3Z3SEO82Tw	Get hash	malicious	Browse	172.245.142.15
	fhrRmQOge6	Get hash	malicious	Browse	172.245.142.15
	HuA8rX5Gnk	Get hash	malicious	Browse	172.245.142.15
	D5MDE1XXvY	Get hash	malicious	Browse	172.245.142.15
	W8gg1JwtVe.exe	Get hash	malicious	Browse	192.3.157.96
	746390_Invoice_Payment_Copy.vbs	Get hash	malicious	Browse	192.3.121.222
	aAme9ZsZlY.rtf	Get hash	malicious	Browse	192.227.196.194
	GQOv1kLqVL.rtf	Get hash	malicious	Browse	192.227.196.194
	7r4phwK4EY	Get hash	malicious	Browse	96.8.118.142
	Jqj1JC6iTV	Get hash	malicious	Browse	96.8.118.142
	5r63A9I65E	Get hash	malicious	Browse	96.8.118.142
	okSlk77ukP	Get hash	malicious	Browse	96.8.118.142
	UlyGshHQH7	Get hash	malicious	Browse	96.8.118.142
ARETI-ASGB	cDHvd1tp2x	Get hash	malicious	Browse	85.237.217.143
	QwKoHC7f1c	Get hash	malicious	Browse	85.237.217.143
	iCRrgdO9hl	Get hash	malicious	Browse	85.237.217.143
	pvtH5neadB	Get hash	malicious	Browse	85.237.217.143
	xMeY7xXFRE	Get hash	malicious	Browse	85.237.217.143
	xyLAkjzDP1	Get hash	malicious	Browse	85.237.217.143
	p9aYSEPY1g	Get hash	malicious	Browse	85.237.217.143
	J7OXgvNcYx	Get hash	malicious	Browse	85.237.217.143
	iCJoZJ1iF0	Get hash	malicious	Browse	85.237.217.143
	kMDTne1K4H	Get hash	malicious	Browse	85.237.217.143
	7evGU3Z12H	Get hash	malicious	Browse	85.237.217.143
	O0eBrHuHOR	Get hash	malicious	Browse	85.237.217.143
	lp4eZYDISa	Get hash	malicious	Browse	85.237.217.143
	utCF3oKE7j	Get hash	malicious	Browse	85.237.217.143
	9xmBK8Yk7L	Get hash	malicious	Browse	85.237.217.143
	5C68yKuI05	Get hash	malicious	Browse	85.237.217.143
	OuTRctwVMc	Get hash	malicious	Browse	85.237.217.143
	3h8hGqSxeZ	Get hash	malicious	Browse	85.237.217.143
	wjEACpPKod	Get hash	malicious	Browse	85.237.217.143
	cpQx2MDtfh	Get hash	malicious	Browse	85.237.217.174
AMAZON-02US	R8G2kiLTEj	Get hash	malicious	Browse	18.182.39.181
	Iif5nK0q3o	Get hash	malicious	Browse	34.249.145.219
	N2MGGp7k8b	Get hash	malicious	Browse	54.171.230.55
	eaGU6Cv0gg.exe	Get hash	malicious	Browse	52.216.92.51
	My7DDV8cjV	Get hash	malicious	Browse	34.249.145.219
	7H8oT3jp4u	Get hash	malicious	Browse	54.171.230.55
	EZ7OmyYi89	Get hash	malicious	Browse	34.223.83.102
	Ro4o8Vo8fo	Get hash	malicious	Browse	63.34.74.38
	2k2LHrePaX	Get hash	malicious	Browse	34.249.145.219
	oFoByyFHMA	Get hash	malicious	Browse	35.74.129.56
	cbr.arm7	Get hash	malicious	Browse	34.249.145.219
	ljykUFS2Jn	Get hash	malicious	Browse	108.131.163.86
	911.x86	Get hash	malicious	Browse	108.151.82.201
	IU65U1j0PR	Get hash	malicious	Browse	184.169.138.28
	QQBGV828134.VBS	Get hash	malicious	Browse	13.225.74.45
	HCLGT440605.VBS	Get hash	malicious	Browse	13.225.74.45
	911.arm	Get hash	malicious	Browse	18.252.179.124
	912534A5380738D96E8DDB7873ECB004667D72D5DF783.exe	Get hash	malicious	Browse	52.218.101.152
	780426DE24AE46F300FDAF9CBF597C8F2164F7B6C525C.exe	Get hash	malicious	Browse	52.95.150.38
	24E7ED53A8DCE89A4D8F054712A5D77693049EC726F67.exe	Get hash	malicious	Browse	3.131.147.49

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/run/systemd/resolve/stub-resolv.conf Download File
Process:	/tmp/HF6zp1MUDf
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.3918926446809334
Encrypted:	false
SSDEEP:	3:KkZRAkd:KaAu
MD5:	C7EA09D26E26605227076E0514A33038
SHA1:	C3F9736E9AF7BD0885578859A50B205C8FA5FC8E
SHA-256:	7E8AD76E0D200E93918CA2E93C99FF8ECD02071953BF1479819DB3AC0DBB6D07
SHA-512:	17D0088725EB9991E9EB82E8A3DE0878E45E6F394BBC2AD260AA59C786FF0AD565E145E21256425D1C0ABE15F3ECB402EBB0A6A5E1C2D5BA7A4D95EC93A2861F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	nameserver 8.8.8.8.nameserver 8.8.4.4.

