Edit tour

Linux Analysis Report
ZkTOOwsXyK.elf

Overview

General Information

Sample Name:	ZkTOOwsXyK.elf
Original Sample Name:	e9975d20bc6592b8aa4832ccbc9f41ab.elf
Analysis ID:	877125
MD5:	e9975d20bc6592b8aa4832ccbc9f41ab
SHA1:	9708205b9c3d7b1804c8e22093f138b55d42bc12
SHA256:	df1f2dd250b7450d2678f5d8b6b822643750aae7d47e8befe15f9770ed8c9409
Tags:	32armelfgafgyt
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	877125
Start date and time:	2023-05-28 22:38:26 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	ZkTOOwsXyK.elf
Original Sample Name:	e9975d20bc6592b8aa4832ccbc9f41ab.elf
Detection:	MAL
Classification:	mal56.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/ZkTOOwsXyK.elf
PID:	6228
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ZkTOOwsXyK.elf (PID: 6228, Parent: 6126, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ZkTOOwsXyK.elf

ZkTOOwsXyK.elf New Fork (PID: 6230, Parent: 6228)

ZkTOOwsXyK.elf New Fork (PID: 6232, Parent: 6230)

ZkTOOwsXyK.elf New Fork (PID: 6234, Parent: 6232)

ZkTOOwsXyK.elf New Fork (PID: 6240, Parent: 6234)

ZkTOOwsXyK.elf New Fork (PID: 6244, Parent: 6240)

ZkTOOwsXyK.elf New Fork (PID: 6249, Parent: 6244)

ZkTOOwsXyK.elf New Fork (PID: 6253, Parent: 6249)

ZkTOOwsXyK.elf New Fork (PID: 6257, Parent: 6253)

ZkTOOwsXyK.elf New Fork (PID: 6261, Parent: 6257)

ZkTOOwsXyK.elf New Fork (PID: 6265, Parent: 6261)

ZkTOOwsXyK.elf New Fork (PID: 6269, Parent: 6265)

ZkTOOwsXyK.elf New Fork (PID: 6274, Parent: 6269)

ZkTOOwsXyK.elf New Fork (PID: 6280, Parent: 6274)

ZkTOOwsXyK.elf New Fork (PID: 6284, Parent: 6280)

ZkTOOwsXyK.elf New Fork (PID: 6288, Parent: 6284)

ZkTOOwsXyK.elf New Fork (PID: 6292, Parent: 6288)

ZkTOOwsXyK.elf New Fork (PID: 6296, Parent: 6292)

ZkTOOwsXyK.elf New Fork (PID: 6301, Parent: 6296)

ZkTOOwsXyK.elf New Fork (PID: 6305, Parent: 6301)

ZkTOOwsXyK.elf New Fork (PID: 6309, Parent: 6305)

ZkTOOwsXyK.elf New Fork (PID: 6313, Parent: 6309)

ZkTOOwsXyK.elf New Fork (PID: 6318, Parent: 6313)

ZkTOOwsXyK.elf New Fork (PID: 6322, Parent: 6318)

ZkTOOwsXyK.elf New Fork (PID: 6327, Parent: 6322)

ZkTOOwsXyK.elf New Fork (PID: 6333, Parent: 6327)

ZkTOOwsXyK.elf New Fork (PID: 6337, Parent: 6333)

ZkTOOwsXyK.elf New Fork (PID: 6341, Parent: 6337)

ZkTOOwsXyK.elf New Fork (PID: 6345, Parent: 6341)

ZkTOOwsXyK.elf New Fork (PID: 6349, Parent: 6345)

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZkTOOwsXyK.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: ZkTOOwsXyK.elf	ReversingLabs: Detection: 67%
Source: ZkTOOwsXyK.elf	Virustotal: Detection: 65%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:37042 -> 68.183.122.246:666

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 199.193.92.134
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246

Source: classification engine

Classification label: mal56.linELF@0/0@0/0

Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: ZkTOOwsXyK.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/ZkTOOwsXyK.elf (PID: 6228)

Queries kernel information via 'uname':

