Edit tour

Linux Analysis Report
dss.elf

Overview

General Information

Sample name:	dss.elf
Analysis ID:	1519109
MD5:	d5505a4d1c30a2e8fdbf80ea3cc7acb9
SHA1:	08b9eeb03f75ae354874298c59c40ee9d9f0adfc
SHA256:	0a14dc334e4bd7ca1557370a2859031aac7ec4ba5ac5c7bb0bdcf159f7376950
Tags:	user-lontze7
Infos:

Detection

Gafgyt, Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519109
Start date and time:	2024-09-26 07:04:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	dss.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: dss.elf

Runtime Messages

Command:	/tmp/dss.elf
PID:	5528
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

dss.elf (PID: 5528, Parent: 5445, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/dss.elf

dss.elf New Fork (PID: 5530, Parent: 5528)

dss.elf New Fork (PID: 5532, Parent: 5530)

dss.elf New Fork (PID: 5534, Parent: 5532)

dss.elf New Fork (PID: 5540, Parent: 5534)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
dss.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
dss.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5530.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5532.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5540.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5528.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: dss.elf PID: 5530	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: dss.elf PID: 5532	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: dss.elf PID: 5540	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:05:34.156394+0200	2847206	1	A Network Trojan was detected	192.168.2.14	51876	89.117.23.69	23	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dss.elf

Avira: detected

Found malware configuration

Source: dss.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.117.23.69:23"}

Multi AV Scanner detection for submitted file

Source: dss.elf

ReversingLabs: Detection: 71%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2847206 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:51876 -> 89.117.23.69:23

Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69
Source: unknown	TCP traffic detected without corresponding DNS query: 89.117.23.69

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: classification engine

Classification label: mal88.troj.linELF@0/0@2/0

Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: dss.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: dss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: dss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: dss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: dss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: dss.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/dss.elf (PID: 5528)

Queries kernel information via 'uname':

Jump to behavior

Source: dss.elf, 5528.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp, dss.elf, 5530.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp, dss.elf, 5532.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp, dss.elf, 5540.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/dss.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dss.elf
Source: dss.elf, 5528.1.00005571c23c0000.00005571c24ee000.rw-.sdmp, dss.elf, 5530.1.00005571c23c0000.00005571c24ee000.rw-.sdmp, dss.elf, 5532.1.00005571c23c0000.00005571c24ee000.rw-.sdmp, dss.elf, 5540.1.00005571c23c0000.00005571c24ee000.rw-.sdmp	Binary or memory string: qU!/etc/qemu-binfmt/arm
Source: dss.elf, 5528.1.00005571c23c0000.00005571c24ee000.rw-.sdmp, dss.elf, 5530.1.00005571c23c0000.00005571c24ee000.rw-.sdmp, dss.elf, 5532.1.00005571c23c0000.00005571c24ee000.rw-.sdmp, dss.elf, 5540.1.00005571c23c0000.00005571c24ee000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: dss.elf, 5528.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp, dss.elf, 5530.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp, dss.elf, 5532.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp, dss.elf, 5540.1.00007ffe9e81c000.00007ffe9e83d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: dss.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: dss.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5540.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dss.elf PID: 5530, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dss.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dss.elf PID: 5540, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Safari/604.1.38
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; CrOS x86_64 9592.96.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.114 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 535) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Mobile Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.4; HTC Desire 620 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Mobile/14D27
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: dss.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: dss.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5540.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007f6f58017000.00007f6f5802d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dss.elf PID: 5530, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dss.elf PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dss.elf PID: 5540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.117.23.69:23"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dss.elf	71%	ReversingLabs	Linux.Trojan.Gafgyt
dss.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.117.23.69:23	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.117.23.69	unknown	Lithuania		15419	LRTC-ASLT	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
89.117.23.69	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	SecuriteInfo.com.PUA.Tool.Linux.BtcMine.9999.9051.28507.elf	Get hash	malicious	Nanominer, Xmrig	Browse	162.213.35.25
	SecuriteInfo.com.ELF.Agent-CUA.9578.1753.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	SecuriteInfo.com.Linux.Siggen.9999.31793.28485.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	SecuriteInfo.com.Linux.Siggen.9999.12455.6685.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	SecuriteInfo.com.Linux.Siggen.9999.6857.12644.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	SecuriteInfo.com.Linux.Siggen.9999.4860.9338.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	SecuriteInfo.com.Linux.Siggen.9999.30626.2322.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LRTC-ASLT	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	yiaAIRR6hn.exe	Get hash	malicious	ArrowRAT	Browse	89.117.146.168
	1726981024eaba256966e5d64020ad74d345ce2969fae5805b304862945360330900888386844.dat-decoded.exe	Get hash	malicious	Remcos	Browse	89.117.23.22
	ACUN4Da4d7.exe	Get hash	malicious	Unknown	Browse	89.117.76.249
	KKKK.hta	Get hash	malicious	Unknown	Browse	86.38.217.167
	decode_ba297ca42bf569929d6fafd20a8ed9212b3012291d38a6ec2be3376d5488c4a5.exe	Get hash	malicious	Remcos	Browse	89.117.23.22
	decode_43048329e6cd6df3e144e8592c1194cf0da5e9113653ea155e664cbcc08b4b27.exe	Get hash	malicious	AsyncRAT	Browse	89.117.23.22

