Edit tour

Linux Analysis Report
felkawtf.armv6l.elf

Overview

General Information

Sample name:	felkawtf.armv6l.elf
Analysis ID:	1620306
MD5:	f33edad75612663c2502da4439f0d589
SHA1:	02aa208c49e1b90807d7209cd60be856a1064d92
SHA256:	b27ebe483edb1272b06de1e7d404c37d695224bda9168a8c41b1f3ade35df621
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Suricata IDS alerts with low severity for network traffic

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1620306
Start date and time:	2025-02-20 21:02:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	felkawtf.armv6l.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: 15.204.128.30:6140

Runtime Messages

Command:	/tmp/felkawtf.armv6l.elf
PID:	5531
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

felkawtf.armv6l.elf (PID: 5531, Parent: 5449, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/felkawtf.armv6l.elf

felkawtf.armv6l.elf New Fork (PID: 5533, Parent: 5531)

felkawtf.armv6l.elf New Fork (PID: 5535, Parent: 5533)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
felkawtf.armv6l.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
felkawtf.armv6l.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x122ac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5531.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5531.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x122ac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5533.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5533.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x122ac:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: felkawtf.armv6l.elf PID: 5531	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10b6d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x12b55:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: felkawtf.armv6l.elf PID: 5533	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5813:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x77fb:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE ELF/Mirai Variant CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-20T21:03:28.765590+0100	2846407	1	A Network Trojan was detected	192.168.2.15	38656	15.204.128.30	6140	TCP
2025-02-20T21:06:33.580405+0100	2846407	1	A Network Trojan was detected	192.168.2.15	38658	15.204.128.30	6140	TCP

ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-20T21:03:28.771645+0100	2848448	1	A Network Trojan was detected	192.168.2.15	38656	15.204.128.30	6140	TCP
2025-02-20T21:06:33.585538+0100	2848448	1	A Network Trojan was detected	192.168.2.15	38658	15.204.128.30	6140	TCP

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: felkawtf.armv6l.elf

Avira: detected

Found malware configuration

Source: felkawtf.armv6l.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "15.204.128.30:6140"}

Multi AV Scanner detection for submitted file

Source: felkawtf.armv6l.elf	ReversingLabs: Detection: 55%
Source: felkawtf.armv6l.elf	Virustotal: Detection: 57%			Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/felkawtf.armv6l.elf (PID: 5531)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.15:38658 -> 15.204.128.30:6140
Source: Network traffic	Suricata IDS: 2846407 - Severity 1 - ETPRO MALWARE ELF/Mirai Variant CnC Activity : 192.168.2.15:38656 -> 15.204.128.30:6140

Source: global traffic

TCP traffic: 192.168.2.15:38656 -> 15.204.128.30:6140

Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.15:38658 -> 15.204.128.30:6140
Source: Network traffic	Suricata IDS: 2848448 - Severity 1 - ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown) : 192.168.2.15:38656 -> 15.204.128.30:6140

Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	TCP traffic detected without corresponding DNS query: 15.204.128.30
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: felkawtf.armv6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5531.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5533.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: felkawtf.armv6l.elf PID: 5531, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: felkawtf.armv6l.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: felkawtf.armv6l.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5531.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5533.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: felkawtf.armv6l.elf PID: 5531, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: felkawtf.armv6l.elf PID: 5533, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/bzero.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: felkawtf.armv6l.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S

Source: /tmp/felkawtf.armv6l.elf (PID: 5531)

Queries kernel information via 'uname':

