Edit tour

Linux Analysis Report
sse.elf

Overview

General Information

Sample name:	sse.elf
Analysis ID:	1588674
MD5:	b926ed51ed242929568603920eeafa80
SHA1:	544d897f4ae68acdf362913d01aed9ce40a0f8f7
SHA256:	78d9bd20f10d57676983187d288e56103e535a16d8074efbcfa75491e541f452
Tags:	elfGafgytuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Connects to many ports of the same IP (likely port scanning)

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588674
Start date and time:	2025-01-11 03:58:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sse.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/sse.elf
PID:	6215
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

sse.elf (PID: 6215, Parent: 6131, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sse.elf

sse.elf New Fork (PID: 6217, Parent: 6215)

sse.elf New Fork (PID: 6219, Parent: 6215)

sse.elf New Fork (PID: 6221, Parent: 6219)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sse.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
sse.elf	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
sse.elf	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00

Memory Dumps

Source	Rule	Description	Author	Strings
6215.1.00007ffa70017000.00007ffa70032000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6215.1.00007ffa70017000.00007ffa70032000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6217.1.00007ffa70017000.00007ffa70032000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6217.1.00007ffa70017000.00007ffa70032000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
6219.1.00007ffa70017000.00007ffa70032000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x1bbe:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
6219.1.00007ffa70017000.00007ffa70032000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ace:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sse.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: sse.elf	Virustotal: Detection: 58%			Perma Link
Source: sse.elf	ReversingLabs: Detection: 75%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/sse.elf (PID: 6215)

Opens: /proc/net/route

Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 89.33.192.138 ports 65487,4,5,6,7,8

Source: global traffic

TCP traffic: 192.168.2.23:44412 -> 89.33.192.138:65487

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.33.192.138

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: sse.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: sse.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6215.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6215.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6217.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6217.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 6219.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 6219.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown

Source: sse.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: sse.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: sse.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6215.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6215.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6217.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6217.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 6219.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 6219.1.00007ffa70017000.00007ffa70032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.spre.troj.linELF@0/0@0/0

Source: /tmp/sse.elf (PID: 6215)

Queries kernel information via 'uname':