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.944087238571199
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	dss.elf
File size:	127'723 bytes
MD5:	d5505a4d1c30a2e8fdbf80ea3cc7acb9
SHA1:	08b9eeb03f75ae354874298c59c40ee9d9f0adfc
SHA256:	0a14dc334e4bd7ca1557370a2859031aac7ec4ba5ac5c7bb0bdcf159f7376950
SHA512:	3862bf300eeb2b02516c771a392588e6f7bfe9e0ab3adbc1c631dfb1dfac55bd2ef1b9b995fde9b84de4bc666ad2990bf6c68aabc48a6bccdc334bfc9cdc77e9
SSDEEP:	3072:TGGhNnu3jGOEHgsRqm53bhISOMmyVUQuiXfQd6W:/ruxEAcqm53pmyVUQuiXfQd6W
TLSH:	2CC30905F901875BC3E227BAE78E438C77355E6457DB33156A38BDB42BE1B982D29230
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................X...X...............`...`...`.......g..........Q.td..................................-...L."....H..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	98524
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x120ac	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1a15c	0x1215c	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1a170	0x12170	0x3740	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1d8b0	0x158b0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x26000	0x16000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x26008	0x16008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x26010	0x16010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x26014	0x16014	0x408	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2641c	0x1641c	0x636c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1641c	0xb68	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x16f88	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x170a8	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17620	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x176d4	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x17f94	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x18034	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x183fc	0x48d0	0x10	0x0		19	647	4
.strtab	STRTAB	0x0	0x1cccc	0x261f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x158b4	0x158b4	6.0861	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x16000	0x26000	0x26000	0x41c	0x6788	3.0073	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1a15c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1a170	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1d8b0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x26000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x26008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x26010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x26014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2641c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a15c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a168	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a16c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbdb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1338c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1366c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1368c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1490c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1521c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1550c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1678c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1723c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1777c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1947c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x26008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2601c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a198	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x95f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9bc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb58c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbda4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf66c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1085c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x260b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x260c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x260c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1c858	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12800	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26204	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x140d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2630c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1445c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26324	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x146d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d484	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x263d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14bc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x263f0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x151f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c68c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x153dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d4cc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16888	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x263f8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1758c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1804c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18cbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26410	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x191b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19230	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.100.4599	.symtab	0x1a830	144	OBJECT	<unknown>	DEFAULT	4
C.104.4641	.symtab	0x1a8c0	144	OBJECT	<unknown>	DEFAULT	4
C.108.4683	.symtab	0x1a950	144	OBJECT	<unknown>	DEFAULT	4
C.112.4725	.symtab	0x1a9e0	144	OBJECT	<unknown>	DEFAULT	4
C.116.4767	.symtab	0x1aa70	144	OBJECT	<unknown>	DEFAULT	4
C.120.4809	.symtab	0x1ab00	144	OBJECT	<unknown>	DEFAULT	4
C.124.4850	.symtab	0x1acd0	8	OBJECT	<unknown>	DEFAULT	4
C.128.4885	.symtab	0x1acd8	8	OBJECT	<unknown>	DEFAULT	4
C.132.4920	.symtab	0x1ace0	8	OBJECT	<unknown>	DEFAULT	4
C.136.4955	.symtab	0x1ace8	8	OBJECT	<unknown>	DEFAULT	4
C.140.4990	.symtab	0x1acf0	8	OBJECT	<unknown>	DEFAULT	4
C.142.5019	.symtab	0x1bab4	12	OBJECT	<unknown>	DEFAULT	4
C.143.5020	.symtab	0x1ba94	12	OBJECT	<unknown>	DEFAULT	4
C.96.4557	.symtab	0x1a7a0	144	OBJECT	<unknown>	DEFAULT	4
GetRandomIP	.symtab	0x9d64	96	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x13178	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x13194	0	NOTYPE	<unknown>	DEFAULT	2
OreoServer	.symtab	0x26024	4	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x26454	16384	OBJECT	<unknown>	DEFAULT	10
RandString	.symtab	0x9858	136	FUNC	<unknown>	DEFAULT	2
Send100UP	.symtab	0xb424	364	FUNC	<unknown>	DEFAULT	2
SendNUKE	.symtab	0xb6fc	364	FUNC	<unknown>	DEFAULT	2
SendOVH	.symtab	0xb14c	364	FUNC	<unknown>	DEFAULT	2
SendPAKI	.symtab	0xb590	364	FUNC	<unknown>	DEFAULT	2
SendZAP	.symtab	0xb2b8	364	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x26004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x26000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x260b8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1c258	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x26410	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1d5b0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x260c0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1c558	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2600c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x26008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1d8b0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1d8b0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x260b8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1c258	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x26410	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1d5b0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x260c0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1c558	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x260bc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x26414	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x260c4	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11a14	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x142ac	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17594	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x11a3c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x11a68	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13bd0	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x11a94	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2c68c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x14b38	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x15248	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14aa4	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x175fc	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17e8c	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17cb8	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x18070	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1777c	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x11ac0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17788	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17794	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15274	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x152a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x152cc	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x11b14	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x152f8	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2c690	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x16944	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x18748	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x183d4	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x14830	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1366c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11bbc	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18ff0	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16690	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x13080	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16680	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1678c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x167a4	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x13090	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x11c54	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x175d0	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x17558	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x143f8	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x146d4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x18108	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x11cb0	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x13c58	