Jump to behavior

Source: felkawtf.armv6l.elf, 5531.1.000055979dbf8000.000055979dd26000.rw-.sdmp, felkawtf.armv6l.elf, 5533.1.000055979dbf8000.000055979dd26000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: felkawtf.armv6l.elf, 5531.1.000055979dbf8000.000055979dd26000.rw-.sdmp, felkawtf.armv6l.elf, 5533.1.000055979dbf8000.000055979dd26000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: felkawtf.armv6l.elf, 5531.1.00007ffe6dfe7000.00007ffe6e008000.rw-.sdmp, felkawtf.armv6l.elf, 5533.1.00007ffe6dfe7000.00007ffe6e008000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: felkawtf.armv6l.elf, 5531.1.00007ffe6dfe7000.00007ffe6e008000.rw-.sdmp, felkawtf.armv6l.elf, 5533.1.00007ffe6dfe7000.00007ffe6e008000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/felkawtf.armv6l.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/felkawtf.armv6l.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: felkawtf.armv6l.elf, type: SAMPLE
Source: Yara match	File source: 5531.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.0 Mobile/14F89 Safari/602.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 5.0.2; HTCONE Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Mobile/14F89
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity
Source: Traffic	Suricata IDS: ETPRO MALWARE ELF/Mirai Variant CnC Activity

Yara detected Gafgyt

Source: Yara match	File source: felkawtf.armv6l.elf, type: SAMPLE
Source: Yara match	File source: 5531.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5533.1.00007f0eb0017000.00007f0eb002c000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "15.204.128.30:6140"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
felkawtf.armv6l.elf	55%	ReversingLabs	Linux.Backdoor.Gafgyt
felkawtf.armv6l.elf	57%	Virustotal		Browse
felkawtf.armv6l.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
15.204.128.30:6140	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
15.204.128.30	unknown	United States		71	HP-INTERNET-ASUS	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
15.204.128.30	felkawtf.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.armv7l.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.sparc.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	felkawtf.i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	pXdN91.i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	pXdN91.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	pXdN91.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	felkawtf.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	felkawtf.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.armv7l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.24
	felkawtf.sparc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HP-INTERNET-ASUS	felkawtf.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	Orden de compra_xl.exe	Get hash	malicious	DarkCloud	Browse	15.235.119.29
	felkawtf.armv5l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.armv7l.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.sparc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	felkawtf.i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse	15.204.128.30
	sys.x86_64.elf	Get hash	malicious	Xmrig	Browse	161.114.29.209
	http://yesincs.com	Get hash	malicious	Unknown	Browse	15.160.106.203

