Edit tour

Linux Analysis Report
a-r.m-5.ISIS.elf

Overview

General Information

Sample name:	a-r.m-5.ISIS.elf
Analysis ID:	1555340
MD5:	20e994693975f946d730733026aa9433
SHA1:	0c0dc52db40a66a50dec9c94e3abb30cd3ed312c
SHA256:	7cf19e34eb148e9948c1ff732724e844ef06fa7e94b6b6f53356da0911f40a37
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555340
Start date and time:	2024-11-13 19:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	a-r.m-5.ISIS.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: a-r.m-5.ISIS.elf

Runtime Messages

Command:	/tmp/a-r.m-5.ISIS.elf
PID:	5423
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

a-r.m-5.ISIS.elf (PID: 5423, Parent: 5345, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/a-r.m-5.ISIS.elf

a-r.m-5.ISIS.elf New Fork (PID: 5425, Parent: 5423)

a-r.m-5.ISIS.elf New Fork (PID: 5427, Parent: 5425)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
a-r.m-5.ISIS.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T19:07:50.593165+0100	2846527	1	A Network Trojan was detected	192.168.2.13	60674	185.78.76.132	839	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: a-r.m-5.ISIS.elf

Avira: detected

Found malware configuration

Source: a-r.m-5.ISIS.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "185.78.76.132:839"}

Multi AV Scanner detection for submitted file

Source: a-r.m-5.ISIS.elf

ReversingLabs: Detection: 65%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/a-r.m-5.ISIS.elf (PID: 5423)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2846527 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:60674 -> 185.78.76.132:839

Source: global traffic

TCP traffic: 192.168.2.13:60674 -> 185.78.76.132:839

Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.78.76.132
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: classification engine

Classification label: mal88.spre.troj.linELF@0/0@2/0

Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: a-r.m-5.ISIS.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Source: /tmp/a-r.m-5.ISIS.elf (PID: 5423)

Queries kernel information via 'uname':

Jump to behavior

Source: a-r.m-5.ISIS.elf, 5423.1.00007ffcd4927000.00007ffcd4948000.rw-.sdmp, a-r.m-5.ISIS.elf, 5425.1.00007ffcd4927000.00007ffcd4948000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/a-r.m-5.ISIS.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/a-r.m-5.ISIS.elf
Source: a-r.m-5.ISIS.elf, 5423.1.0000559a7140f000.0000559a7153d000.rw-.sdmp, a-r.m-5.ISIS.elf, 5425.1.0000559a7140f000.0000559a7153d000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: a-r.m-5.ISIS.elf, 5423.1.0000559a7140f000.0000559a7153d000.rw-.sdmp, a-r.m-5.ISIS.elf, 5425.1.0000559a7140f000.0000559a7153d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: a-r.m-5.ISIS.elf, 5423.1.00007ffcd4927000.00007ffcd4948000.rw-.sdmp, a-r.m-5.ISIS.elf, 5425.1.00007ffcd4927000.00007ffcd4948000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: a-r.m-5.ISIS.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: a-r.m-5.ISIS.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "185.78.76.132:839"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
a-r.m-5.ISIS.elf	66%	ReversingLabs	Linux.Trojan.Gafgyt
a-r.m-5.ISIS.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.78.76.132:839	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.78.76.132	unknown	Poland		262287	MaxihostLTDABR	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.78.76.132	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	a-r.m-7.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	a-r.m-5.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	a-r.m-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	x-3.2-.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	s-h.4-.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	m-i.p-s.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	i-5.8-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse
	a-r.m-7.ISIS.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	ub8ehJSePAfc9FYqZIT6.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	dlr.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	a-r.m-5.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	a-r.m-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	x-3.2-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	s-h.4-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	x-8.6-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MaxihostLTDABR	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-7.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-5.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-4.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	x-3.2-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	s-h.4-.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	m-i.p-s.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	i-5.8-6.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132
	a-r.m-7.ISIS.elf	Get hash	malicious	Gafgyt	Browse	185.78.76.132

