Edit tour

Linux Analysis Report
zAHDiOLGpt.elf

Overview

General Information

Sample name:	zAHDiOLGpt.elf renamed because original name is a hash value
Original sample name:	8bd098baae60823f5a755ec7e4f58930.elf
Analysis ID:	1468126
MD5:	8bd098baae60823f5a755ec7e4f58930
SHA1:	80ac12f666aec74dde1bd7d30959cdaea9b73c2c
SHA256:	aa8824db6dd518d79cddaf20586b229d6e82efe9e931aa17c5783d70e9d5a9c8
Tags:	32armelfgafgyt
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1468126
Start date and time:	2024-07-05 11:29:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	zAHDiOLGpt.elf renamed because original name is a hash value
Original Sample Name:	8bd098baae60823f5a755ec7e4f58930.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/zAHDiOLGpt.elf
PID:	6200
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6182, Parent: 4331)

rm (PID: 6182, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8LUeUVlyQW /tmp/tmp.FnIh6cj2bO /tmp/tmp.ka3qk3uxVh

dash New Fork (PID: 6183, Parent: 4331)

rm (PID: 6183, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8LUeUVlyQW /tmp/tmp.FnIh6cj2bO /tmp/tmp.ka3qk3uxVh

zAHDiOLGpt.elf (PID: 6200, Parent: 6115, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/zAHDiOLGpt.elf

zAHDiOLGpt.elf New Fork (PID: 6202, Parent: 6200)

zAHDiOLGpt.elf New Fork (PID: 6204, Parent: 6202)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zAHDiOLGpt.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
zAHDiOLGpt.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6200.1.00007fdbe8017000.00007fdbe8034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6202.1.00007fdbe8017000.00007fdbe8034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Snort Signatures

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:29:45.128925
SID:	2846264
Source Port:	34268
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:15.141154
SID:	2846318
Source Port:	34270
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:33.676072
SID:	2846264
Source Port:	56234
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:12.194685
SID:	2846264
Source Port:	56228
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:32:21.317934
SID:	2846318
Source Port:	34280
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:33:04.401884
SID:	2846318
Source Port:	34284
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:33.676072
SID:	2846318
Source Port:	56234
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:40.228092
SID:	2846264
Source Port:	34272
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:05.447534
SID:	2846318
Source Port:	34274
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:33.652184
SID:	2846318
Source Port:	56230
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:03.663661
SID:	2846264
Source Port:	56232
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:29:45.128925
SID:	2846318
Source Port:	34268
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:12.194685
SID:	2846318
Source Port:	56228
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:32:42.997407
SID:	2846264
Source Port:	34282
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:29.884614
SID:	2846264
Source Port:	34276
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:29:47.165785
SID:	2846264
Source Port:	56226
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:51.305813
SID:	2846318
Source Port:	34278
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:32:21.317934
SID:	2846264
Source Port:	34280
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:03.663661
SID:	2846318
Source Port:	56232
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:15.141154
SID:	2846264
Source Port:	34270
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:33.652184
SID:	2846264
Source Port:	56230
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:32:42.997407
SID:	2846318
Source Port:	34282
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:29.884614
SID:	2846318
Source Port:	34276
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:30:40.228092
SID:	2846318
Source Port:	34272
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:05.447534
SID:	2846264
Source Port:	34274
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/Mirai Variant CnC Activity - Source IP: 192.168.2.13 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:29:47.165785
SID:	2846318
Source Port:	56226
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:31:51.305813
SID:	2846264
Source Port:	34278
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN ELF/DarkNexus Variant CnC Activity - Source IP: 192.168.2.23 - Destination IP: 5.59.248.211

Timestamp:	07/05/24-11:33:04.401884
SID:	2846264
Source Port:	34284
Destination Port:	6982
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zAHDiOLGpt.elf

Avira: detected

Found malware configuration

Source: zAHDiOLGpt.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "5.59.248.211:6982"}

Multi AV Scanner detection for submitted file

Source: zAHDiOLGpt.elf	ReversingLabs: Detection: 63%
Source: zAHDiOLGpt.elf	Virustotal: Detection: 62%			Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/zAHDiOLGpt.elf (PID: 6200)

Opens: /proc/net/route

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.13:56226 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.13:56226 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.13:56228 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.13:56228 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.13:56230 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.13:56230 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.13:56232 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.13:56232 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.13:56234 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.13:56234 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34268 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34268 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34270 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34270 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34272 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34272 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34274 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34274 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34276 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34276 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34278 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34278 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34280 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34280 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34282 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34282 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846264 ETPRO TROJAN ELF/DarkNexus Variant CnC Activity 192.168.2.23:34284 -> 5.59.248.211:6982
Source: Traffic	Snort IDS: 2846318 ETPRO TROJAN ELF/Mirai Variant CnC Activity 192.168.2.23:34284 -> 5.59.248.211:6982