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.10025460271971
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	felkawtf.armv6l.elf
File size:	119'658 bytes
MD5:	f33edad75612663c2502da4439f0d589
SHA1:	02aa208c49e1b90807d7209cd60be856a1064d92
SHA256:	b27ebe483edb1272b06de1e7d404c37d695224bda9168a8c41b1f3ade35df621
SHA512:	fab1764e6cfaa881e8fbcaa24588bfa0e0958d4acf5920ea0891bc6d1e8f81f9eecb090ea056fcf7426fbd8737576f5041f5045e3b12ee25628752c3629e5206
SSDEEP:	3072:2JaDAC5tpml5asLOtDtFdWzQbmgQOWsXGMN:EaDAC5qLOtDczQbmgQOWCGMN
TLSH:	9BC32A01E5548B1BC1D2277BB69FC259372B1AE4979733115B24AFB42BC27FE0A39C21
File Content Preview:	.ELF..............(.........4....^......4. ...(........pTA..T...T...................................dA..dA..............dA..dA..dA..h...$j..........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	89732
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x101d4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x182a4	0x102a4	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x182b8	0x102b8	0x3e84	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1c13c	0x1413c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1c154	0x14154	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x24164	0x14164	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x24168	0x14168	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2416c	0x1416c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x24170	0x14170	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x24174	0x14174	0x78	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x241ec	0x141ec	0x2e0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x244d0	0x144cc	0x66b8	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x144cc	0xbf8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x150c8	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x151a8	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x15658	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x156e4	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x15d3c	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x15d94	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x15da4	0xdd	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16244	0x4970	0x10	0x0		23	637	4
.strtab	STRTAB	0x0	0x1abb4	0x27b6	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x14154	0x1c154	0x1c154	0x10	0x10	2.4056	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x14164	0x14164	6.2542	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x14164	0x24164	0x24164	0x368	0x6a24	3.9492	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x182a4	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x182b8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1c13c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1c154	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x24164	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x24168	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2416c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x24170	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x24174	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x241ec	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x244d0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x182a4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x182b0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x846c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x99e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa8bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb0d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcfd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcfe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd10c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd39c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe9ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeadc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf01c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf08c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf21c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1039c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1045c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1074c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1086c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1192c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11db8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1238c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1291c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1424c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1449c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1533c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1548c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1708c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2416c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24168	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x241f0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x241f4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x87e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x92f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x99e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5a8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb0c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc23c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc5b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24270	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x24278	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0xd408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd58c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x242b4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x24280	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1b098	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xde38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe680	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x243bc	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0xeab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeeb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf10c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x243c0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x100a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x243d8	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x102c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x243f0	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x24488	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x105dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcc4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2449c	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x10b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11410	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11474	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244b4	0	NOTYPE	<unknown>	DEFAULT	12
$d	.symtab	0x1183c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11990	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd40	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11e90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a718	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11eb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1225c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12520	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd70	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x135e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1369c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1380c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16748	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x244c4	0	NOTYPE	<unknown>	DEFAULT	12
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x1bd40	24	OBJECT	<unknown>	DEFAULT	4
C.125.5691	.symtab	0x1a80c	12	OBJECT	<unknown>	DEFAULT	4
C.76.5274	.symtab	0x1a5a8	32	OBJECT	<unknown>	DEFAULT	4
Laligned	.symtab	0xe868	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xe884	0	NOTYPE	<unknown>	DEFAULT	2
Nulled	.symtab	0x2a748	80	OBJECT	<unknown>	DEFAULT	13
Q	.symtab	0x24508	16384	OBJECT	<unknown>	DEFAULT	13
SendHTTP	.symtab	0xaf44	400	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0xb0d4	544	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0x9e60	540	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0xd33c	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x24174	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x24270	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1aa98	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x244c4	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1be3c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x24278	4	OBJECT	<unknown>	DEFAULT	12
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1ad98	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x24164	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x24164	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x24270	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_tolower	.symtab	0x244c4	4	OBJECT	<unknown>	HIDDEN	12