Static File Info

General
File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.017496838745515
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	HF6zp1MUDf
File size:	180200
MD5:	4622a52d9fd968018ad4c7b4eecbe9c3
SHA1:	652c8242c20c98ce552d229ee40099cb1dcb4fb8
SHA256:	04178bd89bd252ad882bb9d38bc2be80288b7575270675c2587cfff4afefe8c2
SHA512:	52822737a7e3c42d984165c6c471ca87364c2484bf92f73c49b334da2b9073ed274d089f5d1255a05df7076331200725247aba9317f2e8ed37a258f8929ac77f
SSDEEP:	3072:0V/Yb/dnp+eQPGp+37T/a+Brz/5TPibksbfh7A45hLaO3zVbYM/9cFommw3Bq/1A:d+v/a+BrzBTPAbfhf5hLaO3z+M/9cFoc
File Content Preview:	.ELF..............(.........4...........4. ...(........p\...\?..\?.. ... ...........................\|...\|...............\|...\|...\|.......\|v..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	143040
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x18700	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x207f0	0x187f0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x20800	0x18800	0x3744	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x23f44	0x1bf44	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x23f5c	0x1bf5c	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2c07c	0x1c07c	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2c080	0x1c080	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2c080	0x1c080	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2c084	0x1c084	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c088	0x1c088	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2c08c	0x1c08c	0xb4	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2c140	0x1c140	0x44c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2c590	0x1c58c	0x7168	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1c58c	0xcac	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1d238	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1d378	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1d58b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1f5ce	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1fcb0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x20b28	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x20de0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x216aa	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x22839	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x22d91	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x22da7	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x23348	0x5c90	0x10	0x0		28	822	4
.strtab	STRTAB	0x0	0x28fd8	0x3010	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1bf5c	0x23f5c	0x23f5c	0x120	0x120	1.8552	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1c07c	0x1c07c	3.6498	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1c07c	0x2c07c	0x2c07c	0x510	0x767c	3.0604	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
TLS	0x1c080	0x2c080	0x2c080	0x0	0x8	0.0000	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x207f0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x20800	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x23f44	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x23f5c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2c07c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2c080	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2c080	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2c084	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2c088	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2c08c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2c140	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2c590	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x207f0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x207fc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x844c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeeec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1153c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1219c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1508c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1655c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1794c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1873c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1923c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1938c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cda0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d65c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f38c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f89c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2001c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c084	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c080	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2c144	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c148	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x822c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x855c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8594	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x98d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9cf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaabc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc4fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x222f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc7c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe23c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeee4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10aec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x116f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1197c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c380	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2283c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2c388	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22b3c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11cf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11eb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1200c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c394	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c390	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22e88	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12bf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c478	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22e90	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x132b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x138bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22f14	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13cd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13dcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1405c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c47c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c494	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1512c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x151e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c4ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c544	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x153f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23a80	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x158b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15968	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c558	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15ab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x160cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1649c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16738	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16eb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c570	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x173e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17af4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17dc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c57c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23b28	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1804c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e28	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1886c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ce8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23e68	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a1fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a6e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aef8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b588	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c584	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1bd80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c5bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cc94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c588	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1d5fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c58a	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23f24	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1db38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dfa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dfe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1f590	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ff38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5548	.symtab	0x23af0	12	OBJECT	<unknown>	DEFAULT	4
C.258.6576	.symtab	0x222f8	104	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x23e28	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x23afc	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x22e3c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x22e60	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x23e40	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x22e54	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x22e48	12	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0x133d8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x133f4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x2c5d0	16384	OBJECT	<unknown>	DEFAULT	14
SendDOMINATE	.symtab	0xda44	1636	FUNC	<unknown>	DEFAULT	2
SendHTTP	.symtab	0xe0a8	416	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xe248	400	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xc608	448	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0xcd5c	1732	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0xa508	1364	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0xae38	5888	FUNC	<unknown>	DEFAULT	2
UpdateBins	.symtab	0xee88	100	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0x10a68	140	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x117f0	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2c08c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1f344	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1f348	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1fff8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1f33c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1f380	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x2001c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x207bc	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1f374	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1ff8c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1ffb0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1ffd4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1f2a4	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1f8bc	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1f2f0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2c380	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x2283c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2c57c	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x23b28	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2c388	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x22b3c	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2c07c	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2c07c	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2c380	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2c57c	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x2c388	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x169d0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x169b4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2c384	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2c580	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x2c38c	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x11cd4	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x11664	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1a5c4	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x137a8	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x169d0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x116fc	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x16a60	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x16b80	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x16af0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x16a60	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x16a44	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x16b80	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x16b64	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x165c0	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1408c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x140b0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x14068	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x16d98	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x16e68	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x16af0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x16ad4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x137c0	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x117f0	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x14f64	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x156b0	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1bd34	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x11898	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x169d0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x17f58	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x186c0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x186f4	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x18398	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13c20	116	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x17b70	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x158c4	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x18870	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x116fc	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1a218	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x19d08	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1a5c4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x19e4c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1a6f0	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x18ba0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x160f8	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x131c0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1c100	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1c124	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1bd98	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x131f8	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1a5c4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x118d0	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x17bb0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x17bc4	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x17bd8	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13b50	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x13b6c	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1b190	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1db9c	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1df20	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x17bec	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x16748	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11910	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x17c14	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x17c54	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x13a30	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x13a20	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x13b28	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1b098	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x13b0c	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x13a80	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1ca0c	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1c694	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x154cc	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x17c68	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x13980	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x11c7c	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11948	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1e0fc	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1ac20	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x132e0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1e170	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1ad10	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1ad34	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x132f0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x179d0	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1bdfc	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x17d48	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x17dc8	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x13a60	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x13a50	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x16a60	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x18138	196	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1dfe4	116	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x11cf4	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x16790	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x150a4	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x15364	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1c514	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x16b80	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x182ac	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x13d20	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x17e28	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11a08	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13dd4	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13e90	136	