Jump to behavior

Source: sse.elf, 6215.1.00007ffef1938000.00007ffef1959000.rw-.sdmp, sse.elf, 6217.1.00007ffef1938000.00007ffef1959000.rw-.sdmp, sse.elf, 6219.1.00007ffef1938000.00007ffef1959000.rw-.sdmp	Binary or memory string: zS)x86_64/usr/bin/qemu-arm/tmp/sse.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sse.elf
Source: sse.elf, 6215.1.000056118edeb000.000056118ef3a000.rw-.sdmp, sse.elf, 6217.1.000056118edeb000.000056118ef3a000.rw-.sdmp, sse.elf, 6219.1.000056118edeb000.000056118ef3a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: sse.elf, 6215.1.000056118edeb000.000056118ef3a000.rw-.sdmp, sse.elf, 6217.1.000056118edeb000.000056118ef3a000.rw-.sdmp, sse.elf, 6219.1.000056118edeb000.000056118ef3a000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: sse.elf, 6215.1.00007ffef1938000.00007ffef1959000.rw-.sdmp, sse.elf, 6217.1.00007ffef1938000.00007ffef1959000.rw-.sdmp, sse.elf, 6219.1.00007ffef1938000.00007ffef1959000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: sse.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: sse.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sse.elf	59%	Virustotal		Browse
sse.elf	75%	ReversingLabs	Linux.Backdoor.Gafgyt
sse.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.33.192.138	unknown	Romania	9009	M247GB	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.33.192.138	ssp.elf	Get hash	malicious	Gafgyt	Browse
	ssl.elf	Get hash	malicious	Gafgyt	Browse
	ssb.elf	Get hash	malicious	Gafgyt	Browse
	ss.elf	Get hash	malicious	Gafgyt	Browse
	ssd.elf	Get hash	malicious	Gafgyt	Browse
	ssg.elf	Get hash	malicious	Gafgyt	Browse
	ssy.elf	Get hash	malicious	Gafgyt	Browse
	ssh.elf	Get hash	malicious	Gafgyt	Browse
	ssc.elf	Get hash	malicious	Gafgyt	Browse
	sst.elf	Get hash	malicious	Gafgyt	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	ssp.elf	Get hash	malicious	Gafgyt	Browse
	2.elf	Get hash	malicious	Unknown	Browse
	12.elf	Get hash	malicious	Unknown	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	ss.elf	Get hash	malicious	Gafgyt	Browse
	boatnet.x86.elf	Get hash	malicious	Unknown	Browse
	Space.arm5.elf	Get hash	malicious	Unknown	Browse
	ssd.elf	Get hash	malicious	Gafgyt	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	ssp.elf	Get hash	malicious	Gafgyt	Browse
	2.elf	Get hash	malicious	Unknown	Browse
	12.elf	Get hash	malicious	Unknown	Browse
	Space.arm.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	ss.elf	Get hash	malicious	Gafgyt	Browse
	boatnet.x86.elf	Get hash	malicious	Unknown	Browse
	Space.arm5.elf	Get hash	malicious	Unknown	Browse
	ssd.elf	Get hash	malicious	Gafgyt	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	ssp.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	12.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ss.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	boatnet.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
CANONICAL-ASGB	ssp.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	12.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ss.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	boatnet.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
M247GB	ssp.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssl.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssd.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssg.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssy.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssh.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	ssc.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	173.211.38.225
INIT7CH	ssp.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	2.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	12.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ss.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	boatnet.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ssd.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.974125204751729
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sse.elf
File size:	176'658 bytes
MD5:	b926ed51ed242929568603920eeafa80
SHA1:	544d897f4ae68acdf362913d01aed9ce40a0f8f7
SHA256:	78d9bd20f10d57676983187d288e56103e535a16d8074efbcfa75491e541f452
SHA512:	da8f3ec6d2f0b156b7129e91c8f06f2e4b3e6c9fef7211e15ae44c23e713915df402ac75282dafc52ee16aa3fb7edfe35bb431c0fdf8a29242d73af903bd9a1e
SSDEEP:	3072:L7EM1YSFQaDaV7r/OqZru7lt/CUsPD3MMM/9DsfGSfmUIwHyA/WRZ:R1QaDaV7r/RZIt/5sPD3/M/9DsOSfmUE
TLSH:	2D044A04D650975BC2E223BAE7CB424E33335F94A3D733198938BBB43BD27A95E22515
File Content Preview:	.ELF..............(.........4...........4. ...(........p.....,...,.. ... ...............................................................<u..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	138392
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x182c0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x203b0	0x183b0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x203c0	0x183c0	0x291c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x22cdc	0x1acdc	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x22cf4	0x1acf4	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2b000	0x1b000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2b004	0x1b004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2b004	0x1b004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2b008	0x1b008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2b00c	0x1b00c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2b010	0x1b010	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2b0c0	0x1b0c0	0x258	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2b318	0x1b318	0x7224	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1b318	0xcf4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1c010	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1c150	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1c363	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1e3a6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1ea88	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1f900	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1fbb8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x20482	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x21611	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21b69	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21b7f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22120	0x5fa0	0x10	0x0		28	843	4
.strtab	STRTAB	0x0	0x280c0	0x3152	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1acf4	0x22cf4	0x22cf4	0x120	0x120	4.4827	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1ae14	0x1ae14	6.0649	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1b000	0x2b000	0x2b000	0x318	0x753c	4.0010	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1b004	0x2b004	0x2b004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x203b0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x203c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x22cdc	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x22cf4	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2b000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2b004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2b004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2b008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2b00c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2b010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2b0c0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2b318	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x203b0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x203bc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1065c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1200c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1231c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1251c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1254c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1256c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1400c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1421c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1428c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1443c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1605c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1607c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1652c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1752c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1764c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17684	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17efc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1961c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1979c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c17c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eeb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eefc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f16c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f45c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fbdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2037c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x2b0c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b0c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x877c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x994c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20694	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x9aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa0a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb684	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc138	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdce4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf93c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b108	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x10568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1060c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x11f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1206c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1217c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x122d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1235c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x123dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1246c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b10c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x215ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2b114	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x218ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1259c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1269c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21c14	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1314c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b11c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x21c1c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x137b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x139f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21ca0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13df4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14004	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1404c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1414c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14284	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b120	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x158b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b138	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15cf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b150	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2b1e8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2280c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16260	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b1fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x163d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1738c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17680	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1786c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b214	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17e40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1803c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18170	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1822c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1857c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x228a0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1865c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b224	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2b220	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x196f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22900	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a60c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aaf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b184	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b44c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b76c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b308	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b87c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1becc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c068	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c5c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c84c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b30c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1d1b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d20c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d628	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b30e	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x229bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dcb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e220	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b310	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x229dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1f150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1faf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5548	.symtab	0x2287c	12	OBJECT	<unknown>	DEFAULT	4
