Edit tour

Linux Analysis Report
qaE0C9rclb

Overview

General Information

Sample Name:	qaE0C9rclb
Analysis ID:	627354
MD5:	9b1d28d27fa3aceb10eeb48c36300918
SHA1:	b2878f13356c86ac4d58d4c55aa3a4e2e949b823
SHA256:	183ebfeaed6f3dfcaad2f5597ab7a5d533eaab93d0ec96b8b631e123ecc2cb20
Tags:	32armelfgafgyt
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Opens /proc/net/* files useful for finding connected devices and routers

Sample tries to kill multiple processes (SIGKILL)

Executes the "wget" command typically used for HTTP/S downloading

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "uname" command used to read OS and architecture name

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample tries to kill a process (SIGKILL)

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	627354
Start date and time: 16/05/202213:47:13	2022-05-16 13:47:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	qaE0C9rclb
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal72.spre.lin@0/3@0/0

Runtime Messages

Command:	/tmp/qaE0C9rclb
PID:	6265
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	feakofOSKGKriogrjsadfgioayhthinaehnie
Standard Error:

Process Tree

system is lnxubuntu20

python3.8 New Fork (PID: 6219, Parent: 6206)

uname (PID: 6219, Parent: 6206, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -p

dash New Fork (PID: 6221, Parent: 6220)

cut (PID: 6221, Parent: 6220, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -40 /tmp/tmp.mTOD2QG5x0

dash New Fork (PID: 6222, Parent: 6220)

tr (PID: 6222, Parent: 6220, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -c -d [:alnum:]

dash New Fork (PID: 6223, Parent: 6189)

wget (PID: 6223, Parent: 6189, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com

dash New Fork (PID: 6224, Parent: 6189)

cat (PID: 6224, Parent: 6189, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.nTMfcJscKR

dash New Fork (PID: 6225, Parent: 6189)

head (PID: 6225, Parent: 6189, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6226, Parent: 6189)

tr (PID: 6226, Parent: 6189, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6227, Parent: 6189)

cut (PID: 6227, Parent: 6189, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6229, Parent: 6189)

cat (PID: 6229, Parent: 6189, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.nTMfcJscKR

dash New Fork (PID: 6230, Parent: 6189)

head (PID: 6230, Parent: 6189, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6231, Parent: 6189)

tr (PID: 6231, Parent: 6189, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6232, Parent: 6189)

cut (PID: 6232, Parent: 6189, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6233, Parent: 6189)

rm (PID: 6233, Parent: 6189, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.nTMfcJscKR /tmp/tmp.mGz6KxBjf0 /tmp/tmp.mTOD2QG5x0

qaE0C9rclb (PID: 6265, Parent: 6127, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/qaE0C9rclb

qaE0C9rclb New Fork (PID: 6267, Parent: 6265)

qaE0C9rclb New Fork (PID: 6268, Parent: 6265)

qaE0C9rclb New Fork (PID: 6271, Parent: 6268)

qaE0C9rclb New Fork (PID: 6273, Parent: 6271)

qaE0C9rclb New Fork (PID: 6274, Parent: 6271)

gnome-session-binary New Fork (PID: 6279, Parent: 1477)

sh (PID: 6279, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6279, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

xfce4-session New Fork (PID: 6295, Parent: 1900)

xfdesktop (PID: 6295, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-panel New Fork (PID: 6302, Parent: 2063)

wrapper-2.0 (PID: 6302, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6303, Parent: 2063)

xfce4-panel New Fork (PID: 6304, Parent: 2063)

wrapper-2.0 (PID: 6304, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6305, Parent: 2063)

wrapper-2.0 (PID: 6305, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-session New Fork (PID: 6306, Parent: 1900)

xfdesktop (PID: 6306, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-panel New Fork (PID: 6307, Parent: 2063)

wrapper-2.0 (PID: 6307, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6308, Parent: 2063)

wrapper-2.0 (PID: 6308, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

xfce4-session New Fork (PID: 6309, Parent: 1900)

xfdesktop (PID: 6309, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6310, Parent: 1900)

xfdesktop (PID: 6310, Parent: 1900, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542

xfce4-session New Fork (PID: 6311, Parent: 1900)

cleanup

Snort Signatures

ETPRO TROJAN ELF/BASHLITE Variant CnC Checkin M2 - Source IP: 192.168.2.23 - Destination IP: 103.136.41.110