__GI___C_ctype_toupper	.symtab	0x24278	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_b	.symtab	0x24274	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_tolower	.symtab	0x244c8	4	OBJECT	<unknown>	HIDDEN	12
__GI___ctype_toupper	.symtab	0x2427c	4	OBJECT	<unknown>	HIDDEN	12
__GI___errno_location	.symtab	0xd3f4	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xd214	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x13a44	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0xebcc	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x11ea4	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xd1a8	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0xf240	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0xf264	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0xf21c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x11348	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x11418	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0xec14	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xd33c	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x10100	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x10830	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x14e80	76	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xd0d8	52	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x118d0	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xd368	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x11aac	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x121e8	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1221c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x11ec0	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0xef68	56	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2a718	4	OBJECT	<unknown>	HIDDEN	13
__GI_exit	.symtab	0x10a2c	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1238c	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xd1a8	108	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x13838	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x13518	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x13a44	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x135f4	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x13b70	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x12540	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xd014	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0xe6b0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x15318	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1533c	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x14f0c	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0xe6e8	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x13a44	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x119ac	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x11904	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x11918	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x11998	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0xeee4	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0xef00	104	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x146c0	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x16ce8	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x17014	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x11894	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xcfd0	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14ed8	52	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0xefa0	56	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0xd174	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x118bc	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2a71c	4	OBJECT	<unknown>	HIDDEN	13
__GI_htonl	.symtab	0xedc4	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0xedb4	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0xeebc	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x145c8	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0xeea0	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0xee14	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x15b98	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x15838	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1074c	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xd2e8	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0xed14	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0xd39c	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xd140	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x170e4	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x140a0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xe8d0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17150	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x14478	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x142fc	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xe7a0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x11758	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x15194	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x119d8	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x11a0c	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0xedf4	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0xede4	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xcf70	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x11c74	172	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x16fe0	52	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0xf148	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x10240	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x105e4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1424c	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xd10c	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x11db8	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0xf01c	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1192c	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xd098	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0xf054	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0xf08c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xd2b4	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0xf0cc	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x10500	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x117c0	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0xf164	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11a74	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10ae4	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0xf110	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xd410	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x10674	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1708c	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x175fc	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0xeadc	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1449c	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xe8b0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xe8b0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xeab8	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x14208	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x17160	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xe840	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x156ac	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0xe9ec	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x14588	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x14428	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x143dc	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xe8f0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xebe4	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x14190	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x10850	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10cdc	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0xed38	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xcfe4	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xd3c4	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x175c8	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xd444	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x11860	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xd048	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x12264	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x122dc	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x122b8	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xd280	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x24170	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x24170	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x17864	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x181c0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x181c0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x181a4	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x18250	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x17864	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x181d8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x18220	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x18238	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x18208	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x181f0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x17f04	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x17c74	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x17858	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x17860	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x17bc0	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x17b98	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x17714	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x17840	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x17c14	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x17b74	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xce48	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xcf44	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x17c00	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x14ecc	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x14ed0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x14ed4	