Edit tour

Linux Analysis Report
cayo.arm7.elf

Overview

General Information

Sample name:	cayo.arm7.elf
Analysis ID:	1521418
MD5:	d71764370ef5157a82e4c28805612ed0
SHA1:	3fa10032373ec8cdaeebb0c878ea42c9f90547f9
SHA256:	7acd635448d76f937529575beccb06aae61b45d4abd94e78fc536b446b4e6d85
Tags:	cayoelfuser-NDA0E
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521418
Start date and time:	2024-09-28 10:34:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	cayo.arm7.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: cayo.arm7.elf

Runtime Messages

Command:	/tmp/cayo.arm7.elf
PID:	5487
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5475, Parent: 3633)

rm (PID: 5475, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.H1exLYzdDd /tmp/tmp.F4EIyQ4tQL /tmp/tmp.D3iSmRZF42

dash New Fork (PID: 5476, Parent: 3633)

rm (PID: 5476, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.H1exLYzdDd /tmp/tmp.F4EIyQ4tQL /tmp/tmp.D3iSmRZF42

cayo.arm7.elf (PID: 5487, Parent: 5407, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/cayo.arm7.elf

cayo.arm7.elf New Fork (PID: 5489, Parent: 5487)

cayo.arm7.elf New Fork (PID: 5491, Parent: 5487)

cayo.arm7.elf New Fork (PID: 5493, Parent: 5491)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cayo.arm7.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
cayo.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
cayo.arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7959c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7963c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7968c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7972c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5491.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5491.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7959c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7963c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7968c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7972c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5487.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5487.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7959c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7963c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7968c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7972c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5489.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5489.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7959c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x795ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7963c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79650:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79664:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79678:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7968c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x796f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7972c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: cayo.arm7.elf PID: 5487	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x215e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2172:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2186:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x219a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2212:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2226:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x223a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x224e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2262:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2276:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x228a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x229e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: cayo.arm7.elf PID: 5489	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1583d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15879:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1588d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15905:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15919:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1592d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15941:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15955:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15969:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1597d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15991:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: cayo.arm7.elf PID: 5491	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:34:59.116293+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58802	TCP
2024-09-28T10:35:14.701345+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58804	TCP
2024-09-28T10:35:30.264694+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58806	TCP
2024-09-28T10:35:45.969413+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58808	TCP
2024-09-28T10:36:01.579780+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58810	TCP
2024-09-28T10:36:17.198908+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58812	TCP
2024-09-28T10:36:32.782853+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58814	TCP
2024-09-28T10:36:48.384940+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58816	TCP
2024-09-28T10:37:03.952227+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58818	TCP
2024-09-28T10:37:20.486642+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58820	TCP
2024-09-28T10:37:20.487023+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58820	TCP
2024-09-28T10:37:20.487270+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58820	TCP
2024-09-28T10:37:36.058400+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58822	TCP
2024-09-28T10:37:51.645341+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58824	TCP
2024-09-28T10:38:07.201691+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58826	TCP
2024-09-28T10:38:22.775318+0200	2840516	1	Malware Command and Control Activity Detected	207.244.199.83	8008	192.168.2.14	58828	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cayo.arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: cayo.arm7.elf

ReversingLabs: Detection: 42%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/cayo.arm7.elf (PID: 5487)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58816
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58818
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58812
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58804
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58806
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58802
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58822
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58820
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58814
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58810
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58808
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58824
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58826
Source: Network traffic	Suricata IDS: 2840516 - Severity 1 - ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message : 207.244.199.83:8008 -> 192.168.2.14:58828

Source: global traffic

TCP traffic: 192.168.2.14:58802 -> 207.244.199.83:8008

Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83
Source: unknown	TCP traffic detected without corresponding DNS query: 207.244.199.83

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: cayo.arm7.elf

String found in binary or memory: https://www.gnu.org/software/libc/bugs.html

System Summary

Malicious sample detected (through community Yara rule)

Source: cayo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5491.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5487.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5489.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: cayo.arm7.elf PID: 5487, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: cayo.arm7.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: cayo.arm7.elf PID: 5491, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: cayo.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5491.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5487.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5489.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: cayo.arm7.elf PID: 5487, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: cayo.arm7.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: cayo.arm7.elf PID: 5491, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: /usr/bin/dash (PID: 5475)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.H1exLYzdDd /tmp/tmp.F4EIyQ4tQL /tmp/tmp.D3iSmRZF42			Jump to behavior
Source: /usr/bin/dash (PID: 5476)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.H1exLYzdDd /tmp/tmp.F4EIyQ4tQL /tmp/tmp.D3iSmRZF42			Jump to behavior