Timestamp:	192.168.2.23103.136.41.1104348065252839491 05/16/22-13:48:03.425976
SID:	2839491
Source Port:	43480
Destination Port:	6525
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qaE0C9rclb

Avira: detected

Multi AV Scanner detection for submitted file

Source: qaE0C9rclb	Virustotal: Detection: 61%	Perma Link
Source: qaE0C9rclb	Metadefender: Detection: 40%	Perma Link
Source: qaE0C9rclb	ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/qaE0C9rclb (PID: 6265)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2839491 ETPRO TROJAN ELF/BASHLITE Variant CnC Checkin M2 192.168.2.23:43480 -> 103.136.41.110:6525

Source: /usr/bin/dash (PID: 6223)

Wget executable: /usr/bin/wget -> wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:43480 -> 103.136.41.110:6525

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.41.110

Source: qaE0C9rclb	String found in binary or memory: http://%d.%d.%d.%d/perc.sh;
Source: tmp.mGz6KxBjf0.8.dr	String found in binary or memory: https://motd.ubuntu.com/
Source: motd-news.23.dr, tmp.nTMfcJscKR.8.dr	String found in binary or memory: https://ubuntu.com/blog/microk8s-memory-optimisation

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6303, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6304, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6305, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6307, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6308, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6309, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6310, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6311, result: successful	Jump to behavior

Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2074, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6303, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6304, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6305, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6307, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6308, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6309, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6310, result: successful	Jump to behavior
Source: /tmp/qaE0C9rclb (PID: 6274)	SIGKILL sent: pid: 6311, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: 232323var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdwatchdoganko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/srv/var/run/sbin/etc/home/Davincitelnetssh/var/spool/var/Sofiasshdbashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app/percpercx86percmpslpercarmpercm68kpercshpercmipsxeightysixmixedroutersmixeddvreverysinglebinarylol.i586i486x86i686mipsmpslsh4superhppcpowerpcspcsparcarmUser-Agent:miori/proc/self/exe/proc/net/route/etc/rc.d/rc.local/bin/shInfectedByLayer/proc/net/tcp/etc/rc.confNfxx1aju1DOS BOT KILLING PID:Cron/dev/nullUPX!topZeuspstreepmappsMozillakillpkillpidofpwdidhtop/./proc//execrondosbot/status(deleted)/Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Sa

Source: classification engine

Classification label: mal72.spre.lin@0/3@0/0

Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ELF static info symbol of initial sample	FILE: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /usr/bin/dash (PID: 6223)

Jump to behavior

Source: /usr/bin/dash (PID: 6233)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.nTMfcJscKR /tmp/tmp.mGz6KxBjf0 /tmp/tmp.mTOD2QG5x0

Jump to behavior

Source: /tmp/qaE0C9rclb (PID: 6265)

Queries kernel information via 'uname':

Jump to behavior

Source: qaE0C9rclb, 6265.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp, qaE0C9rclb, 6267.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp, qaE0C9rclb, 6268.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp, qaE0C9rclb, 6273.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp	Binary or memory string: Kx86_64/usr/bin/qemu-arm/tmp/qaE0C9rclbSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/qaE0C9rclb
Source: qaE0C9rclb, 6265.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp, qaE0C9rclb, 6267.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp, qaE0C9rclb, 6268.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp, qaE0C9rclb, 6273.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp	Binary or memory string: QV!/etc/qemu-binfmt/arm
Source: qaE0C9rclb, 6265.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp, qaE0C9rclb, 6267.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp, qaE0C9rclb, 6268.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp, qaE0C9rclb, 6273.1.00000000a780a5d4.00000000ecc72b10.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: qaE0C9rclb, 6265.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp, qaE0C9rclb, 6267.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp, qaE0C9rclb, 6268.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp, qaE0C9rclb, 6273.1.0000000070bb1ca7.00000000e75bceee.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: /usr/bin/python3.8 (PID: 6219)

Uname executable: /usr/bin/uname -> uname -p

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
qaE0C9rclb	61%	Virustotal		Browse
qaE0C9rclb	40%	Metadefender		Browse
qaE0C9rclb	66%	ReversingLabs	Linux.Trojan.Gafgyt
qaE0C9rclb	100%	Avira	LINUX/Gafgyt.opnd