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2a710	4	OBJECT	<unknown>	HIDDEN	13
__atexit_lock	.symtab	0x2449c	24	OBJECT	<unknown>	DEFAULT	12
__bss_end__	.symtab	0x2ab88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x244cc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x244cc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x113c4	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x16c04	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x18120	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x24274	4	OBJECT	<unknown>	DEFAULT	12
__ctype_tolower	.symtab	0x244c8	4	OBJECT	<unknown>	DEFAULT	12
__ctype_toupper	.symtab	0x2427c	4	OBJECT	<unknown>	DEFAULT	12
__curbrk	.symtab	0x2a720	4	OBJECT	<unknown>	HIDDEN	13
__data_start	.symtab	0x241ec	0	NOTYPE	<unknown>	DEFAULT	12
__decode_dotted	.symtab	0x15e1c	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x17280	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x11858	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1184c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xcf5c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x17f04	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x17714	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x15f14	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2416c	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x241ec	0	OBJECT	<unknown>	HIDDEN	12
__encode_dotted	.symtab	0x17668	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x17194	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x17334	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2ab88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2a708	4	OBJECT	<unknown>	DEFAULT	13
__eqdf2	.symtab	0x18120	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xd3f4	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1c164	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1c154	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2a700	4	OBJECT	<unknown>	HIDDEN	13
__extendsfdf2	.symtab	0x17bc0	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xd214	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x13a44	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x24170	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x2416c	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x18250	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x17c14	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x17b98	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x17c00	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x17b74	36	FUNC	<unknown>	HIDDEN	2
__frame_dummy_init_array_entry	.symtab	0x24168	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x18110	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x16c9c	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x151d4	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x11894	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0xebcc	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x18110	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x11ea4	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x2416c	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x24168	0	NOTYPE	<unknown>	HIDDEN	8
__ledf2	.symtab	0x18118	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xd368	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0xef68	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xd1a8	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xd014	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x170e4	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x11a0c	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xcf70	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xd10c	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0xf01c	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xd098	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0xf054	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0xf08c	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x117c0	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2a704	4	OBJECT	<unknown>	DEFAULT	13
__libc_waitpid	.symtab	0xd048	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xd280	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x1be1c	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x18118	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0xfcd0	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0xf288	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x243c0	24	OBJECT	<unknown>	DEFAULT	12
__malloc_state	.symtab	0x2a7f4	888	OBJECT	<unknown>	DEFAULT	13
__malloc_trim	.symtab	0xfc20	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x17c74	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x2ab7c	4	OBJECT	<unknown>	HIDDEN	13
__nameservers	.symtab	0x2ab80	4	OBJECT	<unknown>	HIDDEN	13
__nedf2	.symtab	0x18120	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x17394	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x167a8	1116	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2a70c	4	OBJECT	<unknown>	DEFAULT	13
__preinit_array_end	.symtab	0x24168	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x24168	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x244b8	4	OBJECT	<unknown>	DEFAULT	12
__progname_full	.symtab	0x244bc	4	OBJECT	<unknown>	DEFAULT	12
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x1130c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x11304	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x11304	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x11304	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x11304	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x173c4	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x2ab74	4	OBJECT	<unknown>	HIDDEN	13
__resolv_attempts	.symtab	0x244c3	1	OBJECT	<unknown>	HIDDEN	12
__resolv_lock	.symtab	0x2a728	24	OBJECT	<unknown>	DEFAULT	13
__resolv_timeout	.symtab	0x244c2	1	OBJECT	<unknown>	HIDDEN	12
__rtld_fini	.symtab	0x2a714	4	OBJECT	<unknown>	HIDDEN	13
__searchdomain	.symtab	0x2ab78	4	OBJECT	<unknown>	HIDDEN	13
__searchdomains	.symtab	0x2ab84	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0xf240	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0xf264	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0xf21c	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x242c0	4	OBJECT	<unknown>	DEFAULT	12
__stdio_READ	.symtab	0x1548c	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x12560	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x154e4	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1291c	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xd560	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x1b098	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x155a8	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x15670	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x155d8	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x12a5c	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xd668	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x242c4	4	OBJECT	<unknown>	DEFAULT	12
__subdf3	.symtab	0x17860	788	FUNC	<unknown>	HIDDEN	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x11a40	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x11348	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x11418	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x11484	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x244b4	4	OBJECT	<unknown>	HIDDEN	12
__udivsi3	.symtab	0xce48	252	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0xec14	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x15030	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x14f64	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x150dc	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2a510	10	OBJECT	<unknown>	DEFAULT	13
_bss_end__	.symtab	0x2ab88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0xd698	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2a79c	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_handler	.symtab	0x2a7c4	40	OBJECT	<unknown>	HIDDEN	13
_custom_printf_spec	.symtab	0x243bc	4	OBJECT	<unknown>	HIDDEN	12
_dl_aux_init	.symtab	0x14e48	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2ab6c	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x2ab70	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x244cc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2ab88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2a718	4	OBJECT	<unknown>	DEFAULT	13
_exit	.symtab	0xd33c	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x182a4	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x28510	8192	OBJECT	<unknown>	DEFAULT	13
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xd6ec	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x12d24	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2a71c	4	OBJECT	<unknown>	DEFAULT	13
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x12b2c	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x13c10	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xde58	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xe140	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xdef8	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xdf3c	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xe0ec	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1131c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x11314	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2a7ec	8	OBJECT	<unknown>	HIDDEN	13