Source: /tmp/cayo.arm7.elf (PID: 5487)

Queries kernel information via 'uname':

Jump to behavior

Source: cayo.arm7.elf, 5487.1.00007ffd616f8000.00007ffd61719000.rw-.sdmp, cayo.arm7.elf, 5489.1.00007ffd616f8000.00007ffd61719000.rw-.sdmp, cayo.arm7.elf, 5491.1.00007ffd616f8000.00007ffd61719000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/cayo.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/cayo.arm7.elf
Source: cayo.arm7.elf, 5487.1.000055bd29fd7000.000055bd2a12a000.rw-.sdmp, cayo.arm7.elf, 5489.1.000055bd29fd7000.000055bd2a12a000.rw-.sdmp, cayo.arm7.elf, 5491.1.000055bd29fd7000.000055bd2a12a000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: cayo.arm7.elf, 5487.1.000055bd29fd7000.000055bd2a12a000.rw-.sdmp, cayo.arm7.elf, 5489.1.000055bd29fd7000.000055bd2a12a000.rw-.sdmp, cayo.arm7.elf, 5491.1.000055bd29fd7000.000055bd2a12a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: cayo.arm7.elf, 5487.1.00007ffd616f8000.00007ffd61719000.rw-.sdmp, cayo.arm7.elf, 5489.1.00007ffd616f8000.00007ffd61719000.rw-.sdmp, cayo.arm7.elf, 5491.1.00007ffd616f8000.00007ffd61719000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: cayo.arm7.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: cayo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5491.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5487.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message

Yara detected Gafgyt

Source: Yara match

File source: cayo.arm7.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: cayo.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5491.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5487.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.00007f15b801f000.00007f15b80b3000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cayo.arm7.elf	42%	ReversingLabs	Linux.Backdoor.Gafgyt
cayo.arm7.elf	100%	Avira	EXP/ELF.Agent.N.44

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.gnu.org/software/libc/bugs.html	cayo.arm7.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.244.199.83	unknown	United States		6428	CDMUS	true

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	eWOLEi2hJg.elf	Get hash	malicious	ConnectBack	Browse	162.213.35.24
	SecuriteInfo.com.ELF.FastReverseProxy-D.16458.15476.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	pl.spc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	pl.x86.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	pl.arm5.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	pl.m68.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	pl.mips.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	pl.ppc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	pl.sh4.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	pl.arm4t.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDMUS	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	209.145.55.141
	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	209.145.55.141
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	209.145.56.187
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	209.145.56.187
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	209.145.56.187
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	206.225.9.249
	ExeFile (38).exe	Get hash	malicious	Njrat	Browse	209.145.56.0
	x86.elf	Get hash	malicious	Unknown	Browse	205.242.185.140
	axVz9A9D3U.exe	Get hash	malicious	Unknown	Browse	209.145.48.30
	axVz9A9D3U.exe	Get hash	malicious	Unknown	Browse	209.145.48.30

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, for GNU/Linux 3.2.0, with debug_info, not stripped
Entropy (8bit):	6.00482652412904
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	cayo.arm7.elf
File size:	788'572 bytes
MD5:	d71764370ef5157a82e4c28805612ed0
SHA1:	3fa10032373ec8cdaeebb0c878ea42c9f90547f9
SHA256:	7acd635448d76f937529575beccb06aae61b45d4abd94e78fc536b446b4e6d85
SHA512:	85fc9ef97b58b5866f95699493c62b808b6701bef73f70c3ae0c73b85fe2b512b5a55f8b749bc0a80604c098f6c90fc5bb6fa07abc75f248c7e21ff0dd73c4a0
SSDEEP:	12288:EVYkMxWJUvVE2fx/frBc2W8z0hBlGgpvco3hZK+RrvK:gYDguviqB/0hH1RQOrv
TLSH:	79F45B64F850DF62C9C52576F7AE825833230BBEC3EEB20E551857383B9796B4B3A501
File Content Preview:	.ELF..............(.........4...4.......4. ...(.!. ....p.-...-...-...................................4...4...............8...H...H..(7.............................. ... ................8...H...H......8...........Q.td............................R.td.8...H.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x103c0
Flags:	0x5000400
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	7
Section Header Offset:	787252
Section Header Size:	40
Number of Section Headers:	33
Header String Table Index:	32