Jump to behavior

Source: ZkTOOwsXyK.elf, 6228.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6230.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6232.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6234.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6240.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6244.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6249.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6253.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6257.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6261.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6265.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6269.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6274.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6280.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6284.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6288.1.0000563abf70f000.0000563abf83d000.rw-.sdmp	Binary or memory string: :V!/etc/qemu-binfmt/arm
Source: ZkTOOwsXyK.elf, 6228.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6230.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6232.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6234.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6240.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6244.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6249.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6253.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6257.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6261.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6265.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6269.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6274.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6280.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6284.1.0000563abf70f000.0000563abf83d000.rw-.sdmp, ZkTOOwsXyK.elf, 6288.1.0000563abf70f000.0000563abf83d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: ZkTOOwsXyK.elf, 6228.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6230.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6232.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6234.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6240.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6244.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6249.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6253.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6257.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6261.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6265.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6269.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6274.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6280.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6284.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6288.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp	Binary or memory string: Zx86_64/usr/bin/qemu-arm/tmp/ZkTOOwsXyK.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ZkTOOwsXyK.elf
Source: ZkTOOwsXyK.elf, 6228.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6230.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6232.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6234.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6240.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6244.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6249.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6253.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6257.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6261.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6265.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6269.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6274.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6280.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6284.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp, ZkTOOwsXyK.elf, 6288.1.00007ffcf15b7000.00007ffcf15d8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Safari/604.1.38
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; CrOS x86_64 9592.96.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.114 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 535) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Mobile Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.4; HTC Desire 620 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Mobile/14D27
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZkTOOwsXyK.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
ZkTOOwsXyK.elf	66%	Virustotal		Browse
ZkTOOwsXyK.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
199.193.92.134	unknown	Canada	15247	RADIANT-VANCOUVERCA	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
68.183.122.246	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse
	I4l1qRHHYv.elf	Get hash	malicious	Mirai, Moobot	Browse
	uflo6ac5X3.elf	Get hash	malicious	Moobot	Browse
	ZjTqR0kvoS.elf	Get hash	malicious	Moobot	Browse
	5GShhmIqhr.elf	Get hash	malicious	Mirai, Moobot	Browse
	xUpTvFs8no.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	8UwWC37whF.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse
	I4l1qRHHYv.elf	Get hash	malicious	Mirai, Moobot	Browse
	uflo6ac5X3.elf	Get hash	malicious	Moobot	Browse
	ZjTqR0kvoS.elf	Get hash	malicious	Moobot	Browse
	5GShhmIqhr.elf	Get hash	malicious	Mirai, Moobot	Browse
	xUpTvFs8no.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	8UwWC37whF.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INIT7CH	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	I4l1qRHHYv.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	uflo6ac5X3.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	ZjTqR0kvoS.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	5GShhmIqhr.elf	Get hash	malicious	Mirai, Moobot	Browse	109.202.202.202
	xUpTvFs8no.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	8UwWC37whF.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
RADIANT-VANCOUVERCA	gUlmdZu1kH.elf	Get hash	malicious	Mirai	Browse	199.193.93.114
	PmSqu5L14c.elf	Get hash	malicious	Mirai	Browse	207.232.127.58
	UYCfawXTbv.elf	Get hash	malicious	Mirai	Browse	66.163.200.57
	4XueCyNSxf.elf	Get hash	malicious	Mirai	Browse	66.163.198.86
	n7Fq2OHCbN.elf	Get hash	malicious	Mirai	Browse	207.34.108.198
	oC7RMG0EPy.elf	Get hash	malicious	Mirai	Browse	199.91.86.96
	3LGXFsX2o2.elf	Get hash	malicious	Unknown	Browse	207.232.115.95
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	209.207.126.0
	jUqvrmjdgZ.elf	Get hash	malicious	Mirai	Browse	162.222.124.239
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.211.196.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	64.85.51.106
	pK3jaBr5pQ.elf	Get hash	malicious	Mirai	Browse	162.255.254.126
	WS4pHT2LVn.elf	Get hash	malicious	Mirai	Browse	97.75.212.95
	Wqiqo8n0Y1.elf	Get hash	malicious	Mirai	Browse	207.232.127.61
	wL6URtCyl8.elf	Get hash	malicious	Mirai, Moobot	Browse	207.232.127.87
	6n5nGc5tuL.elf	Get hash	malicious	Mirai, Moobot	Browse	216.40.102.192
	xtLmTOX4n5.elf	Get hash	malicious	Mirai, Moobot	Browse	64.85.58.94
	ascaris.spc.elf	Get hash	malicious	Mirai	Browse	66.163.200.60
	HPchROIfUZ.elf	Get hash	malicious	Mirai	Browse	207.194.211.155
	rsWMgMBYvG.elf	Get hash	malicious	Mirai	Browse	207.232.105.240