Source	Detection	Scanner	Label	Link
http://%d.%d.%d.%d/perc.sh;	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://motd.ubuntu.com/	tmp.mGz6KxBjf0.8.dr	false		high
http://%d.%d.%d.%d/perc.sh;	qaE0C9rclb	false	Avira URL Cloud: safe	low
https://ubuntu.com/blog/microk8s-memory-optimisation	motd-news.23.dr, tmp.nTMfcJscKR.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.136.41.110	unknown	India	139884	AGPL-AS-APApeironGlobalPvtLtdIN	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
103.136.41.110	PpcvaRE8wF	Get hash	malicious	Browse
	aPll2HI0vq	Get hash	malicious	Browse
	QQ7EA6NtnR	Get hash	malicious	Browse
	GXUKKZ7Qnf	Get hash	malicious	Browse
	tJ9TlGLj1K	Get hash	malicious	Browse
	ixOTaOEDIW	Get hash	malicious	Browse
	OCrSf4L4AH	Get hash	malicious	Browse
	HvIio1rY75	Get hash	malicious	Browse
	nQ9DQ8dyp9	Get hash	malicious	Browse
	fJoJrFsRDU	Get hash	malicious	Browse
	1U7K4ZoysU	Get hash	malicious	Browse
	2OudwAz06p	Get hash	malicious	Browse
	LmbPIbBJtG	Get hash	malicious	Browse
	muwVjbx43u	Get hash	malicious	Browse
	6mgPR0Wyq7	Get hash	malicious	Browse
	pLYNr2qjHV	Get hash	malicious	Browse
	bwUj1FMbJ6	Get hash	malicious	Browse
	wZwjwmeeGW	Get hash	malicious	Browse
	6zl1VArwOv	Get hash	malicious	Browse
109.202.202.202	fxlJlYCE4I	Get hash	malicious	Browse
	rW2vFLB6Jy	Get hash	malicious	Browse
	UnHAnaAW.arm5	Get hash	malicious	Browse
	n9eApCavgK	Get hash	malicious	Browse
	rrmc88FRmf	Get hash	malicious	Browse
	X66tU1iptI	Get hash	malicious	Browse
	lWfQlkujqz	Get hash	malicious	Browse
	X8hY1BGn3d	Get hash	malicious	Browse
	r5Ns1m235y	Get hash	malicious	Browse
	T6Sv400TfW	Get hash	malicious	Browse
	tUOen8R3jC	Get hash	malicious	Browse
	X2jhhXiaJf	Get hash	malicious	Browse
	SaIN1z8B7X	Get hash	malicious	Browse
	TSL33T.arm5	Get hash	malicious	Browse
	ZG9zarm7	Get hash	malicious	Browse
	ZG9zarm	Get hash	malicious	Browse
	wMZjd2tXuZ	Get hash	malicious	Browse
	Anti.arm5	Get hash	malicious	Browse
	lgvIcn4KKz	Get hash	malicious	Browse
	UepjqejcO9	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AGPL-AS-APApeironGlobalPvtLtdIN	EG4I1Przgq	Get hash	malicious	Browse	103.136.40.176
	j0Ee2pkXcH	Get hash	malicious	Browse	103.136.40.176
	1Ggdi0m8hf	Get hash	malicious	Browse	103.136.40.176
	PpcvaRE8wF	Get hash	malicious	Browse	103.136.41.110
	aPll2HI0vq	Get hash	malicious	Browse	103.136.41.110
	QQ7EA6NtnR	Get hash	malicious	Browse	103.136.41.110
	Iitoq5GM0G.exe	Get hash	malicious	Browse	103.136.40.167
	GXUKKZ7Qnf	Get hash	malicious	Browse	103.136.41.110
	tJ9TlGLj1K	Get hash	malicious	Browse	103.136.41.110
	ixOTaOEDIW	Get hash	malicious	Browse	103.136.41.110
	OCrSf4L4AH	Get hash	malicious	Browse	103.136.41.110
	HvIio1rY75	Get hash	malicious	Browse	103.136.41.110
	nQ9DQ8dyp9	Get hash	malicious	Browse	103.136.41.110
	fJoJrFsRDU	Get hash	malicious	Browse	103.136.41.110
	1U7K4ZoysU	Get hash	malicious	Browse	103.136.41.110
	2OudwAz06p	Get hash	malicious	Browse	103.136.41.110
	LmbPIbBJtG	Get hash	malicious	Browse	103.136.41.110
	muwVjbx43u	Get hash	malicious	Browse	103.136.41.110
	6mgPR0Wyq7	Get hash	malicious	Browse	103.136.41.110
	pLYNr2qjHV	Get hash	malicious	Browse	103.136.41.110
INIT7CH	fxlJlYCE4I	Get hash	malicious	Browse	109.202.202.202
	rW2vFLB6Jy	Get hash	malicious	Browse	109.202.202.202
	UnHAnaAW.arm5	Get hash	malicious	Browse	109.202.202.202
	n9eApCavgK	Get hash	malicious	Browse	109.202.202.202
	rrmc88FRmf	Get hash	malicious	Browse	109.202.202.202
	X66tU1iptI	Get hash	malicious	Browse	109.202.202.202
	lWfQlkujqz	Get hash	malicious	Browse	109.202.202.202
	X8hY1BGn3d	Get hash	malicious	Browse	109.202.202.202
	r5Ns1m235y	Get hash	malicious	Browse	109.202.202.202
	T6Sv400TfW	Get hash	malicious	Browse	109.202.202.202
	tUOen8R3jC	Get hash	malicious	Browse	109.202.202.202
	X2jhhXiaJf	Get hash	malicious	Browse	109.202.202.202
	SaIN1z8B7X	Get hash	malicious	Browse	109.202.202.202
	TSL33T.arm5	Get hash	malicious	Browse	109.202.202.202
	ZG9zarm7	Get hash	malicious	Browse	109.202.202.202
	ZG9zarm	Get hash	malicious	Browse	109.202.202.202
	wMZjd2tXuZ	Get hash	malicious	Browse	109.202.202.202
	Anti.arm5	Get hash	malicious	Browse	109.202.202.202
	lgvIcn4KKz	Get hash	malicious	Browse	109.202.202.202
	UepjqejcO9	Get hash	malicious	Browse	109.202.202.202