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.929426245039559
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	a-r.m-5.ISIS.elf
File size:	105'111 bytes
MD5:	20e994693975f946d730733026aa9433
SHA1:	0c0dc52db40a66a50dec9c94e3abb30cd3ed312c
SHA256:	7cf19e34eb148e9948c1ff732724e844ef06fa7e94b6b6f53356da0911f40a37
SHA512:	5cbd596ff002a1cbfbbfccb98df8f4834075fa4570cac56cf637a2774ce5189983c7cd187a9e22a7e396fc9a0d201c8cb0c311856f9420b17a60400d292a9847
SSDEEP:	3072:pCi6VirwbYRTLL87rutAmpEqQ45vVXY0X:InbcPL87JmpEqQ45vVXY0X
TLSH:	F2A31744F8448767C3D327FAF78E438D77361A6457D733116A39AEB42BC6B982E29120
File Content Preview:	.ELF...a..........(.........4....6......4. ...(.......................................... ... ... .......g..........Q.td..................................-...L."....>..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79528
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0xfc0c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x17cbc	0xfcbc	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x17cd0	0xfcd0	0x22e4	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x19fb4	0x11fb4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x22000	0x12000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x22008	0x12008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x22010	0x12010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x22014	0x12014	0x3a0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x223b4	0x123b4	0x635c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x123b4	0xab4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x12e68	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x12f08	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x13214	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x13278	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x13560	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x13600	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x139c8	0x3f40	0x10	0x0		19	573	4
.strtab	STRTAB	0x0	0x17908	0x218f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x11fb8	0x11fb8	6.0211	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x12000	0x22000	0x22000	0x3b4	0x6710	2.7466	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x17cbc	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x17cd0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x19fb4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x22000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x22008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x22010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x22014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x223b4	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17cbc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cc8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17ccc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x956c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcfd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1031c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1048c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1050c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1064c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1067c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1097c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1242c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12458	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1248c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1260c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1306c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1343c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1397c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13be4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14be0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1729c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1765c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1783c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x22008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2201c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x997c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18184	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa9a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb1e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xba8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbc3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcf00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcfb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf644	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1061c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1071c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22050	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x22058	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1075c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1096c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22060	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x18f5c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1105c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1131c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1235c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1259c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12748	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2219c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x222a4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12bbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x222bc	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12e30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b88	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1327c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22370	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x13438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13584	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22388	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x138bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2861c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x13ab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19bd0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14cd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22390	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15b94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1646c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1768c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223a8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x177bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17838	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.111.5062	.symtab	0x18184	8	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0x119d8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x119f4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x223e8	16384	OBJECT	<unknown>	DEFAULT	10
SendHTTPHex	.symtab	0xb8e8	432	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa83c	364	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9d00	1228	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x22004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x22000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x22050	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1895c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x223a8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x19cb4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x22058	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x18c5c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2200c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x22008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x19fb4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x19fb4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x22050	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1895c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x223a8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x19cb4	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x22058	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x18c5c	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x22054	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x223ac	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x2205c	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x10754	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x17690	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x11d0c	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x13aac	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1031c	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x10390	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x105b4	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x13488	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x13538	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x11d20	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x103e0	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x12a0c	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x13058	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x13058	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x15b9c	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x10434	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x10460	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x12378	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2861c	4	OBJECT	<unknown>	HIDDEN	10
__GI_exit	.symtab	0x13204	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x15c04	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1031c	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x10390	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16494	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x17690	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x162c0	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x16678	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x15d84	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1048c	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x117ec	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x15d90	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x15d9c	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x11820	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x17690	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x104b8	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x138f8	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x13924	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x13950	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x11fc0	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x12004	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x104e0	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1050c	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x123a4	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1397c	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x28620	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x11f9c	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x14f4c	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x11f90	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x11f10	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x16d50	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x169dc	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x12f90	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10538	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x11e14	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10588	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x175f8	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x14be0	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x118e0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x14bd0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x14cdc	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x14cf4	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x118f0	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x139a8	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x105b4	92	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x15bd8	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x15b60	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x12b58	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x12e34	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x16710	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10620	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x12400	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x139d4	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1064c	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1242c	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x12458	52	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1067c	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1248c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x12d74	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x137e0	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x124e8	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x13a2c	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x13298	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x124bc	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x10760	