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x12614	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xd4f8	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x242c8	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_add_lock	.symtab	0x24280	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x136b0	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2850c	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_del_lock	.symtab	0x24298	24	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x28508	4	OBJECT	<unknown>	DEFAULT	13
_stdio_streams	.symtab	0x242cc	240	OBJECT	<unknown>	DEFAULT	12
_stdio_term	.symtab	0xd594	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x242b0	4	OBJECT	<unknown>	DEFAULT	12
_stdlib_strto_l	.symtab	0x1086c	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x12b9c	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1b168	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x12bc8	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xd770	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x10100	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xd064	52	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x10830	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x10830	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0xe8a0	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2a6fc	4	OBJECT	<unknown>	DEFAULT	13
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x14e80	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0xf164	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x2a520	16	OBJECT	<unknown>	DEFAULT	13
buf.5444	.symtab	0x2a530	440	OBJECT	<unknown>	DEFAULT	13
bzero	.symtab	0xe8e0	12	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x24268	4	OBJECT	<unknown>	DEFAULT	12
calloc	.symtab	0x14960	308	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cck	.symtab	0x9d10	336	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0xd0d8	52	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x118d0	52	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xd368	52	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closedir	.symtab	0x11aac	248	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
closenameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x241f4	4	OBJECT	<unknown>	DEFAULT	12
completed.4959	.symtab	0x244d0	1	OBJECT	<unknown>	DEFAULT	13
connect	.symtab	0xef68	56	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x95cc	628	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9ae8	340	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x24264	4	OBJECT	<unknown>	DEFAULT	12
data_start	.symtab	0x241f0	0	NOTYPE	<unknown>	DEFAULT	12
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2a708	4	OBJECT	<unknown>	DEFAULT	13
errno	.symtab	0x2a718	4	OBJECT	<unknown>	DEFAULT	13
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x10a2c	184	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1bd70	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1238c	436	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xd1a8	108	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x11ba4	208	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x846c	212	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x11d20	152	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x13838	524	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x13518	220	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x13a44	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x135f4	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x13b70	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1bd58	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x12540	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0xd014	52	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0xe6b0	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0xfe84	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x15318	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x15318	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1533c	336	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x14f0c	88	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0xe6e8	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getArch	.symtab	0xb2f4	36	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x91d4	104	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x8540	700	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0x8408	100	FUNC	<unknown>	DEFAULT	2
getSoftware	.symtab	0xc278	444	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc	.symtab	0x13518	220	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x13a44	300	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x119ac	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x11904	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x11918	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x11998	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0xeee4	28	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2	.symtab	0xef00	104	FUNC	<unknown>	DEFAULT	2
gethostbyname2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x146c0	672	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x16ce8	760	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostname	.symtab	0x17014	120	FUNC	<unknown>	DEFAULT	2
gethostname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x11894	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xcfd0	20	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x14ed8	52	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0xefa0	56	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0xefd8	68	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0xd174	52	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x118bc	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x244f4	4	OBJECT	<unknown>	DEFAULT	13
h_errno	.symtab	0x2a71c	4	OBJECT	<unknown>	DEFAULT	13
hoste.5443	.symtab	0x2a6e8	20	OBJECT	<unknown>	DEFAULT	13
htonl	.symtab	0xedc4	32	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0xedb4	16	FUNC	<unknown>	DEFAULT	2
i.4589	.symtab	0x2426c	4	OBJECT	<unknown>	DEFAULT	12
index	.symtab	0xeadc	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0xeebc	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x145c8	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0xeea0	28	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0xee14	140	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x15b98	644	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x15a54	324	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x15838	540	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x15768	208	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xc434	400	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81ec	216	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x1039c	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1074c	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0xd2e8	84	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0xed14	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xd39c	40	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xd140	52	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
last_id.5501	.symtab	0x244c0	2	OBJECT	<unknown>	DEFAULT	12
last_ns_num.5500	.symtab	0x2a724	4	OBJECT	<unknown>	DEFAULT	13
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bzero.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9840	424	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x170e4	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x24500	6	OBJECT	<unknown>	DEFAULT	13
main	.symtab	0xc5c4	2180	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x244f0	4	OBJECT	<unknown>	DEFAULT	13
makeIPPacket	.symtab	0x99e8	256	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x923c	184	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0xf300	2336	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x100c0	64	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x140a0	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0xe8d0	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x17150	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x14478	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x142fc	224	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0xe7a0	156	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x11758	104	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x15194	64	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x119d8	52	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x243d8	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x243f0	24	OBJECT	<unknown>	DEFAULT	12
nanosleep	.symtab	0x11a0c	52	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1358	.symtab	0x2a51c	4	OBJECT	<unknown>	DEFAULT	13
nprocessors_onln	.symtab	0x10b90	332	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0xedf4	32	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0xede4	16	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x244f8	8	OBJECT	<unknown>	DEFAULT	13
object.4967	.symtab	0x244d4	24	OBJECT	<unknown>	DEFAULT	13
open	.symtab	0xcf70	96	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opendir	.symtab	0x11c74	172	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2a744	4	OBJECT	<unknown>	DEFAULT	13
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pids	.symtab	0x2a798	4	OBJECT	<unknown>	DEFAULT	13
poll	.symtab	0x16fe0	52	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-20T21:03:28.765590+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.15	38656	15.204.128.30	6140	TCP
2025-02-20T21:03:28.771645+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.15	38656	15.204.128.30	6140	TCP
2025-02-20T21:06:33.580405+0100	2846407	ETPRO MALWARE ELF/Mirai Variant CnC Activity	1	192.168.2.15	38658	15.204.128.30	6140	TCP
2025-02-20T21:06:33.585538+0100	2848448	ETPRO MALWARE Possible ELF/Various IoT Bot Style Device Checkin (unknown)	1	192.168.2.15	38658	15.204.128.30	6140	TCP

