Edit tour

Linux Analysis Report
yakuza.ppc.elf

Overview

General Information

Sample name:	yakuza.ppc.elf
Analysis ID:	1646236
MD5:	eb66c7604c6a5850d8de03a40aa69117
SHA1:	cda127065d04ab48e6037bfec79e7447041ec5c8
SHA256:	7cd0ad8d614c7b1a84303c518e3991d846cc7d7238eafd045bd765fae8354c3e
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	80
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646236
Start date and time:	2025-03-23 18:17:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.ppc.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: 194.180.158.53:23

Runtime Messages

Command:	/tmp/yakuza.ppc.elf
PID:	6230
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.ppc.elf (PID: 6230, Parent: 6150, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/yakuza.ppc.elf

yakuza.ppc.elf New Fork (PID: 6232, Parent: 6230)

yakuza.ppc.elf New Fork (PID: 6234, Parent: 6232)

yakuza.ppc.elf New Fork (PID: 6240, Parent: 6234)

yakuza.ppc.elf New Fork (PID: 6277, Parent: 6240)

yakuza.ppc.elf New Fork (PID: 6296, Parent: 6277)

yakuza.ppc.elf New Fork (PID: 6330, Parent: 6296)

yakuza.ppc.elf New Fork (PID: 6349, Parent: 6330)

yakuza.ppc.elf New Fork (PID: 6370, Parent: 6349)

yakuza.ppc.elf New Fork (PID: 6388, Parent: 6370)

dash New Fork (PID: 6303, Parent: 4331)

rm (PID: 6303, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.EQUfd0T5rU /tmp/tmp.BNI88FiyF1 /tmp/tmp.FQEzgjw9Ux

dash New Fork (PID: 6304, Parent: 4331)

rm (PID: 6304, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.EQUfd0T5rU /tmp/tmp.BNI88FiyF1 /tmp/tmp.FQEzgjw9Ux

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.ppc.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
yakuza.ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6232.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6296.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6277.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6230.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6240.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6370.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6349.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6330.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6234.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Click to see the 4 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yakuza.ppc.elf

Avira: detected

Found malware configuration

Source: yakuza.ppc.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "194.180.158.53:23"}

Multi AV Scanner detection for submitted file

Source: yakuza.ppc.elf	ReversingLabs: Detection: 63%
Source: yakuza.ppc.elf	Virustotal: Detection: 64%			Perma Link

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.158.53

Source: yakuza.ppc.elf	String found in binary or memory: http://0.0.0.0/bins.sh;
Source: yakuza.ppc.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: yakuza.ppc.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: yakuza.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: yakuza.ppc.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: yakuza.ppc.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39250
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39250 -> 443

Source: yakuza.ppc.elf	ELF static info symbol of initial sample: TelnetScanner
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: payload

Source: Initial sample

String containing 'busybox' found: busybox

Source: classification engine

Classification label: mal80.troj.linELF@0/0@0/0

Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /usr/bin/dash (PID: 6303)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.EQUfd0T5rU /tmp/tmp.BNI88FiyF1 /tmp/tmp.FQEzgjw9Ux			Jump to behavior
Source: /usr/bin/dash (PID: 6304)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.EQUfd0T5rU /tmp/tmp.BNI88FiyF1 /tmp/tmp.FQEzgjw9Ux			Jump to behavior

Source: /tmp/yakuza.ppc.elf (PID: 6230)

Queries kernel information via 'uname':