Source: global traffic

TCP traffic: 192.168.2.23:34268 -> 5.59.248.211:6982

Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.194.49
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.248.211

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58948
Source: unknown	Network traffic detected: HTTP traffic on port 58948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: zAHDiOLGpt.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 6182)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8LUeUVlyQW /tmp/tmp.FnIh6cj2bO /tmp/tmp.ka3qk3uxVh			Jump to behavior
Source: /usr/bin/dash (PID: 6183)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8LUeUVlyQW /tmp/tmp.FnIh6cj2bO /tmp/tmp.ka3qk3uxVh			Jump to behavior

Source: /tmp/zAHDiOLGpt.elf (PID: 6200)

Queries kernel information via 'uname':

Jump to behavior

Source: zAHDiOLGpt.elf, 6200.1.00005639c8424000.00005639c8552000.rw-.sdmp, zAHDiOLGpt.elf, 6202.1.00005639c8424000.00005639c8552000.rw-.sdmp	Binary or memory string: 9V!/etc/qemu-binfmt/arm
Source: zAHDiOLGpt.elf, 6200.1.00007ffcde304000.00007ffcde325000.rw-.sdmp, zAHDiOLGpt.elf, 6202.1.00007ffcde304000.00007ffcde325000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/zAHDiOLGpt.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zAHDiOLGpt.elf
Source: zAHDiOLGpt.elf, 6200.1.00005639c8424000.00005639c8552000.rw-.sdmp, zAHDiOLGpt.elf, 6202.1.00005639c8424000.00005639c8552000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: zAHDiOLGpt.elf, 6200.1.00007ffcde304000.00007ffcde325000.rw-.sdmp, zAHDiOLGpt.elf, 6202.1.00007ffcde304000.00007ffcde325000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: zAHDiOLGpt.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: zAHDiOLGpt.elf, type: SAMPLE
Source: Yara match	File source: 6200.1.00007fdbe8017000.00007fdbe8034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6202.1.00007fdbe8017000.00007fdbe8034000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity
Source: Traffic	Snort IDS: ETPRO TROJAN ELF/Mirai Variant CnC Activity

Yara detected Gafgyt

Source: Yara match

File source: zAHDiOLGpt.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: zAHDiOLGpt.elf, type: SAMPLE
Source: Yara match	File source: 6200.1.00007fdbe8017000.00007fdbe8034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6202.1.00007fdbe8017000.00007fdbe8034000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "5.59.248.211:6982"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zAHDiOLGpt.elf	63%	ReversingLabs	Linux.Trojan.Gafgyt
zAHDiOLGpt.elf	62%	Virustotal		Browse
zAHDiOLGpt.elf	100%	Avira	EXP/ELF.Mirai.Z