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.note.ABI-tag	NOTE	0x10114	0x114	0x20	0x0	0x2	A	0	0	4
.rel.dyn	REL	0x10134	0x134	0x10	0x8	0x2	A	0	0	4
.init	PROGBITS	0x10144	0x144	0xc	0x0	0x6	AX	0	0	4
.iplt	PROGBITS	0x10150	0x150	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x10180	0x180	0x78268	0x0	0x6	AX	0	0	64
.fini	PROGBITS	0x883e8	0x783e8	0x8	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x883f0	0x783f0	0x1a694	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0xa2a84	0x92a84	0x292	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0xa2d18	0x92d18	0x788	0x0	0x82	AL	5	0	4
.eh_frame	PROGBITS	0xa34a0	0x934a0	0x4	0x0	0x2	A	0	0	4
.tdata	PROGBITS	0xa4800	0x93800	0x10	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0xa4810	0x93810	0x28	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0xa4810	0x93810	0x4	0x4	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0xa4814	0x93814	0x4	0x4	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0xa4818	0x93818	0x2598	0x0	0x3	WA	0	0	8
.got	PROGBITS	0xa6db0	0x95db0	0x250	0x4	0x3	WA	0	0	4
.data	PROGBITS	0xa7000	0x96000	0xf28	0x0	0x3	WA	0	0	8
.bss	NOBITS	0xa7f28	0x96f28	0x7358	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x96f28	0x32	0x1	0x30	MS	0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x96f5a	0x39	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x96f98	0x110	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x970a8	0x3c58	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x9ad00	0xcc1	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x9b9c1	0x2010	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x9d9d4	0xe54	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x9e828	0x1559	0x1	0x30	MS	0	0	1
.debug_line_str	PROGBITS	0x0	0x9fd81	0xb0	0x1	0x30	MS	0	0	1
.debug_loclists	PROGBITS	0x0	0x9fe31	0x22d3	0x0	0x0		0	0	1
.debug_rnglists	PROGBITS	0x0	0xa2104	0x127	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xa222c	0x146b0	0x10	0x0		31	3520	4
.strtab	STRTAB	0x0	0xb68dc	0x990d	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xc01e9	0x14a	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x92d18	0xa2d18	0xa2d18	0x788	0x788	5.4296	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x10000	0x10000	0x934a4	0x934a4	6.0825	0x5	R E	0x1000	.note.ABI-tag .rel.dyn .init .iplt .text .fini .rodata .ARM.extab .ARM.exidx .eh_frame
LOAD	0x93800	0xa4800	0xa4800	0x3728	0xaa80	3.7500	0x6	RW	0x1000	.tdata .tbss .init_array .fini_array .data.rel.ro .got .data .bss
NOTE	0x114	0x10114	0x10114	0x20	0x20	1.5613	0x4	R	0x4	.note.ABI-tag
TLS	0x93800	0xa4800	0xa4800	0x10	0x38	2.5778	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x93800	0xa4800	0xa4800	0x2800	0x2800	4.3086	0x4	R	0x1	.tdata .tbss .init_array .fini_array .data.rel.ro .got