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x11a8c	132	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x11b10	64	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x11b50	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13f18	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x155c4	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x17a78	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13fa4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x17e94	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x16880	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13f60	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11d40	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x153f4	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1e058	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1e5fc	108	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x138cc	132	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x13410	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1ae14	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x13390	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x13390	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x13500	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1af00	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1e180	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x133b0	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x13524	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x135e0	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1b058	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1af44	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1af94	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x136ac	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13950	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1afe0	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x156d0	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x15ad4	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x139a4	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11bd0	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11ca4	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1e0bc	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x12058	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11d74	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x17f20	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11c00	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1873c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x187b4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x18790	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x16af0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2c088	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2c088	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1fff8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1ff8c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1ffb0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1ffd4	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1e864	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f1c0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f1c0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f1a4	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f250	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1e864	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f1d8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f220	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f238	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f208	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f1f0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1ef04	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1ec74	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1e858	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1e860	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1ebc0	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1eb98	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1e714	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1e840	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1ec14	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x17b20	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1eb74	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1153c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x11638	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1ec00	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1ff58	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1ff50	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1ff48	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x32d38	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2c558	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x336f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2c58c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2c58c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x16e14	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x169d0	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1dab8	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x169b4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f120	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2c384	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2c580	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x2c38c	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x332ac	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2c140	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1cca8	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1e2a0	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x17b18	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x17b0c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11650	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1ef04	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1e714	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1cda0	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2c084	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x2c140	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x1e668	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1e1b4	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1e354	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x336f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x32d30	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1f120	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x11cd4	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x2407c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x23f5c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x327e0	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1ebc0	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x11664	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1a5c4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2c088	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2c084	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1f250	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1ec14	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1eb98	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1ec00	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1eb74	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x160f8	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x336b0	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x336b4	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x327e4	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2c080	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1f110	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1db50	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1bfb8	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x17bec	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x16748	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x137a8	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1f6fc	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1f7e4	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1ff7c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1f778	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1f89c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1ff84	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x20060	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x20774	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1fa00	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1f110	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2c084	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2c080	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1f118	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x169d0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13c20	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x16bf0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x16c78	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x116fc	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x160f8	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x336b8	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x17dc8	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x16a60	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x16b80	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x13d20	112	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11a08	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13dd4	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13e90	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1ba68	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x17a78	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x32d2c	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x1794c	132	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x11c00	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x16af0	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1655c	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x164c4	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x23f24	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1f118	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x14b34	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x140d4	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2c47c	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x33338	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x14a84	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1ec74	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x336ec	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x336f0	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x1f120	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x16a60	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1e3b4	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1d65c	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x16a44	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x32d34	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2c080	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2c080	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2c574	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2c578	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1bc98	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x16d5c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x16d54	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x16d54	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x16d54	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x16d54	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x16b80	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1e3e4	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x16b64	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x165c0	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x336e4	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x2c58b	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x332b4	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x2c58a	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x1ff60	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x32d3c	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x336e8	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x336f4	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x1408c	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x140b0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x14068	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1dee0	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1bd8c	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2c3a0	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1c2e4	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x18bc0	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1c33c	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x190fc	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1c404	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1c4d8	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1c434	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1923c	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12028	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2c3a4	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1e860	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x13bdc	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x13cdc	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x13d90	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x13e44	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x17a4c	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x17d88	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1dfa4	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x17b30	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x119c4	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1ba44	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x16d98	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x16e68	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x16ec0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2c570	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x1153c	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x16af0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x16ad4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x137c0	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1bf0c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1be40	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x325f0	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x336f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x1219c	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x332e0	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x33308	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2c478	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1bca4	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x2c584	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x1bcdc	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x336dc	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x336e0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x336d0	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x336cc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x336d4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x336c4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1b9dc	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x336c0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x336d8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x336c8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x336bc	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2c58c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x336f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x117f0	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x207f0	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x305f0	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x121f0	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x19514	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x19318	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1a790	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12968	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x12c50	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x12a08	68	FUNC	<unknown>	HIDDEN	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2021 18:54:42.021650076 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:54:42.049256086 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:54:42.049339056 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:54:43.535861015 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 18:54:44.301655054 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:54:44.303832054 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 18:54:44.328746080 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:54:45.944684029 CET	888	42516	172.245.142.15	192.168.2.23
Dec 5, 2021 18:54:45.944762945 CET	42516	888	192.168.2.23	172.245.142.15
Dec 5, 2021 18:54:58.385103941 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 18:55:05.947215080 CET	39244	443	192.168.2.23	34.249.145.219
Dec 5, 2021 18:55:06.961649895 CET	39244	443	192.168.2.23	34.249.145.219
Dec 5, 2021 18:55:08.977826118 CET	39244	443	192.168.2.23	34.249.145.219
Dec 5, 2021 18:55:10.674073935 CET	42836	443	192.168.2.23	91.189.91.43
Dec 5, 2021 18:55:13.234147072 CET	39244	443	192.168.2.23	34.249.145.219
Dec 5, 2021 18:55:14.770329952 CET	42516	80	192.168.2.23	109.202.202.202
Dec 5, 2021 18:55:21.426969051 CET	39244	443	192.168.2.23	34.249.145.219
Dec 5, 2021 18:55:36.143537045 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:55:36.143862963 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:55:36.173878908 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:55:36.174122095 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:55:37.556103945 CET	39244	443	192.168.2.23	34.249.145.219
Dec 5, 2021 18:55:39.348354101 CET	43928	443	192.168.2.23	91.189.91.42
Dec 5, 2021 18:56:36.145836115 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:56:36.146116018 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:56:36.172498941 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:56:36.172765970 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:57:36.146853924 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:57:36.147219896 CET	36272	42516	192.168.2.23	85.237.217.143
Dec 5, 2021 18:57:36.173340082 CET	42516	36272	85.237.217.143	192.168.2.23
Dec 5, 2021 18:57:36.173613071 CET	36272	42516	192.168.2.23	85.237.217.143