Process:	/usr/bin/wget
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	493
Entropy (8bit):	4.946153031557121
Encrypted:	false
SSDEEP:	6:HXBmKwR0AYLEHKLG13/3xg7F/uZCHKLGZgM/Tt5RhgZDl7jzisnf20WcmVa4kpa5:HRmKk0TL6OM48QTt5Rh0isO0WcmqzG
MD5:	815D5C679F88240D85E8673BF876E5A7
SHA1:	5FA149C870B41AB9835E05750EB505FD2032E13D
SHA-256:	D779CFDD164E1AE3EE17D28794E949584A468469C490900981A32D074C029491
SHA-512:	D6E3317D12D1B32EEAA955B8AABD1CF6282B3307397BCA1794787CA4C02894C2CEE30AD0F629F22CDE47BACCF9F92253D5B1AC04DBAB54AD9DA5A2460FE557A8
Malicious:	false
Reputation:	low
Preview:	--2022-05-16 13:47:48-- https://motd.ubuntu.com/.Resolving motd.ubuntu.com (motd.ubuntu.com)... 54.171.230.55, 34.249.145.219, 2a05:d018:91c:3200:2846:99fb:81b6:1e11, ....Connecting to motd.ubuntu.com (motd.ubuntu.com)\|54.171.230.55\|:443... connected..HTTP request sent, awaiting response... 200 OK.Length: 191 [text/plain].Saving to: .STDOUT... 0K 100% 103K=0.002s..2022-05-16 13:47:49 (103 KB/s) - written to stdout [191/191]..

/tmp/tmp.nTMfcJscKR

Download File

Process:	/usr/bin/wget
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.515771857099866
Encrypted:	false
SSDEEP:	3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
MD5:	DD514F892B5F93ED615D366E58AC58AF
SHA1:	BA75EDB3C2232CC260BC187F604DC8F25AA72C11
SHA-256:	F40D0DCE6E83DF74109FEF5E68E51CC255727783EEAE04C3E34677E23F7552CF
SHA-512:	9150BDE63F6C4850C5340D8877892B4D9BBF9EBDC98CDCF557A93FA304C1222CEE446418F5BE2ACCDBF38393778AFA5D4F3EDCB37A47BF57D3A4B2DEAD42A2D0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	* Super-optimized for small spaces - read how we shrank the memory. footprint of MicroK8s to make it the smallest full K8s around... https://ubuntu.com/blog/microk8s-memory-optimisation.