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x15350	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11cdc	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13c84	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x11d0c	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x11d74	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x11da0	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13ce4	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x14614	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x15114	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13d40	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13d70	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11df8	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14bcc	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13d14	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11f04	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x14764	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x191b8	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x131b0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x132b8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x182d8	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x13150	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x181c0	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x132d4	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1338c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x16904	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x18288	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1346c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13660	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16890	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x14904	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1368c	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11e4c	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x19054	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11ec4	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11f38	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x153a8	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x153e0	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15450	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15430	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x11e80	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x26010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x26010	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x19684	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x1a054	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x1a054	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x1a038	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x1a0cc	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x19684	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x1a068	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x1a0a4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x1a0b8	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x1a090	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x1a07c	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x19da0	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x19a78	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x19678	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x19680	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x199b8	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x1998c	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x19538	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x19660	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x19a0c	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x19964	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11600	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x116f8	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x199f8	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2c680	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x263d8	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2641c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2641c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14e34	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x19fb4	132	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x260bc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x26414	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x260c4	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2c6b0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x26014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18bb8	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x192dc	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18a90	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x15218	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x15214	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x19da0	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x19538	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x16a30	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1a120	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x26018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x19234	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x189a8	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x18b48	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2c678	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x19fb4	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2c670	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x199b8	64	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x1a0cc	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x19a0c	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x1998c	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x199f8	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x19964	40	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x19fa4	148	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x17510	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x19fa4	148	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x140f0	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x141b8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x14184	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x141a4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__ledf2	.symtab	0x19fac	140	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x193a8	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18ba4	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18ff0	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x175d0	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x11cb0	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x13c58	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11cdc	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13c84	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x15114	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2c674	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x11e80	44	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x19fac	140	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x26204	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2c654	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2c744	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x117dc	228	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x19a78	808	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x118c4	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2c76c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2c778	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x19fb4	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x18c94	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1723c	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2c67c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x17558	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18cc8	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x263f8	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2c684	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2c75c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2c77c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13e64	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13e88	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13e40	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x260d4	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x193f4	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1550c	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x178c4	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x155c8	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x12058	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1c858	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x19450	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17c88	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1947c	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15700	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12120	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x260d8	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x19680	740	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x151f8	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1521c	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14ec8	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x263f0	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11600	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11710	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x12150	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x17570	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2c780	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2c784	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x2641c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2c68c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x11a14	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1a15c	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2a460	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1219c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x159f8	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2c690	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15804	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x161f0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12814	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x12acc	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x128ac	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x128e4	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x12a80	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2c6c4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17990	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11fe8	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x260dc	