Symbols

Name	Section Name	Value	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10114	SECTION	<unknown>	DEFAULT	1
	.symtab	0x10134	SECTION	<unknown>	DEFAULT	2
	.symtab	0x10144	SECTION	<unknown>	DEFAULT	3
	.symtab	0x10150	SECTION	<unknown>	DEFAULT	4
	.symtab	0x10180	SECTION	<unknown>	DEFAULT	5
	.symtab	0x883e8	SECTION	<unknown>	DEFAULT	6
	.symtab	0x883f0	SECTION	<unknown>	DEFAULT	7
	.symtab	0xa2a84	SECTION	<unknown>	DEFAULT	8
	.symtab	0xa2d18	SECTION	<unknown>	DEFAULT	9
	.symtab	0xa34a0	SECTION	<unknown>	DEFAULT	10
	.symtab	0xa4800	SECTION	<unknown>	DEFAULT	11
	.symtab	0xa4810	SECTION	<unknown>	DEFAULT	12
	.symtab	0xa4810	SECTION	<unknown>	DEFAULT	13
	.symtab	0xa4814	SECTION	<unknown>	DEFAULT	14
	.symtab	0xa4818	SECTION	<unknown>	DEFAULT	15
	.symtab	0xa6db0	SECTION	<unknown>	DEFAULT	16
	.symtab	0xa7000	SECTION	<unknown>	DEFAULT	17
	.symtab	0xa7f28	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	SECTION	<unknown>	DEFAULT	26
	.symtab	0x0	SECTION	<unknown>	DEFAULT	27
	.symtab	0x0	SECTION	<unknown>	DEFAULT	28
	.symtab	0x0	SECTION	<unknown>	DEFAULT	29
	.symtab	0x0	FILE	<unknown>	DEFAULT	SHN_ABS
$a	.symtab	0x103c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x10404	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x10144	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x883e8	NOTYPE	<unknown>	DEFAULT	6
$a	.symtab	0x1014c	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x883ec	NOTYPE	<unknown>	DEFAULT	6
$a	.symtab	0x10180	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2be44	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x103a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x87a14	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x103b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x10428	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x10504	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x10898	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x10a04	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x111e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1155c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x115d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x11654	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x11744	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x119c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x11b48	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x121f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x12460	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x12818	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x12eb8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x13484	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x13904	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x13ad0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x13bec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x14204	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x142f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x14424	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x14868	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x159e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x15dc4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x16a6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x16d94	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x17a8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x17ae0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x17fc0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18738	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18a2c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18c40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18e4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18e5c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18e9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x18f4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x191e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x192a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x192cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x195c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x195e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x195f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1961c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19640	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19664	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19688	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x196ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x196d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x196f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19718	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1973c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19760	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19784	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x197b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x197e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x197fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19818	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19834	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19880	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19888	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19950	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19984	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x199c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19b08	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19b30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19b4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19b80	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19bf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19c18	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19c24	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19d50	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19e90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x19ea0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a264	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a280	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a284	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a310	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a3cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a478	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a514	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a7ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a898	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a944	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a978	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a9a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1a9e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1afcc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b010	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b224	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b260	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b320	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b380	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b560	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b578	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b5ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b664	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b6a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b7e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b918	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b934	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b940	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b9c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1b9e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ba08	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ba28	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ba40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ba60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ba78	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ba90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1badc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1baf8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1bb10	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1bb40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1bb58	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1bca8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1bccc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1bdb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1be08	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1be38	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1c254	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1c478	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1c610	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1c6c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1c908	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1cb48	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1cbb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1d294	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1d364	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1d498	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1d668	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1d7b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1dc6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ddb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1e1d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1ea8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1fa9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1fbe0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x1fe3c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x20030	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x20068	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x20104	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x201ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2025c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x205f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x209fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x20b1c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x20c9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2128c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x212d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x21350	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x213a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x21420	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x21854	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x21b0c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x21c40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x21ec4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22098	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22124	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2217c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22538	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22560	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22880	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22900	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x229cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x22d60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2309c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x230e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x23110	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x237dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x237ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x23880	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x23d80	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24360	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x243b8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24438	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24598	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x245f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2461c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24720	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2473c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24c70	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24c90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24cb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24cc8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x24f04	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25088	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25234	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2549c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25544	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x255e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25604	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2560c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2564c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25704	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25744	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25a4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25a8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25b00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25d64	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25da0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25eb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25ef4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x25fbc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26084	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x260c4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2618c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26234	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x262c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26300	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x263f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26444	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2646c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26618	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26804	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26888	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x268c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26988	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x269f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26a0c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26a80	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26aa0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26abc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26b50	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26e90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26ef8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26f40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x26f9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27008	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x270a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x270bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27150	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2721c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x274a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27570	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27590	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x276f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x277c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27898	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27968	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27a40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27b80	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27ba0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27bb4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27bcc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27be0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27be8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27bf4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27d60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27de4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x27fe8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2844c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x28c04	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x28d20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x28e60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x28f68	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2912c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x291d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29384	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x293dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29778	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29af8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29b68	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29c24	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29f3c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x29fe8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a130	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a1cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a204	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a2c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a350	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a3cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a47c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a594	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a6b8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a704	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2a830	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2aaa0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2aca4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2acc0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2acd8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2ae74	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2af7c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2b034	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2b12c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2b1bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2b354	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bd4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bd5c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bd60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bea0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bec4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bf4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2bfa0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c010	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c048	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c0f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c3d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c438	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c578	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c650	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c6a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c6d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c704	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2c73c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2ccbc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2cd00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2cde8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2d2b8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2d370	