/var/cache/motd-news

Download File

Process:	/usr/bin/cut
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.515771857099866
Encrypted:	false
SSDEEP:	3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
MD5:	DD514F892B5F93ED615D366E58AC58AF
SHA1:	BA75EDB3C2232CC260BC187F604DC8F25AA72C11
SHA-256:	F40D0DCE6E83DF74109FEF5E68E51CC255727783EEAE04C3E34677E23F7552CF
SHA-512:	9150BDE63F6C4850C5340D8877892B4D9BBF9EBDC98CDCF557A93FA304C1222CEE446418F5BE2ACCDBF38393778AFA5D4F3EDCB37A47BF57D3A4B2DEAD42A2D0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	* Super-optimized for small spaces - read how we shrank the memory. footprint of MicroK8s to make it the smallest full K8s around... https://ubuntu.com/blog/microk8s-memory-optimisation.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.985274320223549
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	qaE0C9rclb
File size:	143545
MD5:	9b1d28d27fa3aceb10eeb48c36300918
SHA1:	b2878f13356c86ac4d58d4c55aa3a4e2e949b823
SHA256:	183ebfeaed6f3dfcaad2f5597ab7a5d533eaab93d0ec96b8b631e123ecc2cb20
SHA512:	eb3daf8d7e76b20c0a583c2b6d49a8ca779dd9d64ea68c93864a6fc85be2afefd8d37c28254b80e0bad182dafa4030b1f3b9bdb3a9a1068de3034cbdf2866f51
SSDEEP:	3072:RwP9OjMAj5d4IopuCaAO5CrlgBiZMMhBuswu4zzyL5IimwPQdFRCzNx:OPF878RaAiCrlJusN4zUIimwPQdFRCzv
TLSH:	BFE32905E551471BC2D227BEFB9E429D33232F68939B33255A347BB81BE1BAC1D39121
File Content Preview:	.ELF..............(.........4...........4. ...(........pL...L...L...................................\...\...............\...\...\........u..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	108700
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x15f5c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1e02c	0x1602c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1e040	0x16040	0x28f4	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x20934	0x18934	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x2094c	0x1894c	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2895c	0x1895c	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x28960	0x18960	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x28964	0x18964	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x28968	0x18968	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2896c	0x1896c	0x7c	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x289e8	0x189e8	0x34c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x28d38	0x18d34	0x71cc	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x18d34	0xda8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x19ae0	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x19bc0	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1a070	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1a0fc	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1a754	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1a7ac	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a7bc	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1ac5c	0x5680	0x10	0x0		23	741	4
.strtab	STRTAB	0x0	0x202dc	0x2ddd	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1894c	0x2094c	0x2094c	0x10	0x10	0.8750	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1895c	0x1895c	3.4876	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1895c	0x2895c	0x2895c	0x3d8	0x75a8	2.2002	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1e02c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1e040	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x20934	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x2094c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2895c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x28960	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x28964	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x28968	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2896c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x289e8	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x28d38	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1e02c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1e038	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x900c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x915c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb27c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1053c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1144c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1284c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1315c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1472c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1511c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1643c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1647c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1687c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1772c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1835c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1839c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a19c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a93c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b024	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d11c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28964	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28960	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x289ec	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28d54	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x289f0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x8bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9008	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x914c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9d54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28aa4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x9e9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa0cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5f4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xb278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb87c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbcfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf57c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1052c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28ad4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x112ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28ad8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x28ae0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x12c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f880	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1306c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28b1c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x28ae8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1f898	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x133cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28c24	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x147f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28c28	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x15bd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16590	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28c40	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x16644	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28c58	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x28cf0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x16958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16abc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x204c4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16da0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28d04	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x16f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1760c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17728	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1789c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28d1c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x17ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28d28	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x184bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2ef88	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x184e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18888	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20868	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19c0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a04c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a194	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a7c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b01c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c95c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d3e8	0	NOTYPE	<unknown>	DEFAULT	2
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x1f880	24	OBJECT	<unknown>	DEFAULT	4
C.129.5452	.symtab	0x1eaac	20	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x28d58	4	OBJECT	<unknown>	DEFAULT	13
KHserverHACKER	.symtab	0x28ac4	4	OBJECT	<unknown>	DEFAULT	12
LOCAL_ADDR	.symtab	0x2efb4	4	OBJECT	<unknown>	DEFAULT	13
Laligned	.symtab	0x145a8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x145c4	0	NOTYPE	<unknown>	DEFAULT	2
Percocet_bp	.symtab	0x28ab4	4	OBJECT	<unknown>	DEFAULT	12
Q	.symtab	0x28d74	16384	OBJECT	<unknown>	DEFAULT	13
TotalKilled	.symtab	0x2efb8	4	OBJECT	<unknown>	DEFAULT	13
TotalSaved	.symtab	0x2f9f0	4	OBJECT	<unknown>	DEFAULT	13
UpdateBins	.symtab	0xdb7c	228	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x28ab8	12	OBJECT	<unknown>	DEFAULT	12
_Exit	.symtab	0x12a74	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2896c	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x28ad8	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1f280	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x28d28	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x20550	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x28ae0	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1f580	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2895c	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2895c	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x28ad8	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x28d28	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x28ae0	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x28adc	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x28d2c	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x28ae4	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0x12fd8	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x12980	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1a070	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x149f0	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x184d0	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x12914	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x150d4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x150f8	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x150b0	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x17770	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x17840	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x14a38	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x12a74	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1647c	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x16bac	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1afd8	76	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x17edc	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x12ad8	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x12b3c	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x18814	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x18848	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x184ec	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x14d68	56	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x125e0	52	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2ef88	4	OBJECT	<unknown>	HIDDEN	13
__GI_execl	.symtab	0x17630	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x17e38	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x16da8	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x189b8	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x12914	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x19e64	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x19b44	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1a070	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x19c20	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1a19c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x18b6c	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x12754	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x143f8	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1b174	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1b198	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x17fec	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x14430	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1a070	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x12880	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x17f44	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x12740	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x180b0	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x14ce4	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x14d00	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1ad00	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1ca88	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1cdb4	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x17ea0	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x126bc	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x17f10	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x14da0	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x128e0	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x17ec8	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2ef8c	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0x14c6c	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x14c5c	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x14cbc	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1ac08	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1b938	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1b5d8	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x16ac8	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x12a20	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x14bbc	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x128ac	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x17e6c	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1ce84	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1a6e0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x14610	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1a6d0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1aab8	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1a93c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x144e0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x17cdc	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1835c	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x182f4	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x18328	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x14c9c	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x14c8c	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x12628	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x12d04	172	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x12688	52	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1cd80	52	FUNC	<unknown>	HIDDEN	2
__GI_printf	.symtab	0x13028	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x14f84	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x165bc	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x16960	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1a88c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1284c	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x12e48	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x183e4	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x12818	52	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x14e1c	56	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x14e54	60	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x18044	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x127d8	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x14e90	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x14ec8	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x14f08	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1687c	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x17d64	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x14fa0	68	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x14fe4	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x14ff8	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x12aa0	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x16e60	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x14f4c	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x13074	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x169f0	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1ce2c	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1d384	108	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x14b38	132	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x147f8	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x14900	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1aadc	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x145f0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x145f0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x14820	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1a848	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1cee8	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x14580	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x14844	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1472c	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1abc8	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1aa68	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1aa1c	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x14630	