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x12ec4	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x177c0	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x11a10	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x11990	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x11990	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x11b18	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x168e0	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x119b0	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x167c8	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x14de0	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x11b34	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x14f0c	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x16890	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x11c14	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x11e08	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x14e98	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x13064	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x11e34	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x106a8	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x1765c	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x10720	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x10794	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x13a80	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x106d4	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x13ab8	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x13b28	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x13b08	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x106dc	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x22010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x22010	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x17b40	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x102c8	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x17c68	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x102c8	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x10008	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x10100	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x28610	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x22370	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x124e8	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x28710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x223b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x223b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x13500	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x22054	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x223ac	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x2205c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x28640	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x22014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x171c0	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x178e4	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x17098	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x138c8	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x138c4	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x102c8	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x17b40	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x15038	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x17c80	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x22018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1783c	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x16fb0	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x17150	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x28710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x28608	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x10754	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x28600	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x17690	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x22000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x22000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x15b18	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x11d0c	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x13aac	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x12850	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x12918	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x128e4	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x12904	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x22000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x22000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x179b0	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x171ac	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x10460	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x12378	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x10610	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1031c	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x10390	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1048c	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x104e0	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x175f8	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x139a8	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x105b4	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x15bd8	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10620	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x12400	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1064c	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1242c	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x12458	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x137e0	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x28604	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x106d4	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x106dc	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x2219c	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x285e4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x286cc	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x101e4	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x102cc	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x286f4	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x28700	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x1729c	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x15844	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2860c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x22000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x22000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x134f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x134f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x134f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x134f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x134f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x134fc	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x15b60	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x172d0	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x22390	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x28614	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x286e4	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x28704	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x125c4	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x125e8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x125a0	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2206c	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x179fc	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x13be4	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x15ecc	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x13ca0	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x108b4	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x18f5c	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x17a58	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x16290	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x17a84	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x13dd8	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1097c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x22070	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x138cc	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x13488	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x13538	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x13594	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x22388	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x10008	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x10118	204	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x11d20	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x28710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x109ac	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x15b78	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x28708	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2870c	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x223b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x28710	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2861c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x103e0	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x17cbc	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x263f0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x109f8	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x140d0	1640	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x28620	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x13edc	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x14740	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x11070	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x11328	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x11108	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x11140	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x112dc	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x134fc	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x134fc	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2864c	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x15f98	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x10844	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x22074	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x22078	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x16354	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x263ec	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x22090	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x263e8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x220ac	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x108c4	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x220a8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1306c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x13f4c	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1902c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x13f80	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x10a7c	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x12a0c	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x10408	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x13058	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x13058	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x118d0	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x285fc	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x28618	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x15b9c	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x124e8	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x283f4	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x28404	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x22048	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x17cb4	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x10434	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x10460	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x22024	4	OBJECT	<unknown>	DEFAULT	9
completed.2555	.symtab	0x223b4	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x12378	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x956c	640	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x10610	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9984	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x22044	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x22020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x28608	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2861c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x13204	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x19bd0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x15c04	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1031c	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x10390	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x8438	208	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x16494	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x17690	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x162c0	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x16678	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x19bbc	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x15d84	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x22014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x223b0	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x1048c	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x117ec	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x12760	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x15d90	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x15d90	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x15d9c	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ftcp	.symtab	0xa1cc	1648	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked	.symtab	0x11820	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xcee8	28	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x91ac	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8508	740	FUNC	<unknown>	DEFAULT	2