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
5.59.248.211:6982	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.194.49	unknown	United States	54113	FASTLYUS	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
5.59.248.211	unknown	Czech Republic	50923	METRO-SET-ASMetrosetAutonomousSystemRU	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
151.101.194.49	ELECTRONIC RECEIPT_bpost.be.html	Get hash	malicious	HTMLPhisher	Browse
	G2k1zBLxQT.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	Pt1Xss90eE.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	6uPZGWXA2x.elf	Get hash	malicious	Mirai	Browse
	liIBMdOQ7U.elf	Get hash	malicious	Unknown	Browse
	CnEvVVPgmL.elf	Get hash	malicious	Unknown	Browse
	I4i6z8T1j9j8N5349890049902.zip	Get hash	malicious	Unknown	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:va6c2:b9dfa724-1395-4aee-a0d2-16448fc39e11	Get hash	malicious	Unknown	Browse
	ePt0gXr9X2.elf	Get hash	malicious	Unknown	Browse
	1wfo0yCbI7.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	AezMWH4tiG.elf	Get hash	malicious	Unknown	Browse
	Cs9TFjlT3z.elf	Get hash	malicious	Unknown	Browse
	T3leD4pO2f.elf	Get hash	malicious	Unknown	Browse
	7kWJ4bB86A.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	k7spsJEdGT.elf	Get hash	malicious	Unknown	Browse
	GbY7rLP11G.elf	Get hash	malicious	Unknown	Browse
	MBQFNFUI2w.elf	Get hash	malicious	Unknown	Browse
	GDOzdrSF8s.elf	Get hash	malicious	Unknown	Browse
	bx433EvPSR.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	6s92F3NQsa.elf	Get hash	malicious	Unknown	Browse
5.59.248.211	pySm2HvPnL.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	EkQSLHZFrN.elf	Get hash	malicious	Mirai	Browse
	FECspjRRFi.elf	Get hash	malicious	Mirai	Browse
	fww9qYRaEW.elf	Get hash	malicious	Mirai	Browse
	5kRDDHRHHJ.elf	Get hash	malicious	Unknown	Browse
	vkCwQ9Y16T.elf	Get hash	malicious	Unknown	Browse
	3IWSSh31C6.elf	Get hash	malicious	Mirai	Browse
	BHXBEzLYH4.elf	Get hash	malicious	Mirai	Browse
	SJ5FzASRUv.elf	Get hash	malicious	Mirai	Browse
	cHtOtQF1T0.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	AezMWH4tiG.elf	Get hash	malicious	Unknown	Browse
	Cs9TFjlT3z.elf	Get hash	malicious	Unknown	Browse
	T3leD4pO2f.elf	Get hash	malicious	Unknown	Browse
	7kWJ4bB86A.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	k7spsJEdGT.elf	Get hash	malicious	Unknown	Browse
	GbY7rLP11G.elf	Get hash	malicious	Unknown	Browse
	MBQFNFUI2w.elf	Get hash	malicious	Unknown	Browse
	GDOzdrSF8s.elf	Get hash	malicious	Unknown	Browse
	bx433EvPSR.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	6s92F3NQsa.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	AezMWH4tiG.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Cs9TFjlT3z.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	T3leD4pO2f.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	7kWJ4bB86A.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	k7spsJEdGT.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	2Cn3vPj6IQ.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	GbY7rLP11G.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	huRdsUh0To.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	MBQFNFUI2w.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	GDOzdrSF8s.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
FASTLYUS	http://bootcss.com	Get hash	malicious	Unknown	Browse	151.101.65.229
	http://bootcss.com	Get hash	malicious	Unknown	Browse	151.101.193.229