Network Port Distribution

Total Packets: 13
• 6140 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2025 21:03:27.726998091 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:03:27.732148886 CET	6140	38656	15.204.128.30	192.168.2.15
Feb 20, 2025 21:03:27.732206106 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:03:28.752501965 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:03:28.758332968 CET	6140	38656	15.204.128.30	192.168.2.15
Feb 20, 2025 21:03:28.759151936 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:03:28.765589952 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:03:28.771584034 CET	6140	38656	15.204.128.30	192.168.2.15
Feb 20, 2025 21:03:28.771645069 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:03:28.777312040 CET	6140	38656	15.204.128.30	192.168.2.15
Feb 20, 2025 21:06:33.574065924 CET	6140	38656	15.204.128.30	192.168.2.15
Feb 20, 2025 21:06:33.574522972 CET	38656	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:06:33.575140953 CET	38658	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:06:33.579617023 CET	6140	38656	15.204.128.30	192.168.2.15
Feb 20, 2025 21:06:33.580221891 CET	6140	38658	15.204.128.30	192.168.2.15
Feb 20, 2025 21:06:33.580332041 CET	38658	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:06:33.580404997 CET	38658	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:06:33.585422039 CET	6140	38658	15.204.128.30	192.168.2.15
Feb 20, 2025 21:06:33.585537910 CET	38658	6140	192.168.2.15	15.204.128.30
Feb 20, 2025 21:06:33.590570927 CET	6140	38658	15.204.128.30	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2025 21:06:10.892370939 CET	60320	53	192.168.2.15	1.1.1.1
Feb 20, 2025 21:06:10.892370939 CET	45235	53	192.168.2.15	1.1.1.1
Feb 20, 2025 21:06:10.900487900 CET	53	45235	1.1.1.1	192.168.2.15
Feb 20, 2025 21:06:10.901222944 CET	53	60320	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 20, 2025 21:06:10.892370939 CET	192.168.2.15	1.1.1.1	0x873b	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Feb 20, 2025 21:06:10.892370939 CET	192.168.2.15	1.1.1.1	0xaaa7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 20, 2025 21:06:10.901222944 CET	1.1.1.1	192.168.2.15	0x873b	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Feb 20, 2025 21:06:10.901222944 CET	1.1.1.1	192.168.2.15	0x873b	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: felkawtf.armv6l.elf PID: 5531, Parent PID: 5449

General

Start time (UTC):	20:03:26
Start date (UTC):	20/02/2025
Path:	/tmp/felkawtf.armv6l.elf
Arguments:	/tmp/felkawtf.armv6l.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: felkawtf.armv6l.elf PID: 5533, Parent PID: 5531

General

Start time (UTC):	20:03:26
Start date (UTC):	20/02/2025
Path:	/tmp/felkawtf.armv6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: felkawtf.armv6l.elf PID: 5535, Parent PID: 5533

General

Start time (UTC):	20:03:26
Start date (UTC):	20/02/2025
Path:	/tmp/felkawtf.armv6l.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report felkawtf.armv6l.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: felkawtf.armv6l.elf PID: 5531, Parent PID: 5449

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Linux Analysis Report
felkawtf.armv6l.elf