Jump to behavior

Source: yakuza.ppc.elf, 6230.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6232.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6234.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6240.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6277.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6296.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6330.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6349.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6370.1.000055f64057c000.000055f6406aa000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: yakuza.ppc.elf, 6230.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6232.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6234.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6240.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6277.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6296.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6330.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6349.1.000055f64057c000.000055f6406aa000.rw-.sdmp, yakuza.ppc.elf, 6370.1.000055f64057c000.000055f6406aa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: yakuza.ppc.elf, 6230.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6232.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6234.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6240.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6277.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6296.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6330.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6349.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6370.1.00007fff56353000.00007fff56374000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: yakuza.ppc.elf, 6230.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6232.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6234.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6240.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6277.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6296.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6330.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6349.1.00007fff56353000.00007fff56374000.rw-.sdmp, yakuza.ppc.elf, 6370.1.00007fff56353000.00007fff56374000.rw-.sdmp	Binary or memory string: S\x86_64/usr/bin/qemu-arm/tmp/yakuza.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.ppc.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: yakuza.ppc.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: yakuza.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6232.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6277.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6349.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6330.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: yakuza.ppc.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: yakuza.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6232.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6277.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6349.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6330.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.00007f43ac017000.00007f43ac02a000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{
  "C2 url": "194.180.158.53:23"
}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.ppc.elf	64%	ReversingLabs	Linux.Trojan.Gafgyt
yakuza.ppc.elf	65%	Virustotal		Browse
yakuza.ppc.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
194.180.158.53:23	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.baidu.com/search/spider.html)	yakuza.ppc.elf	false	high
http://www.billybobbot.com/crawler/)	yakuza.ppc.elf	false	high
http://fast.no/support/crawler.asp)	yakuza.ppc.elf	false	high
http://feedback.redkolibri.com/	yakuza.ppc.elf	false	high
http://www.baidu.com/search/spider.htm)	yakuza.ppc.elf	false	high
http://0.0.0.0/bins.sh;	yakuza.ppc.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.180.158.53	unknown	unknown	39798	MIVOCLOUDMD	true
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.180.158.53	yakuza.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse
34.249.145.219	yakuza.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	miner.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	yakuza.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	updated.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	spc.elf	Get hash	malicious	Mirai	Browse
	i686.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	morte.arm7.elf	Get hash	malicious	Okiru	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INIT7CH	yakuza.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	updated.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i686.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	morte.arm7.elf	Get hash	malicious	Okiru	Browse	109.202.202.202
MIVOCLOUDMD	yakuza.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	194.180.158.53
	yakuza.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	194.180.158.53
	yakuza.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	194.180.158.53
	yakuza.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	194.180.158.53
	yakuza.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	194.180.158.53
	yakuza.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse	194.180.158.53
	compited.ps1	Get hash	malicious	Unknown	Browse	5.181.157.225
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	5.181.159.16
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	5.181.159.16
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	5.181.159.16
AMAZON-02US	yakuza.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	yakuza.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.254.182.186
	updated.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	Setup.exe	Get hash	malicious	Unknown	Browse	18.238.55.96
	spc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	sh4.elf	Get hash	malicious	Mirai	Browse	54.247.62.1
	i.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.98416528210159
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.ppc.elf
File size:	116'040 bytes
MD5:	eb66c7604c6a5850d8de03a40aa69117
SHA1:	cda127065d04ab48e6037bfec79e7447041ec5c8
SHA256:	7cd0ad8d614c7b1a84303c518e3991d846cc7d7238eafd045bd765fae8354c3e
SHA512:	822cb19b7878328e6b199c97635fa5d6e7be2dc52ad7f1429e356d70b610982cfe0740ab164ce13309b67a40cc7ea318a1fb1e66a60cdf30fac3c735ad8d7c6b
SSDEEP:	3072:VqDUOulvQ+nozmrCEJ0gtcbWt5h8CbH58bDoeCRl7YHQQ/hVOmAD3m:JJ0fWt5h8CbHH7YHQQ/hVOmAD3m
TLSH:	78B30805F9404B23C6D26BBBF79B438D77366658ABD7330196297EF02BC17982E3A150
File Content Preview:	.ELF...a..........(.........4....R......4. ...(....................../.../...............0...0...0......@i..........Q.td..................................-...L."....?..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	86764
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0xff2c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x17fdc	0xffdc	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x17ff0	0xfff0	0x2ffc	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1afec	0x12fec	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x23000	0x13000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x23008	0x13008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x23010	0x13010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x23014	0x13014	0x5ac	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x235c0	0x135c0	0x6380	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x135c0	0xbd4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x14198	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x142b8	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x14830	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x148e4	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x151a4	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x15244	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1560c	0x48a0	0x10	0x0		19	634	4
.strtab	STRTAB	0x0	0x19eac	0x269c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x12ff0	0x12ff0	6.1199	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x13000	0x23000	0x23000	0x5c0	0x6940	3.5721	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x17fdc	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x17ff0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1afec	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x23000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x23008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x23010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x23014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x235c0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17fdc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fe8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x17fec	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x852c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa2bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xada4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf01c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf09c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf82c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1100c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1155c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1158c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1226c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1240c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1303c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1320c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1325c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1327c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14608	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1583c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1715c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x23008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2301c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x912c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x928c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9c08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc218	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe130	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf15c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2325c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x23264	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0xf38c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf55c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf798	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2326c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19f94	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xffd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1166c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x233a8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x234b0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11db0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x234c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abc0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2357c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23594	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x12ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1317c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23598	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x29848	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x13208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1349c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af08	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x145e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1502c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x235a4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x15b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ee0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16038	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170b0	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