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2d3a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2d424	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2d7b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x2e9c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x301b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x30ca8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x30cf4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x316ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x31918	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x31b7c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x31bb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x31cfc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x31f28	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3213c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32178	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x321b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x322c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x323a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32450	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x325f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32a74	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32b10	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32ec4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32f4c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x32f9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x33184	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x33284	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x338f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x33a40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x33aa8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x33d44	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x33f30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3405c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x340b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x341f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x347b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x34b6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x34ca4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x34d58	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x34ea0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x34ffc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35104	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35160	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35244	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35298	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35434	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35494	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35588	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3561c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35670	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x356f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x357c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x358e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35960	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x35cf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x36048	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x36088	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x36454	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x367bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3689c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3692c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3694c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x36b08	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x37130	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3718c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x372b8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3739c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x373b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x373cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x373f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3744c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x37bd0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x37f40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38438	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x385c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x385d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38744	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x387b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x387cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x387fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38bb4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38ccc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38d6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38e2c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38e60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38f28	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38fb0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x38fd8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x39110	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x393b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3947c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3975c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3992c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x39934	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x39bf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x39d04	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x39ddc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x39e28	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a0fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a148	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a1c4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a1fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a284	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a2d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a2f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a310	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a330	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a350	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a36c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a508	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a5c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a630	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a6f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a788	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a7d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a810	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a850	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a8a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a920	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3a9e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3b494	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3b4dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3b5d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3b6a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3b898	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3b9a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3bbc4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3bfc8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3bfe8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c3bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c430	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c488	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c518	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c6a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c77c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c850	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c8a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3c998	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3ca14	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3caa4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3cec0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3cf68	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3cfe0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3d6d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3d7c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3d824	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3d8e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3d904	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3d9b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3da30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3db20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3dd20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3dd30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3de20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3deb8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3dfc8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3dfdc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3dff4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3e088	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3e3fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3e420	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3e650	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3ea80	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f018	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f0f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f19c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f344	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f434	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f69c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3f860	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x3fbf8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x40de4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x41b34	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x41cf8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x41e9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x428f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x42d24	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4347c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x435ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x43764	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4381c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x43a8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x43c1c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x44164	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x441a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x441e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x442a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x44420	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x44524	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x445fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x44688	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x446f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x45750	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x45bcc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x45ca4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x45d74	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x45f58	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x45f7c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x46290	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x465cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x46600	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x46614	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x466cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x46768	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4677c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x46814	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x47270	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x47344	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x475cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x47714	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x477b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x47b10	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x47c04	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x47f94	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48010	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48334	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48644	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48664	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48690	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48740	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x48c70	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x492f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x49810	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x49ecc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4a328	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4ae0c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4ba50	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4c7ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4cf2c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4da90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4e1ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4ed74	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4f1b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4f298	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4f36c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4f37c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4f580	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4f610	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fa6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fa88	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fab8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fb60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fd68	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fd8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4fdbc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x4ff88	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x50060	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x507ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x50b58	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x50b7c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x51720	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x51f28	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x52018	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5227c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x522cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x533d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x53e0c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x53e24	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x54298	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x54464	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x54488	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x54a84	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x54c7c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x55790	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x55898	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x558e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5595c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x561f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x56214	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x56244	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x562b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x562bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x56448	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x564ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5655c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x56618	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5679c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x567e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5680c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x568c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x56e78	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x58230	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x587f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x58890	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x58cec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59334	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5942c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x595b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5968c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59788	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x597ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x598ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x598f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59a00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59a34	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59abc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59b30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59bbc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59bf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59c1c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59c58	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59d6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x59ed0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a084	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a1b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a4cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a534	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a624	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a62c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5a9d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5aef4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5af54	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5b084	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5b3a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5b4e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5b63c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5b6b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5b8bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5c228	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5c38c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5c650	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5c7d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d06c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d1b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d2f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d3cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d4a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d560	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d61c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d700	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d708	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d790	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d848	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d8d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d984	