	https://phisher-parts-production-eu-west-1.s3.eu-west-1.amazonaws.com/ff082dce-b8a1-4a27-8368-a0f5940c3157/2024-07-04/5461g50l9tbjchnpu30tke9ueqbjnia37k8o3fo1/d7b46afb9b92fb581d0de36b79490a8d9bd21f3a7c66d2a62f513a8c9c2d38e8?response-content-disposition=attachment%3B%20filename%3D%22Rwgroup%20Statement%20httpsworker-rough-fire-759a.berwieberwieberwieberwieberwie.workers.deveba%253D.html%22%3B%20filename%2A%3DUTF-8%27%27Rwgroup%2520Statement%2520httpsworker-rough-fire-759a.berwieberwieberwieberwieberwie.workers.deveba%253D.html&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIA37KREM2QIBN6KBZV%2F20240705%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20240705T084740Z&X-Amz-Expires=21148&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAEaCWV1LXdlc3QtMSJGMEQCIHg20UP6zTxrOA5hyalwjLdCJXsYziq49Wa5fD3zG8gLAiBs01dRpb1tWPoUPWJpq0Rdoyt%2F996lvhUXsSQTSpU9%2ByqIBAi6%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDgyMzE5MzI2NTgyNCIM7dc0LdBze1PHujCsKtwDNVQ%2BPm1alHG%2BOhifSoNCk23clHq%2FQFQVWh6XGgi4iQpx0EYjfPPN6uTTtnXM2jqmfWVbPsb6COUACetwgFd%2Fxar8QImJuuBGlzNZwPR34Koo%2BF6328FsvRN2HAjgWZaN3%2B%2FxPgcd1iatfVG%2F8s8GwyuCApKHT7ainePJ0zXqrb%2Fh0Yp%2B6kyJ%2BDkk8ra7a%2FgMytdQU8aXtqn1FkgmdVJVqiZR8Ie%2FZlYs3BZk7JyaL2yBrzTxSXyVWB1O7%2B0THkH%2FpvIsc4HU7Q48E0vPtfzVLeJ6AzGBkwFFXnvnV9oYqvZJLNTLNidMaiKMQf9MPX7I95wp2ma9VM9bVMqmIYXh%2BBv%2FdAlg13%2FSJGTwW19Q%2Fr5NOpdd2SbdeNPpwAVcNI2iQtuymBHV0MGYnzXxwJvO3lkV8NexKVfnlsuTOFhCYU0gupkxCD0zOWKDlTD31bz7UcR4hv%2BiPHff1OZ7P6msEi2dCdpQOtM40tVnpt6Uxh9Jwc1ola4PqlGc00oPed7DadOECj4PbEcxdthckWMcu1aP9P5bpwGrgjs9qFBpwP1iwDKCb2xN2JVCxNT1zSzsxQlzJWpqeyxaSGtvM5VYKgJULcSSP%2BDD4Ntxp7hk3HiqL8zwfsWAK7GEifAw6OKetAY6pgHkE2GbnW6HaWfMrVj6LhnVoweXW4o4Zwr10LCMfNduRa5nsR2hFOp0a0YcQHmIdVC1W6fF5lUPSvVLawqmVCiqwIfz4%2FGfBlqCWRQsN%2B2xfGcJf4ZLz%2FxlT%2BogN%2FMFPcly3KA8%2FlLCWhRnn%2F5hJ5XmX7lQm3SZFKik8gMX2YeUIcd01U9Veng2K8PjBO9QAOn3yVHRrTRD3k67sqoYA3YpuNUQiFxM&X-Amz-SignedHeaders=host&X-Amz-Signature=f7715d80649aa4b136ac0a44dd7da8eb0e33485c1ca9b731b1978a8f5f52b4d8	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://www.bing.com/ck/a?!&&p=1c2e03d92a757c8bJmltdHM9MTcyMDA1MTIwMCZpZ3VpZD0xN2U2ZWM4Ni1jZTFkLTY0ODgtMDE5Yy1mODM0Y2ZkZDY1ZDYmaW5zaWQ9NTMwOQ&ptn=3&ver=2&hsh=3&fclid=17e6ec86-ce1d-6488-019c-f834cfdd65d6&u=a1aHR0cHM6Ly93d3cuZGlyZWl0b2RlbGFzcG9yZWxhcy5jb20uYnIvbXlwYWdlL2xvZ2lu&#ZmluYW5jZUBibHVlcGFwZXIuZXU=	Get hash	malicious	Unknown	Browse	151.101.65.16
	https://free2try.com/?session_id=531dd1e83a5911ef8dd1bff723d6de30	Get hash	malicious	Unknown	Browse	151.101.129.44
	AndroidSideloader (1).exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	https://urlz.fr/r7T9	Get hash	malicious	Unknown	Browse	151.101.192.217
	http://weber-portal.com	Get hash	malicious	Unknown	Browse	151.101.192.114
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	185.199.108.133
	pirates.bat	Get hash	malicious	Kematian Stealer	Browse	185.199.111.133
INIT7CH	AezMWH4tiG.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Cs9TFjlT3z.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	T3leD4pO2f.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	7kWJ4bB86A.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	k7spsJEdGT.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	GbY7rLP11G.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	MBQFNFUI2w.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	GDOzdrSF8s.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	bx433EvPSR.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	6s92F3NQsa.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
METRO-SET-ASMetrosetAutonomousSystemRU	pySm2HvPnL.elf	Get hash	malicious	Mirai, Gafgyt	Browse	5.59.248.211
	95DVgihS4k.elf	Get hash	malicious	Unknown	Browse	37.60.21.200
	Pw6Hh7YeYl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206
	ik8c56mT3o.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206
	e9plT5CDgv.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206
	SdKTQkWdHv.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206
	T5FgKMuX5w.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206
	Lun7rNsvBP.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206
	aklSd5xI61.elf	Get hash	malicious	Mirai, Okiru	Browse	5.59.248.206
	Y2QLIONt9v.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.59.248.206