Laligned	.symtab	0x10958	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10974	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x235f8	16384	OBJECT	<unknown>	DEFAULT	10
SendHTTP	.symtab	0xd034	364	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xc254	340	FUNC	<unknown>	DEFAULT	2
SendTCP	.symtab	0xc874	1652	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0xc3a8	1228	FUNC	<unknown>	DEFAULT	2
SendWGET	.symtab	0xd1a0	192	FUNC	<unknown>	DEFAULT	2
TelnetIPRanges	.symtab	0xa2bc	1016	FUNC	<unknown>	DEFAULT	2
TelnetScanner	.symtab	0xaadc	6008	FUNC	<unknown>	DEFAULT	2
UpdateNameSrvs	.symtab	0xe090	168	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x23004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x23000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x2325c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x19984	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x23598	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1abf2	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x23264	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x19c84	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2300c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x23008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1afec	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1afec	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x2325c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x19984	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x23598	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1abf2	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x23264	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x19c84	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x23260	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x2359c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x23268	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0xf384	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x16f08	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x10d6c	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x13200	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xee80	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0xf0f4	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x12a88	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x12b38	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x10d80	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xef44	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x11adc	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x12260	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x12260	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x15b94	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xef98	44	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x12f34	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0xefc4	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x11474	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x12f60	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x29848	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x124a0	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x12f8c	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1240c	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x13338	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xee80	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x134b8	56	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x14608	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x16f08	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x15e5c	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x15ef0	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x15c18	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0xeff0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10764	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x15c24	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x15c30	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10798	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x16f08	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0xf01c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x12fb8	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x12fe4	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x13010	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x110bc	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x11100	884	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1303c	24	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0xf044	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0xf09c	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x13054	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2984c	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x11098	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x14f44	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1108c	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1100c	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x165c8	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x16254	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x12060	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x13080	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x10f10	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xf0c8	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x16e70	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x14c90	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10860	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x14c80	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x14d8c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x14da4	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10870	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x130d0	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0xf0f4	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x130fc	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x15bec	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x15b58	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x11c28	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x11f04	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x15f88	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0xf190	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x114d0	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x13128	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xf1bc	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x114fc	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x11528	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0xf1ec	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0xf254	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0xf280	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1155c	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x11e44	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x12de0	228	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x115b8	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x13180	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x12534	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1158c	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xf390	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x11f94	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x17038	124	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x10e68	156	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x10990	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x109b8	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10910	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10910	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10ac0	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x16158	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10930	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x16040	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x10adc	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x10b94	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x14f04	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x16108	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x10c74	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x10f04	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x14e90	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1226c	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x126d8	944	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x10f30	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xf2d8	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x16ed4	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xf350	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x12ed0	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xf3c4	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x131d4	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xf304	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1320c	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1327c	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1325c	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0xf30c	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x23010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x23010	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x17504	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x17ed4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x17ed4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x17eb8	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x17f4c	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x17504	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x17ee8	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x17f24	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x17f38	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x17f10	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x17efc	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x17c20	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x178f8	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x174f8	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x17500	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x17838	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x1780c	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x173b8	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0xee2c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x174e0	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x1788c	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0xee2c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x177e4	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0xeb6c	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0xec64	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x17878	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2983c	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x2357c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x115b8	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x29940	