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x14a08	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1a7d0	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x16bcc	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x17058	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x14be0	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x126d0	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1839c	20	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x12b0c	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1d350	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x125a0	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x132fc	228	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x130a8	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x17e04	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x12788	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x18890	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x18908	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x188e4	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x129ec	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x28968	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x28968	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x1d5ec	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1df48	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1df48	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1df2c	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1dfd8	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1d5ec	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1df60	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1dfa8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1dfc0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1df90	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1df78	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1dc8c	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1d9fc	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1d5e0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1d5e8	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1d948	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1d920	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1d49c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1d5c8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1d99c	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1d8fc	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x12474	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12570	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1d988	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1b024	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x1b028	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x1b02c	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2ef80	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x28d04	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x2ff04	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x28d34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x28d34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x177ec	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1c9a4	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x1dea8	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x28adc	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x28d2c	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x28ae4	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x2ef90	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x289e8	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x1bbbc	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1d008	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x17dfc	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x17df0	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x12588	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1dc8c	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1d49c	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1bcb4	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x28964	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x289e8	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x1d3f0	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1cf1c	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1d0bc	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2ff04	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2ef78	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x1dea8	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x12fd8	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x125dc	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x2095c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x2094c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2ef70	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x1d948	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x12980	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1a070	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x28968	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x28964	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x1dfd8	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1d99c	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1d920	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1d988	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1d8fc	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x28960	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x1de98	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1ca3c	76	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x17f58	148	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1b030	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x17ea0	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x149f0	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x1de98	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x184d0	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x28964	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x28960	0	NOTYPE	<unknown>	HIDDEN	8
__ledf2	.symtab	0x1dea0	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x12ad8	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x14d68	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x12914	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x12754	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x17e6c	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1ce84	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x18328	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x12628	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1284c	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x14e1c	56	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x14e54	60	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x127d8	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x14e90	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x14ec8	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x17d64	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2ef74	4	OBJECT	<unknown>	DEFAULT	13
__libc_system	.symtab	0x17b80	348	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x12788	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x129ec	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x20914	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1dea0	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1604c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1511c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x28c28	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x2fb70	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0x15f9c	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1d9fc	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2fef8	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x2fefc	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x1dea8	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x1d11c	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1c548	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2ef7c	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x28960	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x28960	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x28d20	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x28d24	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x17734	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1772c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1772c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1772c	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1772c	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1d14c	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2fef0	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x28d33	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x2ef98	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x28d32	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x2ef84	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x2fef4	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x2ff00	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x150d4	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x150f8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x150b0	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x28b28	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1b2e8	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x18b8c	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1b340	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x18f48	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x131c4	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x1f898	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x1b404	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1b4cc	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1b434	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x19088	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x132cc	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x28b2c	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x1d5e8	788	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x17d44	32	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x183b0	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x17770	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x17840	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x178ac	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x28d1c	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0x12474	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x125a0	64	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x14a38	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x18190	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x180c4	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x1823c	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2ed90	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x2ff04	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x133e0	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2fb18	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x2fb40	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x28c24	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x1afa0	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2fee8	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x2feec	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x28d34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2ff04	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2ef88	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0x12a74	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1e02c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2cd90	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x13434	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x19350	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2ef8c	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x19158	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1a240	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x13ba0	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x13e88	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x13c40	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x13c84	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x13e34	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x17744	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1773c	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2fb68	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x18c40	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1315c	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x28b30	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x28ae8	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x19cdc	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2cd8c	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x28b00	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x2cd88	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x28b34	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0x131f8	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x28b18	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x16be8	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x191c8	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1f968	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x191f4	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x134b8	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1647c	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x127a4	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_entry	.symtab	0x1144c	140	FUNC	<unknown>	DEFAULT	2
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x16bac	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x16bac	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x145e0	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2ef6c	4	OBJECT	<unknown>	DEFAULT	13
brk	.symtab	0x1afd8	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x14ff8	184	FUNC	<unknown>	DEFAULT	2
buf.5444	.symtab	0x2eda0	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0x14620	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x28acc	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x15ab4	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x81ec	216	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x82c4	424	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x846c	424	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x12ff4	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x17edc	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x12ad8	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x12b3c	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.4959	.symtab	0x28d38	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0x14d68	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0xb880	628	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xbd00	340	FUNC	<unknown>	DEFAULT	2
current_protect_values	.symtab	0x2f7c4	4	OBJECT	<unknown>	DEFAULT	13
data_start	.symtab	0x289ec	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x125e0	52	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2ef78	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x2ef88	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x17630	172	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x17e38	52	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x16da8	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x20868	72	OBJECT	<unknown>	DEFAULT	4
exploit_pid	.symtab	0x2f9e8	4	OBJECT	<unknown>	DEFAULT	13
fclose	.symtab	0x189b8	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x12914	108	FUNC	<unknown>	DEFAULT	2
fd	.symtab	0x2f7c0	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x12c34	208	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0xb124	212	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x2cd74	4	OBJECT	<unknown>	DEFAULT	13
fdopendir	.symtab	0x12db0	152	FUNC	<unknown>	DEFAULT	2
fdpclose	.symtab	0xaf9c	392	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0xad14	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x19e64	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x19b44	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1a070	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x19c20	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1a19c	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0xbc9c	100	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x20850	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x18b6c	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x12754	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x143f8	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x16200	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1b174	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1b174	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1b198	336	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x17fec	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x14430	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0xfa94	24	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0xb428	104	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0xf7d8	700	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x19b44	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1a070	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x12880	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x17f44	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x12740	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x180b0	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x14ce4	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0x14d00	104	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1ad00	672	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1ca88	760	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x1cdb4	120	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x17ea0	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x126bc	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x12614	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23103.136.41.1104348065252839491 05/16/22-13:48:03.425976	TCP	2839491	ETPRO TROJAN ELF/BASHLITE Variant CnC Checkin M2	43480	6525	192.168.2.23	103.136.41.110