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d9ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5d9e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5dc00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5dd50	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5dd8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ddd8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5deac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5dfe4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5e044	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5e094	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5e300	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5e51c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5e994	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ea6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5eb38	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5eb8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ebcc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ebfc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ec60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ec98	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ecdc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5ed20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f06c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f0d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f0fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f1b8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f1c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f1c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f1e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f344	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f3b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f454	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f498	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f4dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f57c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f5bc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f6f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f8dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x5f948	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6015c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6017c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x601d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x602f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6034c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x603dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x604a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x60514	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x606d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x607ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x60afc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x60b6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x60c6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x60e5c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x61af0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x61ba4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x61c60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x61c90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x61d48	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x61d78	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6220c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x622ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x623cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x62784	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x62ce0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x62d64	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x62df0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63394	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63494	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63768	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6388c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x639d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63a78	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63ae4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63cb8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63cf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63f20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x63f90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64070	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x641f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64260	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x642cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x643c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6443c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6459c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64900	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64afc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64b60	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64ce4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64f9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x64fb8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6579c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x657f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x66134	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x66238	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x668e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x66b64	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x66be0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x66c00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x66c50	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x67308	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x67364	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x67664	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x676b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x67fa4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x68040	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x680c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6811c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x681f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x682e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x68458	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6847c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x685ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x689d0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x69c90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6b494	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6c094	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6c11c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6c1cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6c274	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6c32c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6c424	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6ce40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6cfc8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d000	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d080	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d0cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d110	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d140	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d700	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d720	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d88c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d8b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d918	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d958	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6d9e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6daa8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e228	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e2b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e2dc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e35c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e3cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e4a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e4e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e5b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e73c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6e784	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6eb40	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f118	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f12c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f1b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f27c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f3fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f4f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f50c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f598	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f648	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f700	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f7fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f810	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f89c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6f958	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6fa10	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x6fec0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x70558	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7056c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x70604	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x706d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x70890	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x70c5c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x70ce8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x70ff4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71208	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71238	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71580	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x716a0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x716b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71740	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71820	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x718e0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71b54	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71c50	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71c64	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71cf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71dcc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71e74	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71f70	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x71f84	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72010	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x720cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72184	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72454	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72550	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72564	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x725f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x726e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x727a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x728a4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x728b8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72944	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72a00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72afc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72b10	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72b9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72c58	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72ecc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72fc8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x72fdc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x73068	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x73144	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x731ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x73484	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x735d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x743fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x74474	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x746f0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x74bc8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x74d88	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x752c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7539c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7541c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x75590	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x756a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x756c8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x75814	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x758e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x75ab4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x75c48	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x76590	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x766b0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x76b88	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x77528	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x77594	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x775a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7763c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7779c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x77ecc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x77f10	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x77f90	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x77fdc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78490	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78588	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78708	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7872c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x789e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78c14	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78d20	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78ef8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x78f94	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79164	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79340	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7934c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79374	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7939c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x795ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79778	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79888	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x798cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79984	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x799cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79a14	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79ae8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79b2c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79b6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79be4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79c44	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79cd0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79d38	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79dbc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79e34	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79e98	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79ec0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79edc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x79f74	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7a030	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7a304	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7a398	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7a3e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7a708	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7b394	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7b3b4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7b574	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7b6ec	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7b9cc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7c6c0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7c76c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7c834	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7c8f8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7cce0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7d2ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7d2e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7d7e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7d948	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7dc00	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7dda8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7ded4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7dfb8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7e0ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7e174	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7e414	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7e598	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7eb6c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7ec88	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7ed30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7edd8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7f54c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7f5f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7f69c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7f74c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7f7fc	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x7ff30	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x80094	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x812e8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x8139c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81404	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x815d4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81708	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x817ac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81828	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x818a8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81a54	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81aac	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81d64	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x81d9c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x820f4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x821d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x82458	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x82784	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x8282c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x828d8	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x82994	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x836e4	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x83860	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x8399c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x83bf0	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x83f8c	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x84258	NOTYPE	<unknown>	DEFAULT	5
$a	.symtab	0x84330	NOTYPE	<unknown>	DEFAULT	5