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x260e0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17d4c	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x2a45c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x260f8	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2a458	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x26114	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x12068	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x26110	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1490c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15874	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1c928	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x158a8	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12220	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x142ac	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x13070	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2c66c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2c688	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17594	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x2c464	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x2c474	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x26030	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1a154	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x11a3c	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_tcp_udp	.symtab	0x9f1c	448	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2555	.symtab	0x2641c	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x92f8	636	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9dc4	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x26028	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x26020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x11a94	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2c678	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2c68c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x14b38	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x15248	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14aa4	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1d4cc	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x175fc	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x9228	208	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x2a454	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x90a4	388	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x8e1c	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17e8c	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17cb8	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x18070	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1d4b8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1777c	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x26014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x26418	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x14000	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17788	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17788	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17794	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getHost	.symtab	0x979c	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x109f4	740	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15274	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x152a0	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x152cc	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x13c28	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x152f8	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x26440	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x2c640	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2c690	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x1a198	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x13730	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13754	20	FUNC	<unknown>	DEFAULT	2
i.3637	.symtab	0x26034	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x131b0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x16944	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x18748	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x185e4	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x183d4	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x18308	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10868	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x26208	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x14500	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x14830	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ioctl_keepalive	.symtab	0xe538	304	FUNC	<unknown>	DEFAULT	2
ioctl_pid	.symtab	0x26438	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x1366c	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x11eac	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11bbc	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9bcc	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18ff0	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x2644c	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x10cd8	2344	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x2643c	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0xa1ec	276	FUNC	<unknown>	DEFAULT	2
makeVSEPacket	.symtab	0xa300	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13eac	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16690	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x13080	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x16680	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x1678c	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x167a4	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x13090	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x2630c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x26324	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2c694	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x2c460	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x136f8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1371c	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x26444	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x26420	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2c6b4	4	OBJECT	<unknown>	DEFAULT	10
ourPublicIP	.symtab	0x2c6b8	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0xbdb0	3464	FUNC	<unknown>	DEFAULT	2
p.2553	.symtab	0x2601c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x9574	128	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x2c6c0	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x11c54	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x175d0	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x11c80	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1c880	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x88e0	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8508	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x86f8	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8574	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xe668	8704	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1c894	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x17558	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x143f4	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x143f8	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1d484	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x146d4	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x26358	128	OBJECT	<unknown>	DEFAULT	9
rangechoice	.symtab	0x2602c	4	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x18108	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T07:05:34.156394+0200	2847206	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.14	51876	89.117.23.69	23	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 07:05:34.150332928 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:05:34.155272961 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:05:34.155364990 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:05:34.156394005 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:05:34.161175966 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:06:03.811240911 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:06:03.811398983 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:06:03.938736916 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:06:03.938894987 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:06:33.957128048 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:06:33.962207079 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:06:34.125148058 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:06:34.125276089 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:07:03.814423084 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:07:03.814603090 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:07:03.934053898 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:07:03.934197903 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:07:33.963176012 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:07:33.969343901 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:07:34.132236958 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:07:34.132366896 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:08:03.818236113 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:08:03.818536043 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:08:03.935085058 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:08:03.935271025 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:08:20.036911964 CEST	45156	53	192.168.2.14	8.8.8.8
Sep 26, 2024 07:08:20.228050947 CEST	53	45156	8.8.8.8	192.168.2.14
Sep 26, 2024 07:08:20.228142977 CEST	45156	53	192.168.2.14	8.8.8.8
Sep 26, 2024 07:08:20.228184938 CEST	45156	53	192.168.2.14	8.8.8.8
Sep 26, 2024 07:08:20.228246927 CEST	45156	53	192.168.2.14	8.8.8.8
Sep 26, 2024 07:08:20.235125065 CEST	53	45156	8.8.8.8	192.168.2.14
Sep 26, 2024 07:08:20.235155106 CEST	53	45156	8.8.8.8	192.168.2.14
Sep 26, 2024 07:08:20.704395056 CEST	53	45156	8.8.8.8	192.168.2.14
Sep 26, 2024 07:08:20.704889059 CEST	45156	53	192.168.2.14	8.8.8.8
Sep 26, 2024 07:08:22.704659939 CEST	53	45156	8.8.8.8	192.168.2.14
Sep 26, 2024 07:08:22.704956055 CEST	45156	53	192.168.2.14	8.8.8.8
Sep 26, 2024 07:08:22.709836006 CEST	53	45156	8.8.8.8	192.168.2.14
Sep 26, 2024 07:08:33.964371920 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:08:33.969335079 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:08:34.132266045 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:08:34.132461071 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:09:03.820837021 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:09:03.821077108 CEST	51876	23	192.168.2.14	89.117.23.69
Sep 26, 2024 07:09:03.948227882 CEST	23	51876	89.117.23.69	192.168.2.14
Sep 26, 2024 07:09:03.948337078 CEST	51876	23	192.168.2.14	89.117.23.69