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.08298211789268
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	zAHDiOLGpt.elf
File size:	180'960 bytes
MD5:	8bd098baae60823f5a755ec7e4f58930
SHA1:	80ac12f666aec74dde1bd7d30959cdaea9b73c2c
SHA256:	aa8824db6dd518d79cddaf20586b229d6e82efe9e931aa17c5783d70e9d5a9c8
SHA512:	476a9f196c6203e7870a009acf4aed405b972ed31bf8e8a17d9689da6c1293acd10c1f944fabb16d66b532812e67bbb0fef69b1dbf661b774a910c43762ff49a
SSDEEP:	3072:9fs8Tmeg7aqtCUtS7Rz91eLZIPTH/jAESeM/9gDnmKwMkZ/CIn:9fsL7aqtCUCRCLZOTH/jAYM/9WmKwMkt
TLSH:	5E043B56D6404E63C1D21676BBEF92863323D7A4D3DB23055A28BBF43F826DB0E67901
File Content Preview:	.ELF..............(.........4....<......4. ...(........p.....K...K.. ... ...........................................................$...Ht..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	146632
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1a344	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x22434	0x1a434	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x22448	0x1a448	0x274c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x24b94	0x1cb94	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x24bac	0x1cbac	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2d000	0x1d000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2d004	0x1d004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2d004	0x1d004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2d008	0x1d008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2d00c	0x1d00c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2d010	0x1d010	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2d0c0	0x1d0c0	0x264	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2d328	0x1d324	0x7120	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1d324	0xd18	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1e040	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1e180	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1e393	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x203d6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x20ab8	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x21930	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x21be8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x224b2	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x23641	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x23b99	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x23baf	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x24150	0x5580	0x10	0x0		28	793	4
.strtab	STRTAB	0x0	0x296d0	0x2c10	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1cbac	0x24bac	0x24bac	0x120	0x120	4.5464	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1cccc	0x1cccc	6.2309	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1d000	0x2d000	0x2d000	0x324	0x7448	4.1801	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1d004	0x2d004	0x2d004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x22434	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x22448	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x24b94	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x24bac	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2d000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2d004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2d004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2d008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2d00c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2d010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2d0c0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2d328	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x22434	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x22440	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9198	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x946c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x96b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbbd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc4e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdeb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfcc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1165c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1449c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1613c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1660c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1842c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1931c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1943c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19df0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b64c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d01c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d34c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1deb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e08c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e21c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fbfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fcb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fdc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fdf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x202ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2049c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x208b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2135c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x213bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x214e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8990	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x96ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x98e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x99f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa59c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc4d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1161c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1345c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d0c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d0c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d104	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d110	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x234a4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x234b0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2d114	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d118	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1400c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1446c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23abc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1483c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1493c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23af4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x153a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d12c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x23afc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15a58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23b80	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15fd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1612c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16178	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1632c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16370	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x163e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1642c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17004	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d130	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1714c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d148	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17bd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17dec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d160	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d1f8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17e94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1840c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d20c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18554	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1917c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1965c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d224	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19c30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a068	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a86c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d234	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2d230	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b41c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x247c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1c334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d014	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d60c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d680	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d92c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1deb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e04c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e8ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f1c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d318	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f2ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d31a	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x24874	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1f790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fb20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fbf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fd10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fd50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fdc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x202a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x211d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x2d11c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x234bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2d124	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x237bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2d31c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x24894	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x24758	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x23abc	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x24764	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x23ad4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x247a0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x2477c	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x24794	12	OBJECT	<unknown>	DEFAULT	4
C.82.6444	.symtab	0x234b0	12	OBJECT	<unknown>	DEFAULT	4
C.85.6479	.symtab	0x234a4	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x24788	12	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0x15b78	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x15b94	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x2d358	16384	OBJECT	<unknown>	DEFAULT	14
SendHTTPHex	.symtab	0x84f8	328	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0x8280	304	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x8640	376	FUNC	<unknown>	DEFAULT	2
SendSTDHEX1	.symtab	0x87b8	236	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0xa5b0	2544	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x14108	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2d010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x20f88	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x20f8c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x21c3c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x20f80	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x20fc4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x21c60	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x22400	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x20fb8	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x21bd0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x21bf4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x21c18	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x20ee8	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x21500	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x20f34	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2d11c	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x234bc	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2d31c	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x24894	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2d124	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x237bc	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2d000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2d000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2d11c	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2d31c	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x2d124	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x192e0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x192c4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2d120	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2d320	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x2d128	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x14820	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x13f7c	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1c6fc	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x15e8c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x192e0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14014	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x19370	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x19490	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x19400	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x19370	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x19354	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x19490	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x19474	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x16630	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x16654	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1660c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x196a8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x19778	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x19400	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x193e4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x15ea4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14108	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x17a08	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x18154	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1d9f0	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x14170	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x192e0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x144cc	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1a6c0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1a6f4	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1a398	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x16180	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x18368	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1a870	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14014	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1c350	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1be40	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1c6fc	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1bf84	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1c828	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1aba0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x18bec	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x15968	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1db9c	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1dbc0	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x19d60	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x159a0	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1c6fc	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x19dc4	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x19df0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x19e04	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x19e18	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x160b0	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x160cc	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1d34c	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1f7f4	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1fb78	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x19e2c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x19050	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x19e54	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x161f4	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x19e8c	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x19ecc	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x16088	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1d254	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1606c	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x15fe0	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1e664	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1e2ec	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x17f70	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x141a8	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1d1b4	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x14474	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14288	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1fd54	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1cd60	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x15a70	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x15a80	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1e08c	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1ce50	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x15a90	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x19bbc	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x19ee0	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x19f24	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x19fa4	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x19370	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x146ac	196	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1fc3c	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x19098	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x17b48	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x17e08	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1e0b0	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x19490	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1a2ac	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x162c4	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1a004	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14304	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x16378	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x16434	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x14388	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x164bc	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x18068	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x19c64	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x16548	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1a070	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x19188	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x16504	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x14840	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x17e98	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1fcb0	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x20240	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x15bb0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1cf30	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x15b30	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x15b30	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x15ca0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1d01c	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1fdc4	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x15b50	