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-28T10:34:59.116293+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58802	TCP
2024-09-28T10:35:14.701345+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58804	TCP
2024-09-28T10:35:30.264694+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58806	TCP
2024-09-28T10:35:45.969413+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58808	TCP
2024-09-28T10:36:01.579780+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58810	TCP
2024-09-28T10:36:17.198908+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58812	TCP
2024-09-28T10:36:32.782853+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58814	TCP
2024-09-28T10:36:48.384940+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58816	TCP
2024-09-28T10:37:03.952227+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58818	TCP
2024-09-28T10:37:20.486642+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58820	TCP
2024-09-28T10:37:20.487023+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58820	TCP
2024-09-28T10:37:20.487270+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58820	TCP
2024-09-28T10:37:36.058400+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58822	TCP
2024-09-28T10:37:51.645341+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58824	TCP
2024-09-28T10:38:07.201691+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58826	TCP
2024-09-28T10:38:22.775318+0200	2840516	ETPRO MALWARE ELF/BASHLITE/Mirai Cayosin Variant CnC Server Message	1	207.244.199.83	8008	192.168.2.14	58828	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 10:34:58.480737925 CEST	58802	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:34:58.485534906 CEST	8008	58802	207.244.199.83	192.168.2.14
Sep 28, 2024 10:34:58.485589027 CEST	58802	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:34:58.497376919 CEST	58802	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:34:58.502176046 CEST	8008	58802	207.244.199.83	192.168.2.14
Sep 28, 2024 10:34:59.116292953 CEST	8008	58802	207.244.199.83	192.168.2.14
Sep 28, 2024 10:34:59.116337061 CEST	8008	58802	207.244.199.83	192.168.2.14
Sep 28, 2024 10:34:59.116353035 CEST	8008	58802	207.244.199.83	192.168.2.14
Sep 28, 2024 10:34:59.116509914 CEST	58802	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:34:59.116509914 CEST	58802	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:34:59.116882086 CEST	58802	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:34:59.121648073 CEST	8008	58802	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:14.121840954 CEST	58804	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:14.126771927 CEST	8008	58804	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:14.126831055 CEST	58804	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:14.126862049 CEST	58804	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:14.131645918 CEST	8008	58804	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:14.701344967 CEST	8008	58804	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:14.701497078 CEST	8008	58804	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:14.701570988 CEST	58804	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:14.701606989 CEST	58804	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:14.706391096 CEST	8008	58804	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:29.707577944 CEST	58806	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:29.712891102 CEST	8008	58806	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:29.712995052 CEST	58806	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:29.713104010 CEST	58806	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:29.719073057 CEST	8008	58806	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:30.264693975 CEST	8008	58806	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:30.264791012 CEST	8008	58806	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:30.264842033 CEST	58806	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:30.265070915 CEST	58806	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:30.272295952 CEST	8008	58806	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:45.270272970 CEST	58808	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:45.275083065 CEST	8008	58808	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:45.275166035 CEST	58808	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:45.275198936 CEST	58808	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:45.279930115 CEST	8008	58808	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:45.969413042 CEST	8008	58808	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:45.969501019 CEST	8008	58808	207.244.199.83	192.168.2.14
Sep 28, 2024 10:35:45.969597101 CEST	58808	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:45.969597101 CEST	58808	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:35:45.974525928 CEST	8008	58808	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:00.975408077 CEST	58810	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:00.980278969 CEST	8008	58810	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:00.980365038 CEST	58810	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:00.980432034 CEST	58810	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:00.985187054 CEST	8008	58810	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:01.579780102 CEST	8008	58810	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:01.579895020 CEST	8008	58810	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:01.580030918 CEST	58810	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:01.580332994 CEST	58810	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:01.585139990 CEST	8008	58810	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:16.586436033 CEST	58812	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:16.593077898 CEST	8008	58812	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:16.593169928 CEST	58812	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:16.593235016 CEST	58812	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:16.608135939 CEST	8008	58812	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:17.198908091 CEST	8008	58812	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:17.199012995 CEST	58812	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:17.202373028 CEST	8008	58812	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:17.202476025 CEST	58812	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:17.209482908 CEST	8008	58812	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:32.208365917 CEST	58814	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:32.213340998 CEST	8008	58814	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:32.213433981 CEST	58814	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:32.213470936 CEST	58814	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:32.218358040 CEST	8008	58814	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:32.782852888 CEST	8008	58814	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:32.783168077 CEST	8008	58814	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:32.783183098 CEST	58814	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:32.783356905 CEST	58814	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:32.793525934 CEST	8008	58814	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:47.788492918 CEST	58816	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:47.794121027 CEST	8008	58816	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:47.794239998 CEST	58816	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:47.794239998 CEST	58816	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:47.799875021 CEST	8008	58816	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:48.384939909 CEST	8008	58816	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:48.385050058 CEST	8008	58816	207.244.199.83	192.168.2.14
Sep 28, 2024 10:36:48.385222912 CEST	58816	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:48.385380983 CEST	58816	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:36:48.390110970 CEST	8008	58816	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:03.390449047 CEST	58818	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:03.395701885 CEST	8008	58818	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:03.395766973 CEST	58818	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:03.395796061 CEST	58818	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:03.401083946 CEST	8008	58818	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:03.952227116 CEST	8008	58818	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:03.952336073 CEST	8008	58818	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:03.952510118 CEST	58818	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:03.952510118 CEST	58818	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:03.957323074 CEST	8008	58818	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:18.957360029 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:18.962347984 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:18.962439060 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:18.962493896 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:18.967250109 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:20.486641884 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:20.486675978 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:20.486706972 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:20.486764908 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:20.486764908 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:20.486840010 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:20.487023115 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:20.487085104 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:20.487270117 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:20.487304926 CEST	58820	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:20.491621017 CEST	8008	58820	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:35.491986036 CEST	58822	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:35.497123003 CEST	8008	58822	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:35.497184992 CEST	58822	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:35.497215986 CEST	58822	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:35.501966953 CEST	8008	58822	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:36.058399916 CEST	8008	58822	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:36.058537960 CEST	58822	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:36.058695078 CEST	8008	58822	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:36.058927059 CEST	58822	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:36.063741922 CEST	8008	58822	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:51.064030886 CEST	58824	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:51.069113970 CEST	8008	58824	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:51.069174051 CEST	58824	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:51.069199085 CEST	58824	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:51.074032068 CEST	8008	58824	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:51.645340919 CEST	8008	58824	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:51.645483971 CEST	58824	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:51.645502090 CEST	8008	58824	207.244.199.83	192.168.2.14
Sep 28, 2024 10:37:51.645592928 CEST	58824	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:37:51.650326014 CEST	8008	58824	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:06.651010990 CEST	58826	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:06.655872107 CEST	8008	58826	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:06.655980110 CEST	58826	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:06.656043053 CEST	58826	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:06.661041975 CEST	8008	58826	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:07.201690912 CEST	8008	58826	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:07.201838970 CEST	8008	58826	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:07.201968908 CEST	58826	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:07.202212095 CEST	58826	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:07.206998110 CEST	8008	58826	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:22.208920956 CEST	58828	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:22.213917017 CEST	8008	58828	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:22.214000940 CEST	58828	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:22.214016914 CEST	58828	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:22.218802929 CEST	8008	58828	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:22.775317907 CEST	8008	58828	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:22.775540113 CEST	8008	58828	207.244.199.83	192.168.2.14
Sep 28, 2024 10:38:22.775592089 CEST	58828	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:22.775662899 CEST	58828	8008	192.168.2.14	207.244.199.83
Sep 28, 2024 10:38:22.780405998 CEST	8008	58828	207.244.199.83	192.168.2.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 10:37:43.689174891 CEST	43558	53	192.168.2.14	8.8.8.8
Sep 28, 2024 10:37:43.689244032 CEST	56678	53	192.168.2.14	8.8.8.8
Sep 28, 2024 10:37:43.695311069 CEST	53	43558	8.8.8.8	192.168.2.14
Sep 28, 2024 10:37:43.695518970 CEST	53	56678	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 10:37:43.689174891 CEST	192.168.2.14	8.8.8.8	0x2971	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 10:37:43.689244032 CEST	192.168.2.14	8.8.8.8	0x21ed	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 10:37:43.695311069 CEST	8.8.8.8	192.168.2.14	0x2971	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Sep 28, 2024 10:37:43.695311069 CEST	8.8.8.8	192.168.2.14	0x2971	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 5475, Parent PID: 3633