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 07:08:20.228184938 CEST	192.168.2.14	8.8.8.8	0xc052	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:08:20.228246927 CEST	192.168.2.14	8.8.8.8	0x9648	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 07:08:20.704395056 CEST	8.8.8.8	192.168.2.14	0xc052	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Sep 26, 2024 07:08:20.704395056 CEST	8.8.8.8	192.168.2.14	0xc052	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dss.elf PID: 5528, Parent PID: 5445

General

Start time (UTC):	05:05:33
Start date (UTC):	26/09/2024
Path:	/tmp/dss.elf
Arguments:	/tmp/dss.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dss.elf PID: 5530, Parent PID: 5528

General

Start time (UTC):	05:05:33
Start date (UTC):	26/09/2024
Path:	/tmp/dss.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dss.elf PID: 5532, Parent PID: 5530

General

Start time (UTC):	05:05:33
Start date (UTC):	26/09/2024
Path:	/tmp/dss.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dss.elf PID: 5534, Parent PID: 5532

General

Start time (UTC):	05:05:33
Start date (UTC):	26/09/2024
Path:	/tmp/dss.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dss.elf PID: 5540, Parent PID: 5534

General

Start time (UTC):	05:05:33
Start date (UTC):	26/09/2024
Path:	/tmp/dss.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report dss.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dss.elf PID: 5528, Parent PID: 5445

General

Chronological Activities

Analysis Process: dss.elf PID: 5530, Parent PID: 5528

General

Chronological Activities

Analysis Process: dss.elf PID: 5532, Parent PID: 5530

General

Chronological Activities

Analysis Process: dss.elf PID: 5534, Parent PID: 5532

General

Chronological Activities

Analysis Process: dss.elf PID: 5540, Parent PID: 5534

General

Linux Analysis Report
dss.elf