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1e160	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x15cc4	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1d174	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1d060	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1d0b0	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x15d90	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x15fb0	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1d0fc	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x18174	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x18578	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1d1d8	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x143c8	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1449c	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1fd14	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x14874	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1a0fc	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x143f8	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1a73c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1a7b4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1a790	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x19400	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2d00c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2d00c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x21c3c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x21bd0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x21bf4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x21c18	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x204a8	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x20e04	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x20e04	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x20de8	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x20e94	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x204a8	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x20e1c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x20e64	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x20e7c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x20e4c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x20e34	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x20b48	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x208b8	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x2049c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x204a4	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x20804	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x207dc	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x20358	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x20484	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x20858	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x19d10	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x207b8	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x13e54	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x13f50	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x20844	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x21b9c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x21b94	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x21b8c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x31aa0	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2d20c	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x34448	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2d324	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2d324	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x19724	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x192e0	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1f710	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x192c4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x20d64	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2d120	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2d320	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x2d128	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x34004	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2d0c0	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1e900	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1fee4	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x19d04	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x19cf8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x13f68	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x20b48	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x20358	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1e9f8	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2d008	0	OBJECT	<unknown>	DEFAULT	10
__encode_dotted	.symtab	0x202ac	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1fdf8	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1ff98	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x34448	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x31a98	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x20d64	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x14820	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x24ccc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x24bac	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x31548	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x20804	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x13f7c	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1c6fc	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2d00c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2d008	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x20e94	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x20858	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x207dc	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x20844	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x207b8	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x18bec	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x34400	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x34404	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x3154c	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2d004	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x20d54	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1f7a8	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1da54	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x19e2c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x19050	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x15e8c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x21340	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x21428	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x21bc0	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x213bc	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x214e0	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x21bc8	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x21ca4	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x223b8	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x21644	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x20d54	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2d008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2d004	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x20d5c	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x192e0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x16180	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x19500	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x19588	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x14014	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x18bec	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x34408	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x19fa4	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x19370	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x19490	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x162c4	112	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x14304	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x16378	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x16434	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1d724	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x19c64	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x31a94	4	OBJECT	<unknown>	DEFAULT	14
__libc_waitpid	.symtab	0x143f8	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x19400	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x18fb8	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x24874	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x20d5c	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x175d8	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x16678	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2d130	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x34088	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x17528	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x208b8	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x3443c	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x34440	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x20d64	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x19370	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1fff8	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1f2b4	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x19354	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x31a9c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2d004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2d004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2d228	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2d22c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1d954	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1966c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x19664	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x19664	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x19664	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x19664	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x19490	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x20028	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x19474	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x34434	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x2d31b	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x3400c	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x2d31a	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x21ba4	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x31aa4	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x34438	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x34444	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x16630	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x16654	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1660c	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1fb38	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1da48	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2d240	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1dd80	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1ddd8	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1deb4	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1b020	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1df7c	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1e050	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1dfac	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1b344	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1b420	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2d244	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x204a4	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x1613c	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x16280	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x16334	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x163e8	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x19c38	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x19f64	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1fbfc	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x19d20	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x142c0	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1d700	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x196a8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x19778	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x197d0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2d224	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x13e54	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x19400	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x193e4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x15ea4	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1a200	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1a134	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x31358	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x34448	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x14944	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x34030	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x34058	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2d12c	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1d960	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1d998	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x3442c	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x34430	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x34420	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x3441c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x34424	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x34414	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1d698	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x34410	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x34428	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x34418	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x3440c	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2d324	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x34448	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x14108	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x22434	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x31ac8	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x14998	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1b64c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1b450	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1c8d0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x15110	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x153f8	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x151b0	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x151f4	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x153a4	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1967c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x19674	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x19cec	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x34080	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1abc0	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1b160	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2d248	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x31aa8	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1c0a0	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x31ac4	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x31ab4	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x31ac0	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x2d24c	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x1b1e0	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2d230	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x18190	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1b4c4	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x23b90	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1b4f0	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x14a1c	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x17a08	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
astd	.symtab	0x88a4	240	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x18154	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x18154	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x15a60	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x31544	4	OBJECT	<unknown>	DEFAULT	14
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1d9f0	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x16548	196	FUNC	<unknown>	DEFAULT	2
buf.4507	.symtab	0x31368	16	OBJECT	<unknown>	DEFAULT	14
buf.6549	.symtab	0x31378	440	OBJECT	<unknown>	DEFAULT	14
c	.symtab	0x2d114	4	OBJECT	<unknown>	DEFAULT	13
calloc	.symtab	0x17028	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0x14170	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x192e0	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x144cc	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/05/24-11:29:45.128925	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34268	6982	192.168.2.23	5.59.248.211
07/05/24-11:30:15.141154	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34270	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:33.676072	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	56234	6982	192.168.2.13	5.59.248.211
07/05/24-11:30:12.194685	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	56228	6982	192.168.2.13	5.59.248.211
07/05/24-11:32:21.317934	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34280	6982	192.168.2.23	5.59.248.211
07/05/24-11:33:04.401884	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34284	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:33.676072	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	56234	6982	192.168.2.13	5.59.248.211
07/05/24-11:30:40.228092	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34272	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:05.447534	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34274	6982	192.168.2.23	5.59.248.211
07/05/24-11:30:33.652184	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	56230	6982	192.168.2.13	5.59.248.211
07/05/24-11:31:03.663661	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	56232	6982	192.168.2.13	5.59.248.211
07/05/24-11:29:45.128925	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34268	6982	192.168.2.23	5.59.248.211
07/05/24-11:30:12.194685	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	56228	6982	192.168.2.13	5.59.248.211
07/05/24-11:32:42.997407	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34282	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:29.884614	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34276	6982	192.168.2.23	5.59.248.211
07/05/24-11:29:47.165785	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	56226	6982	192.168.2.13	5.59.248.211
07/05/24-11:31:51.305813	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34278	6982	192.168.2.23	5.59.248.211
07/05/24-11:32:21.317934	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34280	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:03.663661	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	56232	6982	192.168.2.13	5.59.248.211
07/05/24-11:30:15.141154	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34270	6982	192.168.2.23	5.59.248.211
07/05/24-11:30:33.652184	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	56230	6982	192.168.2.13	5.59.248.211
07/05/24-11:32:42.997407	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34282	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:29.884614	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34276	6982	192.168.2.23	5.59.248.211
07/05/24-11:30:40.228092	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	34272	6982	192.168.2.23	5.59.248.211
07/05/24-11:31:05.447534	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34274	6982	192.168.2.23	5.59.248.211
07/05/24-11:29:47.165785	TCP	2846318	ETPRO TROJAN ELF/Mirai Variant CnC Activity	56226	6982	192.168.2.13	5.59.248.211
07/05/24-11:31:51.305813	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34278	6982	192.168.2.23	5.59.248.211
07/05/24-11:33:04.401884	TCP	2846264	ETPRO TROJAN ELF/DarkNexus Variant CnC Activity	34284	6982	192.168.2.23	5.59.248.211