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x235c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x235c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x12b00	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x17e34	132	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x23260	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x2359c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x23268	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2986c	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x23014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x16a38	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1715c	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x16910	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x12f04	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x12f00	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xee2c	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x17c20	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x173b8	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x15030	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x17fa0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x23018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x170b4	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x16828	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x169c8	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x29940	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x29834	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x17e34	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0xf384	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x12ef4	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2982c	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x17838	64	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x16f08	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x23000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x23000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x17f4c	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x1788c	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x1780c	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x17878	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x177e4	40	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x17e24	148	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x15b10	72	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1303c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x10d6c	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x17e24	148	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x13200	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x11920	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x119e8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x119b4	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x119d4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x23000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x23000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__ledf2	.symtab	0x17e2c	140	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x17228	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x16a24	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0xefc4	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x11474	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0xf150	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0xee80	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0xeff0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0xf044	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x16e70	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x130d0	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0xf0f4	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x15bec	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0xf190	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x114d0	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xf1bc	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x114fc	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x11528	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x12de0	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x29830	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x12128	312	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0xf304	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0xf30c	44	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x17e2c	140	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x233a8	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x29810	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x298fc	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0xed48	228	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x178f8	808	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0xee30	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x29924	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x29930	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x17e34	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x16b14	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1583c	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x29838	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x23000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x23000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x12af4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x12afc	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x15b58	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x16b48	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x235a4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x29840	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x29914	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x29934	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x11694	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x116b8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x11670	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x23278	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x17274	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x134f0	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x15d60	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x138a4	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0xf82c	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x19f94	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x172d0	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x15e2c	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x172fc	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x139dc	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xf8f4	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2327c	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x17500	740	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x15bd0	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x12f08	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x12a88	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x12b38	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x12b94	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x23594	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0xeb6c	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0xec7c	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x12ed0	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x10d80	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x29940	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xf924	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x15b70	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x29938	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2993c	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x235c0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x29940	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x29848	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0xef44	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x17fdc	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2761c	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xf970	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x13cd4	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2984c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x13ae0	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x147f0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xffe8	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x102a0	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x10080	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x100b8	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x10254	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x12afc	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x12afc	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2987c	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x135ac	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xf7bc	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x23280	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x23284	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x144c8	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x27618	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x2329c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x27614	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x232b8	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0xf83c	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x232b4	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x12274	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x13b50	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1a064	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x13b84	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xf9f4	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x11adc	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xef6c	44	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
advance_telstate	.symtab	0x8798	112	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x23084	64	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x23138	44	OBJECT	<unknown>	DEFAULT	9
atoi	.symtab	0x12260	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x12260	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x10850	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x29828	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x29844	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x15b94	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x115b8	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x29620	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x29630	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x23254	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x17fd4	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0xef98	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x12f34	44	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0xefc4	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commServer	.symtab	0x23024	4	OBJECT	<unknown>	DEFAULT	9
completed.2555	.symtab	0x235c0	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x11474	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x97f8	640	FUNC	<unknown>	DEFAULT	2
contains_fail	.symtab	0x84fc	48	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x852c	96	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x83f4	216	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x84cc	48	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0xf150	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0xa714	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x23164	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x23020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x12f60	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x29834	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x29848	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x124a0	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x12f8c	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1240c	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1af08	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x230c4	44	OBJECT	<unknown>	DEFAULT	9