C.152.6371	.symtab	0x20d8c	36	OBJECT	<unknown>	DEFAULT	4
C.156.6413	.symtab	0x2112c	24	OBJECT	<unknown>	DEFAULT	4
C.186.6692	.symtab	0x21350	20	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x228a0	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x22888	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x21bec	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x228dc	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x228b8	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x228d0	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x228c4	12	OBJECT	<unknown>	DEFAULT	4
Hexed	.symtab	0xbb98	380	FUNC	<unknown>	DEFAULT	2
KHcommSOCK	.symtab	0x2b338	4	OBJECT	<unknown>	DEFAULT	14
KHserverHACKER	.symtab	0x2b0f8	4	OBJECT	<unknown>	DEFAULT	13
LOCAL_ADDR	.symtab	0x32028	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x138d8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x138f4	0	NOTYPE	<unknown>	DEFAULT	2
Percocet_bp	.symtab	0x2b0d8	4	OBJECT	<unknown>	DEFAULT	13
Q	.symtab	0x2b354	16384	OBJECT	<unknown>	DEFAULT	14
RSF	.symtab	0xbd14	596	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0xcaf4	556	FUNC	<unknown>	DEFAULT	2
UDPBYPASS	.symtab	0xae90	336	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x2b0ec	12	OBJECT	<unknown>	DEFAULT	13
_Exit	.symtab	0x1200c	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2b010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1ef04	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1ef08	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1fbb8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1eefc	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1ef40	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1fbdc	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x2037c	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1ef34	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1fb4c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1fb70	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1fb94	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1ee64	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1f47c	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1eeb0	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2b10c	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x215ec	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2b310	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x229dc	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2b114	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x218ec	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2b000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2b000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2b10c	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2b310	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x2b114	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x174f0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x174d4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2b110	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2b314	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x2b118	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x1254c	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x11e80	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1a9d4	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13ca8	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x174f0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11f18	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x17580	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x176a0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x17610	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x17580	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x17564	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x176a0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x17684	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x170d8	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x14538	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1455c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x14514	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x178b8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x17988	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x17610	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x175f4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13cc0	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1200c	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x15910	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1605c	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1b830	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x174f0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x18230	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x18998	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x189cc	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x18670	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13f54	116	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x120b4	64	FUNC	<unknown>	HIDDEN	2
__GI_execl	.symtab	0x16334	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x17f70	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x16270	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x18b48	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11f18	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1a628	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1a118	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1a9d4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1a25c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1ab00	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x18e78	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x16c10	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x136c8	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1bbb8	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1bbdc	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1b894	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x13700	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1a9d4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x120f4	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x17fb0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x12120	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x17fc4	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13e84	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x13ea0	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1b18c	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1d754	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1dad8	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x17fd8	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x17260	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x12148	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13fc8	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x18000	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x18040	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x13e0c	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x13dfc	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x13e5c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1b094	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1c5c4	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1c24c	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x15e78	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x12180	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1aff4	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x12260	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1dcb4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1aba0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x137e0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1dd30	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1c0a8	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1ac90	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x137f0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x17dcc	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x18054	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x18098	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x18118	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x13e3c	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x13e2c	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x17580	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x18410	196	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x12298	64	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1db9c	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x172a8	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x15a50	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x15d10	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1c0cc	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x176a0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x18584	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x14098	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x14150	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x18178	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x12360	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1421c	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x142d8	136	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x14360	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x15f70	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x17e74	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x143ec	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1443c	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x14450	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x123e4	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x17398	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x143a8	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x125a0	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x15da0	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1dc10	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1e1bc	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x13910	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1ad70	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x13890	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x13890	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x13a00	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1ae5c	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1dd40	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x138b0	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x13a24	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x13ae0	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1afb4	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1aea0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1aef0	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x13bac	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13dcc	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1af3c	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1607c	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1652c	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1b018	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x12470	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x181e4	20	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1251c	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1dc74	64	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x16ba0	112	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x125d4	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x181f8	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x124a0	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x18a14	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x18a8c	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x18a68	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x17610	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2b00c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2b00c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1fbb8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1fb4c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1fb70	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1fb94	