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 11:29:45.122708082 CEST	34268	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:29:45.127840996 CEST	6982	34268	5.59.248.211	192.168.2.23
Jul 5, 2024 11:29:45.127888918 CEST	34268	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:29:45.128925085 CEST	34268	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:29:45.133943081 CEST	6982	34268	5.59.248.211	192.168.2.23
Jul 5, 2024 11:29:46.411489964 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 5, 2024 11:29:49.147716999 CEST	443	58948	151.101.194.49	192.168.2.23
Jul 5, 2024 11:29:49.148190975 CEST	58948	443	192.168.2.23	151.101.194.49
Jul 5, 2024 11:29:49.153105021 CEST	443	58948	151.101.194.49	192.168.2.23
Jul 5, 2024 11:29:51.786782026 CEST	42836	443	192.168.2.23	91.189.91.43
Jul 5, 2024 11:29:53.322535038 CEST	42516	80	192.168.2.23	109.202.202.202
Jul 5, 2024 11:30:06.888600111 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 5, 2024 11:30:15.134927034 CEST	6982	34268	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:15.135200977 CEST	34268	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:15.135632992 CEST	34270	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:15.140559912 CEST	6982	34268	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:15.140933037 CEST	6982	34270	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:15.140990973 CEST	34270	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:15.141154051 CEST	34270	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:15.146720886 CEST	6982	34270	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:19.174909115 CEST	42836	443	192.168.2.23	91.189.91.43
Jul 5, 2024 11:30:23.270351887 CEST	42516	80	192.168.2.23	109.202.202.202
Jul 5, 2024 11:30:40.222310066 CEST	6982	34270	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:40.222466946 CEST	34270	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:40.223033905 CEST	34272	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:40.227648973 CEST	6982	34270	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:40.227963924 CEST	6982	34272	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:40.228070021 CEST	34272	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:40.228091955 CEST	34272	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:30:40.233015060 CEST	6982	34272	5.59.248.211	192.168.2.23
Jul 5, 2024 11:30:47.842968941 CEST	43928	443	192.168.2.23	91.189.91.42
Jul 5, 2024 11:31:05.441025972 CEST	6982	34272	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:05.441339016 CEST	34272	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:05.441994905 CEST	34274	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:05.447297096 CEST	6982	34272	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:05.447391987 CEST	6982	34274	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:05.447453022 CEST	34274	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:05.447534084 CEST	34274	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:05.452373028 CEST	6982	34274	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:29.878653049 CEST	6982	34274	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:29.878998041 CEST	34274	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:29.879654884 CEST	34276	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:29.884166002 CEST	6982	34274	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:29.884521961 CEST	6982	34276	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:29.884576082 CEST	34276	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:29.884613991 CEST	34276	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:29.889489889 CEST	6982	34276	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:51.300142050 CEST	6982	34276	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:51.300318003 CEST	34276	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:51.300874949 CEST	34278	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:51.305424929 CEST	6982	34276	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:51.305727005 CEST	6982	34278	5.59.248.211	192.168.2.23
Jul 5, 2024 11:31:51.305784941 CEST	34278	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:51.305813074 CEST	34278	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:31:51.310693979 CEST	6982	34278	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:21.311566114 CEST	6982	34278	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:21.312053919 CEST	34278	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:21.312894106 CEST	34280	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:21.317039013 CEST	6982	34278	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:21.317785025 CEST	6982	34280	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:21.317842007 CEST	34280	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:21.317934036 CEST	34280	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:21.323026896 CEST	6982	34280	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:42.979345083 CEST	6982	34280	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:42.979533911 CEST	6982	34280	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:42.979736090 CEST	34280	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:42.979736090 CEST	34280	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:42.980406046 CEST	34282	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:42.997246981 CEST	6982	34280	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:42.997260094 CEST	6982	34282	5.59.248.211	192.168.2.23
Jul 5, 2024 11:32:42.997322083 CEST	34282	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:42.997406960 CEST	34282	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:32:43.002228022 CEST	6982	34282	5.59.248.211	192.168.2.23
Jul 5, 2024 11:33:04.396171093 CEST	6982	34282	5.59.248.211	192.168.2.23
Jul 5, 2024 11:33:04.396380901 CEST	34282	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:33:04.396863937 CEST	34284	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:33:04.401222944 CEST	6982	34282	5.59.248.211	192.168.2.23
Jul 5, 2024 11:33:04.401782990 CEST	6982	34284	5.59.248.211	192.168.2.23
Jul 5, 2024 11:33:04.401869059 CEST	34284	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:33:04.401884079 CEST	34284	6982	192.168.2.23	5.59.248.211
Jul 5, 2024 11:33:04.406807899 CEST	6982	34284	5.59.248.211	192.168.2.23