fclose	.symtab	0x13338	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xee80	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0xeef4	80	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x134b8	56	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x14608	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x16f08	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x15e5c	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x15ef0	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1aef4	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x15c18	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x23014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x235bc	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0xeff0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x10764	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x11830	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x15c24	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x15c24	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x15c30	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x10798	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x81cc	28	FUNC	<unknown>	DEFAULT	2
getEndianness	.symtab	0xe138	276	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x9438	100	FUNC	<unknown>	DEFAULT	2
getRandomIP	.symtab	0xa6b4	96	FUNC	<unknown>	DEFAULT	2
getRandomPublicIP	.symtab	0x9f0c	944	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x8760	56	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x16f08	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0xf01c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x12fb8	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x12fe4	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x13010	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x110bc	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x11100	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x1303c	24	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0xf044	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0xf070	44	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0xf09c	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x114a0	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x13054	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4900	.symtab	0x297fc	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2984c	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
htonl	.symtab	0x10fd4	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x10ff8	20	FUNC	<unknown>	DEFAULT	2
i.4276	.symtab	0x23258	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x109b8	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x11098	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x14f44	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1108c	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1100c	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x165c8	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x16464	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x16254	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x16188	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0xdf08	392	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81e8	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x233ac	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x11d30	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x12060	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x13080	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ipState.5057	.symtab	0x235ee	4	OBJECT	<unknown>	DEFAULT	10
ipState.5159	.symtab	0x235f2	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x10f10	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0xf338	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0xf0c8	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9a78	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x16e70	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x235e8	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0xe24c	2336	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x235dc	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0xa97c	276	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x949c	136	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x116dc	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
matchPrompt	.symtab	0x9d9c	368	FUNC	<unknown>	DEFAULT	2
memchr	.symtab	0x14c90	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x10860	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x14c80	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x14d8c	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x14da4	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x10870	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x275f8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x234b0	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x234c8	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x29850	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x130d0	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x9c10	396	FUNC	<unknown>	DEFAULT	2
next_start.1066	.symtab	0x2961c	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x10f9c	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x10fc0	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x235e0	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x235c4	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0xf0f4	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x29870	4	OBJECT	<unknown>	DEFAULT	10
p.2553	.symtab	0x2301c	0	OBJECT	<unknown>	DEFAULT	9
payload	.symtab	0x23028	4	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0xf474	256	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x29878	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x130fc	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x15bec	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0xf574	584	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x27610	4	OBJECT	<unknown>	DEFAULT	10
prctl	.symtab	0xf160	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x19fbc	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x8d40	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8968	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x8b58	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x89d4	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xd260	3240	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x19fd0	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x15b58	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x11c24	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82bc	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x11c28	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1abc0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x11f04	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x234fc	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x15f88	184	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 51
• 443 (HTTPS)
• 80 (HTTP)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 23, 2025 18:18:28.310461044 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 18:18:28.315030098 CET	34774	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:18:29.330434084 CET	34774	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:18:31.346085072 CET	34774	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:18:33.937647104 CET	42836	443	192.168.2.23	91.189.91.43
Mar 23, 2025 18:18:34.961637020 CET	42516	80	192.168.2.23	109.202.202.202
Mar 23, 2025 18:18:35.473474026 CET	34774	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:18:43.664518118 CET	34774	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:18:48.420187950 CET	39250	443	192.168.2.23	34.249.145.219
Mar 23, 2025 18:18:48.420242071 CET	443	39250	34.249.145.219	192.168.2.23
Mar 23, 2025 18:18:48.420367956 CET	39250	443	192.168.2.23	34.249.145.219
Mar 23, 2025 18:18:48.420965910 CET	39250	443	192.168.2.23	34.249.145.219
Mar 23, 2025 18:18:48.420975924 CET	443	39250	34.249.145.219	192.168.2.23
Mar 23, 2025 18:18:49.295543909 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 18:18:59.534198046 CET	42836	443	192.168.2.23	91.189.91.43
Mar 23, 2025 18:18:59.790225983 CET	34774	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:03.382627010 CET	34778	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:04.397423029 CET	34778	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:05.677217960 CET	42516	80	192.168.2.23	109.202.202.202
Mar 23, 2025 18:19:06.413261890 CET	34778	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:10.542341948 CET	34778	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:18.731439114 CET	34778	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:30.249819040 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 18:19:34.857342005 CET	34778	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:38.410999060 CET	34780	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:39.432682037 CET	34780	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:41.448501110 CET	34780	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:45.607903004 CET	34780	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:19:48.412568092 CET	39250	443	192.168.2.23	34.249.145.219
Mar 23, 2025 18:19:48.460323095 CET	443	39250	34.249.145.219	192.168.2.23
Mar 23, 2025 18:19:50.727314949 CET	42836	443	192.168.2.23	91.189.91.43
Mar 23, 2025 18:19:53.798640966 CET	34780	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:09.924458027 CET	34780	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:13.418956995 CET	34782	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:14.435723066 CET	34782	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:16.451492071 CET	34782	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:20.674992085 CET	34782	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:28.865799904 CET	34782	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:44.991489887 CET	34782	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:48.460777998 CET	34784	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:49.471004009 CET	34784	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:51.486596107 CET	34784	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:20:55.742129087 CET	34784	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:03.932878017 CET	34784	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:20.058598042 CET	34784	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:23.481338978 CET	34786	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:24.506066084 CET	34786	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:26.521817923 CET	34786	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:30.553245068 CET	34786	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:38.744093895 CET	34786	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:54.869833946 CET	34786	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:58.513298988 CET	34788	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:21:59.541177034 CET	34788	23	192.168.2.23	194.180.158.53
Mar 23, 2025 18:22:01.556876898 CET	34788	23	192.168.2.23	194.180.158.53