System Behavior

Analysis Process: HF6zp1MUDf PID: 5212 Parent PID: 5108

General

Start time:	18:54:41
Start date:	05/12/2021
Path:	/tmp/HF6zp1MUDf
Arguments:	/tmp/HF6zp1MUDf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5214 Parent PID: 5212

General

Start time:	18:54:41
Start date:	05/12/2021
Path:	/tmp/HF6zp1MUDf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5216 Parent PID: 5214

General

Start time:	18:54:41
Start date:	05/12/2021
Path:	/tmp/HF6zp1MUDf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5218 Parent PID: 5216

General

Start time:	18:54:41
Start date:	05/12/2021
Path:	/tmp/HF6zp1MUDf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5219 Parent PID: 5216

General

Start time:	18:54:41
Start date:	05/12/2021
Path:	/tmp/HF6zp1MUDf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dash PID: 5280 Parent PID: 4335

General

Start time:	18:56:05
Start date:	05/12/2021
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5280 Parent PID: 4335

General

Start time:	18:56:05
Start date:	05/12/2021
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.VADrHQ3TP0 /tmp/tmp.sw5Tcf2iYj /tmp/tmp.Jn0ReUwJaA
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report HF6zp1MUDf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: HF6zp1MUDf PID: 5212 Parent PID: 5108

General

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5214 Parent PID: 5212

General

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5216 Parent PID: 5214

General

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5218 Parent PID: 5216

General

Chronological Activities

Analysis Process: HF6zp1MUDf PID: 5219 Parent PID: 5216

General

Chronological Activities

Analysis Process: dash PID: 5280 Parent PID: 4335

General

Chronological Activities

Analysis Process: rm PID: 5280 Parent PID: 4335

General

Chronological Activities