System Behavior

Analysis Process: dash PID: 6182, Parent PID: 4331

General

Start time (UTC):	09:29:36
Start date (UTC):	05/07/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6182, Parent PID: 4331

General

Start time (UTC):	09:29:36
Start date (UTC):	05/07/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.8LUeUVlyQW /tmp/tmp.FnIh6cj2bO /tmp/tmp.ka3qk3uxVh
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6183, Parent PID: 4331

General

Start time (UTC):	09:29:36
Start date (UTC):	05/07/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6183, Parent PID: 4331

General

Start time (UTC):	09:29:36
Start date (UTC):	05/07/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.8LUeUVlyQW /tmp/tmp.FnIh6cj2bO /tmp/tmp.ka3qk3uxVh
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: zAHDiOLGpt.elf PID: 6200, Parent PID: 6115

General

Start time (UTC):	09:29:44
Start date (UTC):	05/07/2024
Path:	/tmp/zAHDiOLGpt.elf
Arguments:	/tmp/zAHDiOLGpt.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: zAHDiOLGpt.elf PID: 6202, Parent PID: 6200

General

Start time (UTC):	09:29:44
Start date (UTC):	05/07/2024
Path:	/tmp/zAHDiOLGpt.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: zAHDiOLGpt.elf PID: 6204, Parent PID: 6202

General

Start time (UTC):	09:29:44
Start date (UTC):	05/07/2024
Path:	/tmp/zAHDiOLGpt.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report zAHDiOLGpt.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6182, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6182, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6183, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6183, Parent PID: 4331

General

Chronological Activities

Analysis Process: zAHDiOLGpt.elf PID: 6200, Parent PID: 6115

General

Chronological Activities

Linux Analysis Report
zAHDiOLGpt.elf