getPortz	.symtab	0xcf04	204	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x83d8	96	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x17690	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x104b8	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x138f8	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x13924	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x13950	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x11fc0	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x12004	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x104e0	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1050c	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x123a4	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x123d0	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x1397c	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x223d4	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x285d0	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x28620	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x11ed8	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x11efc	20	FUNC	<unknown>	DEFAULT	2
i.4126	.symtab	0x2204c	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x11a10	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x11f9c	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x14f4c	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x11f90	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x11f10	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x16d50	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x16bec	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x169dc	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x16910	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xf668	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x221a0	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x12c60	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x12f90	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10538	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x11e14	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x10708	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10588	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x97ec	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x175f8	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x223e0	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xf7f4	2068	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x223d0	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0x9bec	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x9210	136	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0xb0b4	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1260c	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x14be0	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x118e0	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x14bd0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x14cdc	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x14cf4	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x118f0	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x222a4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x222bc	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x28624	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x139a8	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x283f0	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x11ea0	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x11ec4	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x223d8	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x223b8	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x105b4	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x28644	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0xc160	3464	FUNC	<unknown>	DEFAULT	2
p.2553	.symtab	0x2201c	0	OBJECT	<unknown>	DEFAULT	9
pids	.symtab	0x28648	4	OBJECT	<unknown>	DEFAULT	10
poll	.symtab	0x15bd8	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x18f84	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8cf4	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x891c	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8b0c	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8988	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xcfd0	9880	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x18f98	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x15b60	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x12b54	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x12b58	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x19b88	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x12e34	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x222f0	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x16710	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10620	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x12400	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x9298	724	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x139d4	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
select	.symtab	0x1064c	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1242c	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0xa9a8	1472	FUNC	<unknown>	DEFAULT	2
sendHTTPtwo	.symtab	0xba98	432	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0xbc48	1304	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x12458	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsid	.symtab	0x1067c	44	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1248c	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x12bd4	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x12d74	192	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x137e0	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x124e8	184	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x13a2c	84	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x13298	420	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x124bc	44	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0xaf68	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x90e4	200	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4146	.symtab	0x18fac	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4140	.symtab	0x18f90	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4143	.symtab	0x18fd8	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4142	.symtab	0x18ff0	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4145	.symtab	0x18fbc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4144	.symtab	0x18fcc	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x10760	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x12cf8	124	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x12cf8	124	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x12ec4	204	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x2238c	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x2863c	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x22068	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x22060	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x22064	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x177c0	124	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x11a10	264	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x11990	28	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x11990	28	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x11b18	28	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x168e0	48	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x11d20	232	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x119b0	96	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x167c8	200	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x14de0	184	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x11b34	224	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x14f0c	64	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x16890	80	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x11c14	248	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x11e08	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x14e98	116	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x13064	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x11e34	108	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpcsum	.symtab	0x9adc	272	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x106a8	44	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x1765c	52	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x10720	52	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x87ec	304	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x18ff8	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x19010	12	OBJECT	<unknown>	DEFAULT	4
unknown.1088	.symtab	0x1901c	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x222d4	28	OBJECT	<unknown>	DEFAULT	9
useragents	.symtab	0x22028	28	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x1343c	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vseattack	.symtab	0xb1ec	1788	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x10794	176	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x13a80	44	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x106d4	8	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x13ab8	80	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x13b28	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x13b08	32	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x106dc	44	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3041	.symtab	0x19c7c	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T19:07:50.593165+0100	2846527	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	60674	185.78.76.132	839	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 19:07:50.585748911 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:07:50.591492891 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:07:50.591553926 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:07:50.593164921 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:07:50.597959042 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:08:42.114475965 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:08:42.114765882 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:08:42.252114058 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:08:42.252249002 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:09:42.115643024 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:09:42.115883112 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:09:42.247189999 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:09:42.247267962 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:10:42.117620945 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:10:42.117861986 CET	60674	839	192.168.2.13	185.78.76.132
Nov 13, 2024 19:10:42.249244928 CET	839	60674	185.78.76.132	192.168.2.13
Nov 13, 2024 19:10:42.249401093 CET	60674	839	192.168.2.13	185.78.76.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 19:10:34.016864061 CET	55227	53	192.168.2.13	1.1.1.1
Nov 13, 2024 19:10:34.016957998 CET	57132	53	192.168.2.13	1.1.1.1
Nov 13, 2024 19:10:34.026721954 CET	53	57132	1.1.1.1	192.168.2.13
Nov 13, 2024 19:10:34.028743029 CET	53	55227	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 19:10:34.016864061 CET	192.168.2.13	1.1.1.1	0x836	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 19:10:34.016957998 CET	192.168.2.13	1.1.1.1	0x67de	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 19:10:34.028743029 CET	1.1.1.1	192.168.2.13	0x836	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Nov 13, 2024 19:10:34.028743029 CET	1.1.1.1	192.168.2.13	0x836	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: a-r.m-5.ISIS.elf PID: 5423, Parent PID: 5345

General

Start time (UTC):	18:07:49
Start date (UTC):	13/11/2024
Path:	/tmp/a-r.m-5.ISIS.elf
Arguments:	/tmp/a-r.m-5.ISIS.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: a-r.m-5.ISIS.elf PID: 5425, Parent PID: 5423

General

Start time (UTC):	18:07:50
Start date (UTC):	13/11/2024
Path:	/tmp/a-r.m-5.ISIS.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: a-r.m-5.ISIS.elf PID: 5427, Parent PID: 5425

General

Start time (UTC):	18:07:50
Start date (UTC):	13/11/2024
Path:	/tmp/a-r.m-5.ISIS.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report a-r.m-5.ISIS.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: a-r.m-5.ISIS.elf PID: 5423, Parent PID: 5345

General

Chronological Activities

Analysis Process: a-r.m-5.ISIS.elf PID: 5425, Parent PID: 5423

General

Chronological Activities

Analysis Process: a-r.m-5.ISIS.elf PID: 5427, Parent PID: 5425

General

Chronological Activities

Linux Analysis Report
a-r.m-5.ISIS.elf