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1e424	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1ed80	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1ed80	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1ed64	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1ee10	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1e424	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1ed98	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1ede0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1edf8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1edc8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1edb0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1eac4	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1e834	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1e418	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1e420	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1e780	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1e758	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1e2d4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1e400	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1e7d4	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x17f20	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1e734	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x11d58	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x11e54	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1e7c0	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1fb18	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1fb10	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1fb08	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2faa0	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2b1fc	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x3253c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2b318	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2b318	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x17934	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x174f0	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1d670	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x174d4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1ece0	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2b110	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2b314	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x2b118	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x32004	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2b0c0	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1c860	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1de60	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x17f14	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x17f08	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x11e6c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1eac4	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1e2d4	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1c958	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2b008	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x2b0c0	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x1e228	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1dd74	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1df14	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x3253c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2fa98	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1ece0	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x1254c	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x16c0c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x22e14	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x22cf4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2f548	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1e780	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x11e80	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1a9d4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2b00c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2b008	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1ee10	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1e7d4	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1e758	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1e7c0	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1e734	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x16c10	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x324f4	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x324f8	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2f54c	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2b004	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1ecd0	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1d708	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1ba70	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x17fd8	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x17260	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x13ca8	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1f2bc	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1f3a4	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1fb3c	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1f338	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1f45c	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1fb44	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1fc20	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x20334	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1f5c0	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1ecd0	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2b008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2b004	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1ecd8	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x174f0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13f54	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x17710	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x17798	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x11f18	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x16c10	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x324fc	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x18118	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x17580	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x176a0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x14098	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x14150	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x12360	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1421c	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x142d8	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b564	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x17e74	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2fa94	4	OBJECT	<unknown>	DEFAULT	14
__libc_waitpid	.symtab	0x124a0	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x17610	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x17074	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x16fdc	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x229bc	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1ecd8	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x154e0	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x14580	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2b120	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x3217c	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x15430	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1e834	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x32530	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x32534	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x1ece0	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x17580	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x1df74	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1d214	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x17564	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2fa9c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2b004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2b004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2b218	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2b21c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1b794	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1787c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x17874	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x17874	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x17874	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x17874	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x176a0	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1dfa4	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x17684	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x170d8	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x32528	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x2b30f	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x3200c	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x2b30e	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x1fb20	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2faa4	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x3252c	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x32538	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x14538	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1455c	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x14514	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1da98	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1b888	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2b230	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1bd9c	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1bdf4	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1bed0	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x192f8	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1bf98	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1c06c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1bfc8	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1961c	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x196f8	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2b234	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1e420	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x13f10	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x14054	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x14108	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x141d8	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x1428c	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x17e48	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x180d8	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x1db5c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x17f30	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1231c	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1b540	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x178b8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x17988	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x179e0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2b214	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x11d58	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x16ba0	112	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x17610	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x175f4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x13cc0	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1b9c4	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1b8f8	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2f368	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x3253c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x126a4	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x32124	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x3214c	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2b11c	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1b7a0	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x2b308	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x1b7d8	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x32520	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x32524	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x32514	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x32510	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x32518	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x32508	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1b4d8	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x32504	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x3251c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x3250c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x32500	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2b318	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x3253c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_endswith	.symtab	0x11914	236	FUNC	<unknown>	DEFAULT	2
_exit	.symtab	0x1200c	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x203b0	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2fac8	8192	OBJECT	<unknown>	DEFAULT	14