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 16, 2022 13:48:01.602727890 CEST	42836	443	192.168.2.23	91.189.91.43
May 16, 2022 13:48:01.858786106 CEST	42516	80	192.168.2.23	109.202.202.202
May 16, 2022 13:48:03.399888039 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:48:03.425401926 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:48:03.425498009 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:48:03.425976038 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:48:03.451154947 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:48:16.962551117 CEST	43928	443	192.168.2.23	91.189.91.42
May 16, 2022 13:48:24.622867107 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:48:24.622962952 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:48:24.648017883 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:48:24.648152113 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:48:27.202398062 CEST	42836	443	192.168.2.23	91.189.91.43
May 16, 2022 13:48:31.298310995 CEST	42516	80	192.168.2.23	109.202.202.202
May 16, 2022 13:48:57.921916962 CEST	43928	443	192.168.2.23	91.189.91.42
May 16, 2022 13:49:18.401659012 CEST	42836	443	192.168.2.23	91.189.91.43
May 16, 2022 13:49:24.639364004 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:49:24.639550924 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:49:24.664701939 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:49:24.664866924 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:50:24.645951986 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:50:24.646141052 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:50:24.671284914 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:50:24.671468019 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:51:24.662491083 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:51:24.662631989 CEST	43480	6525	192.168.2.23	103.136.41.110
May 16, 2022 13:51:24.687830925 CEST	6525	43480	103.136.41.110	192.168.2.23
May 16, 2022 13:51:24.687983036 CEST	43480	6525	192.168.2.23	103.136.41.110