System Behavior

Analysis Process: yakuza.ppc.elf PID: 6230, Parent PID: 6150

General

Start time (UTC):	17:18:27
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	/tmp/yakuza.ppc.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6232, Parent PID: 6230

General

Start time (UTC):	17:18:27
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6234, Parent PID: 6232

General

Start time (UTC):	17:18:27
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6240, Parent PID: 6234

General

Start time (UTC):	17:18:27
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6277, Parent PID: 6240

General

Start time (UTC):	17:19:02
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6296, Parent PID: 6277

General

Start time (UTC):	17:19:37
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6330, Parent PID: 6296

General

Start time (UTC):	17:20:12
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6349, Parent PID: 6330

General

Start time (UTC):	17:20:47
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6370, Parent PID: 6349

General

Start time (UTC):	17:21:22
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6388, Parent PID: 6370

General

Start time (UTC):	17:21:57
Start date (UTC):	23/03/2025
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dash PID: 6303, Parent PID: 4331

General

Start time (UTC):	17:19:47
Start date (UTC):	23/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6303, Parent PID: 4331

General

Start time (UTC):	17:19:47
Start date (UTC):	23/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.EQUfd0T5rU /tmp/tmp.BNI88FiyF1 /tmp/tmp.FQEzgjw9Ux
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6304, Parent PID: 4331

General

Start time (UTC):	17:19:47
Start date (UTC):	23/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6304, Parent PID: 4331

General

Start time (UTC):	17:19:47
Start date (UTC):	23/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.EQUfd0T5rU /tmp/tmp.BNI88FiyF1 /tmp/tmp.FQEzgjw9Ux
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: yakuza.ppc.elf PID: 6230, Parent PID: 6150

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6232, Parent PID: 6230

General

Process Activities

Process Forked

Thread Sleep

Linux Analysis Report
yakuza.ppc.elf