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:59:28.668279886 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 03:59:30.815531969 CET	44412	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:30.820415974 CET	65487	44412	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:30.820482016 CET	44412	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:30.821989059 CET	44412	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:30.826833963 CET	65487	44412	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:31.230381012 CET	65487	44412	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:31.230396032 CET	65487	44412	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:31.230427027 CET	44412	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:31.230813026 CET	44412	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:31.235542059 CET	65487	44412	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:34.299546957 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 03:59:35.835347891 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 03:59:46.250286102 CET	44414	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:46.255194902 CET	65487	44414	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:46.255301952 CET	44414	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:46.255772114 CET	44414	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:46.261291027 CET	65487	44414	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:46.661796093 CET	65487	44414	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:46.661900997 CET	44414	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:46.661931992 CET	65487	44414	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:46.662069082 CET	44414	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 03:59:46.666939020 CET	65487	44414	89.33.192.138	192.168.2.23
Jan 11, 2025 03:59:48.633538008 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 04:00:00.919897079 CET	42836	443	192.168.2.23	91.189.91.43
Jan 11, 2025 04:00:01.665966988 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:01.670829058 CET	65487	44416	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:01.670897007 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:02.679605007 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:02.684482098 CET	65487	44416	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:02.684578896 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:02.684667110 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:02.689403057 CET	65487	44416	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:03.089163065 CET	65487	44416	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:03.089193106 CET	65487	44416	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:03.089315891 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:03.089421034 CET	44416	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:03.094223976 CET	65487	44416	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:07.063090086 CET	42516	80	192.168.2.23	109.202.202.202
Jan 11, 2025 04:00:18.093686104 CET	44418	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:18.098824978 CET	65487	44418	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:18.098918915 CET	44418	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:18.098920107 CET	44418	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:18.103822947 CET	65487	44418	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:21.511792898 CET	65487	44418	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:21.511857986 CET	65487	44418	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:21.511996984 CET	44418	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:21.512095928 CET	44418	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:21.516876936 CET	65487	44418	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:29.587946892 CET	43928	443	192.168.2.23	91.189.91.42
Jan 11, 2025 04:00:36.513741016 CET	44420	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:36.518562078 CET	65487	44420	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:36.518621922 CET	44420	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:36.518646955 CET	44420	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:36.523401976 CET	65487	44420	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:36.940506935 CET	65487	44420	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:36.940526962 CET	65487	44420	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:36.940656900 CET	44420	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:36.940745115 CET	44420	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:36.945497990 CET	65487	44420	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:51.943706036 CET	44422	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:51.948615074 CET	65487	44422	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:51.948692083 CET	44422	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:51.948728085 CET	44422	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:51.953511000 CET	65487	44422	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:52.347246885 CET	65487	44422	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:52.347336054 CET	65487	44422	89.33.192.138	192.168.2.23
Jan 11, 2025 04:00:52.347404957 CET	44422	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:52.347498894 CET	44422	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:00:52.352372885 CET	65487	44422	89.33.192.138	192.168.2.23
Jan 11, 2025 04:01:07.349886894 CET	44424	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:01:07.354825020 CET	65487	44424	89.33.192.138	192.168.2.23
Jan 11, 2025 04:01:07.354899883 CET	44424	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:01:07.354938030 CET	44424	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:01:07.359707117 CET	65487	44424	89.33.192.138	192.168.2.23
Jan 11, 2025 04:01:57.479353905 CET	65487	44424	89.33.192.138	192.168.2.23
Jan 11, 2025 04:01:57.479707003 CET	44424	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:01:57.613687992 CET	65487	44424	89.33.192.138	192.168.2.23
Jan 11, 2025 04:01:57.614309072 CET	44424	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:02:57.481126070 CET	65487	44424	89.33.192.138	192.168.2.23
Jan 11, 2025 04:02:57.481628895 CET	44424	65487	192.168.2.23	89.33.192.138
Jan 11, 2025 04:02:57.577299118 CET	65487	44424	89.33.192.138	192.168.2.23
Jan 11, 2025 04:02:57.577581882 CET	44424	65487	192.168.2.23	89.33.192.138

System Behavior

Analysis Process: sse.elf PID: 6215, Parent PID: 6131

General

Start time (UTC):	02:59:29
Start date (UTC):	11/01/2025
Path:	/tmp/sse.elf
Arguments:	/tmp/sse.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sse.elf PID: 6217, Parent PID: 6215

General

Start time (UTC):	02:59:30
Start date (UTC):	11/01/2025
Path:	/tmp/sse.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sse.elf PID: 6219, Parent PID: 6215

General

Start time (UTC):	02:59:30
Start date (UTC):	11/01/2025
Path:	/tmp/sse.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sse.elf PID: 6221, Parent PID: 6219

General

Start time (UTC):	02:59:30
Start date (UTC):	11/01/2025
Path:	/tmp/sse.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sse.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: sse.elf PID: 6215, Parent PID: 6131

General

Chronological Activities

Analysis Process: sse.elf PID: 6217, Parent PID: 6215

General

Chronological Activities

Analysis Process: sse.elf PID: 6219, Parent PID: 6215

General

Chronological Activities

Analysis Process: sse.elf PID: 6221, Parent PID: 6219

General

Chronological Activities

Linux Analysis Report
sse.elf