System Behavior

Analysis Process: python3.8 PID: 6219, Parent PID: 6206

General

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/python3.8
Arguments:	n/a
File size:	5490352 bytes
MD5 hash:	69f442c3e33b5f9a66b722c29ad89435

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/uname
Arguments:	uname -p
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/cut
Arguments:	cut -c -40 /tmp/tmp.mTOD2QG5x0
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/tr
Arguments:	tr -c -d [:alnum:]
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:48
Start date:	16/05/2022
Path:	/usr/bin/wget
Arguments:	wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com
File size:	548568 bytes
MD5 hash:	996940118df7bb2aaa718589d4e95c08

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.nTMfcJscKR
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.nTMfcJscKR
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:47:49
Start date:	16/05/2022
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.nTMfcJscKR /tmp/tmp.mGz6KxBjf0 /tmp/tmp.mTOD2QG5x0
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time:	13:48:02
Start date:	16/05/2022
Path:	/tmp/qaE0C9rclb
Arguments:	/tmp/qaE0C9rclb
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	13:48:02
Start date:	16/05/2022
Path:	/tmp/qaE0C9rclb
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	13:48:02
Start date:	16/05/2022
Path:	/tmp/qaE0C9rclb
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	13:48:02
Start date:	16/05/2022
Path:	/tmp/qaE0C9rclb
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	13:48:02
Start date:	16/05/2022
Path:	/tmp/qaE0C9rclb
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	13:48:02
Start date:	16/05/2022
Path:	/tmp/qaE0C9rclb
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	13:48:03
Start date:	16/05/2022
Path:	/usr/libexec/gnome-session-binary
Arguments:	n/a
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time:	13:48:03
Start date:	16/05/2022
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Start time:	13:48:03
Start date:	16/05/2022
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

Start time:	13:48:03
Start date:	16/05/2022
Path:	/usr/bin/xfce4-panel
Arguments:	n/a
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time:	13:48:03
Start date:	16/05/2022
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time:	13:48:04
Start date:	16/05/2022
Path:	/usr/bin/xfce4-panel
Arguments:	n/a
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/bin/xfce4-panel
Arguments:	n/a
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/bin/xfce4-panel
Arguments:	n/a
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time:	13:48:05
Start date:	16/05/2022
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfce4-panel
Arguments:	n/a
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfce4-panel
Arguments:	n/a
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 29178b886-02e2-48f2-9471-8dbd02206542
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

Start time:	13:48:06
Start date:	16/05/2022
Path:	/usr/bin/xfce4-session
Arguments:	n/a
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	API monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report qaE0C9rclb

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/tmp.mGz6KxBjf0

/tmp/tmp.nTMfcJscKR

/var/cache/motd-news

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: python3.8 PID: 6219, Parent PID: 6206

General

Chronological Activities

Analysis Process: uname PID: 6219, Parent PID: 6206

General

Chronological Activities

Analysis Process: dash PID: 6221, Parent PID: 6220

General

Chronological Activities

Analysis Process: cut PID: 6221, Parent PID: 6220

General

Chronological Activities

Analysis Process: dash PID: 6222, Parent PID: 6220

General

Chronological Activities

Analysis Process: tr PID: 6222, Parent PID: 6220

Linux Analysis Report
qaE0C9rclb