General

Start time (UTC):	08:34:49
Start date (UTC):	28/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5475, Parent PID: 3633

General

Start time (UTC):	08:34:49
Start date (UTC):	28/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.H1exLYzdDd /tmp/tmp.F4EIyQ4tQL /tmp/tmp.D3iSmRZF42
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5476, Parent PID: 3633

General

Start time (UTC):	08:34:49
Start date (UTC):	28/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5476, Parent PID: 3633

General

Start time (UTC):	08:34:49
Start date (UTC):	28/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.H1exLYzdDd /tmp/tmp.F4EIyQ4tQL /tmp/tmp.D3iSmRZF42
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: cayo.arm7.elf PID: 5487, Parent PID: 5407

General

Start time (UTC):	08:34:57
Start date (UTC):	28/09/2024
Path:	/tmp/cayo.arm7.elf
Arguments:	/tmp/cayo.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: cayo.arm7.elf PID: 5489, Parent PID: 5487

General

Start time (UTC):	08:34:57
Start date (UTC):	28/09/2024
Path:	/tmp/cayo.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: cayo.arm7.elf PID: 5491, Parent PID: 5487

General

Start time (UTC):	08:34:57
Start date (UTC):	28/09/2024
Path:	/tmp/cayo.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: cayo.arm7.elf PID: 5493, Parent PID: 5491

General

Start time (UTC):	08:34:57
Start date (UTC):	28/09/2024
Path:	/tmp/cayo.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report cayo.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 5475, Parent PID: 3633

General

Chronological Activities

Analysis Process: rm PID: 5475, Parent PID: 3633

General

Chronological Activities

Analysis Process: dash PID: 5476, Parent PID: 3633

General

Chronological Activities

Analysis Process: rm PID: 5476, Parent PID: 3633

General

Chronological Activities

Linux Analysis Report
cayo.arm7.elf