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.940285930241682
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ZkTOOwsXyK.elf
File size:	120177
MD5:	e9975d20bc6592b8aa4832ccbc9f41ab
SHA1:	9708205b9c3d7b1804c8e22093f138b55d42bc12
SHA256:	df1f2dd250b7450d2678f5d8b6b822643750aae7d47e8befe15f9770ed8c9409
SHA512:	05f45066701e8bda60cc87fb141c1fb9d8b073bd8798606c13651d806e74a4ad580735d00c591a05aab2b806bfcf2b5eb3f6fbb9c6c48072f90207d89ddc2af0
SSDEEP:	3072:hQrFRNfuLrGhEPOD0ug3gNlmBoHQuQekQnYW:IFzuaEGQug3CmBoHQuQekQnYW
TLSH:	14C3FA45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120
File Content Preview:	.ELF...a..........(.........4....g......4. ...(......................L...L...............P...P...P.......g..........Q.td..................................-...L."....E..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x11474	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19524	0x11524	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19538	0x11538	0x3744	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1cc7c	0x14c7c	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x25000	0x15000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x25008	0x15008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x25010	0x15010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x25014	0x15014	0x408	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2541c	0x1541c	0x636c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1541c	0xb68	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x15f88	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x16028	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x16334	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x16398	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x16680	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x16720	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16ae8	0x4620	0x10	0x0		19	640	4
.strtab	STRTAB	0x0	0x1b108	0x2469	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x14c80	0x14c80	6.0727	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x15000	0x25000	0x25000	0x41c	0x6788	3.0387	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19524	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19538	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1cc7c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x25000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x25008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x25010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x25014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2541c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19524	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19530	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x194e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1951c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19534	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbdb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1338c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1366c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1368c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1490c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1521c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1550c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1746c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1914c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x25008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2501c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19564	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x95f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9bc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb58c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbda4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf66c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1085c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x250b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x250c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x250c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1bc24	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12800	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25204	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x140d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2530c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1445c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25324	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x146d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c850	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14bc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253f0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x151f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b68c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x153dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c898	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x165f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1689c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253f8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x173fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1743c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25410	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190a0	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.100.4599	.symtab	0x19bfc	144	OBJECT	<unknown>	DEFAULT	4
C.104.4641	.symtab	0x19c8c	144	OBJECT	<unknown>	DEFAULT	4
C.108.4683	.symtab	0x19d1c	144	OBJECT	<unknown>	DEFAULT	4
C.112.4725	.symtab	0x19dac	144	OBJECT	<unknown>	DEFAULT	4
C.116.4767	.symtab	0x19e3c	144	OBJECT	<unknown>	DEFAULT	4
C.120.4809	.symtab	0x19ecc	144	OBJECT	<unknown>	DEFAULT	4
C.124.4850	.symtab	0x1a09c	8	OBJECT	<unknown>	DEFAULT	4
C.128.4885	.symtab	0x1a0a4	8	OBJECT	<unknown>	DEFAULT	4
C.132.4920	.symtab	0x1a0ac	8	OBJECT	<unknown>	DEFAULT	4
C.136.4955	.symtab	0x1a0b4	8	OBJECT	<unknown>	DEFAULT	4
C.140.4990	.symtab	0x1a0bc	8	OBJECT	<unknown>	DEFAULT	4
C.142.5019	.symtab	0x1ae80	12	OBJECT	<unknown>	DEFAULT	4
C.143.5020	.symtab	0x1ae60	12	OBJECT	<unknown>	DEFAULT	4
C.96.4557	.symtab	0x19b6c	144	OBJECT	<unknown>	DEFAULT	4
GetRandomIP	.symtab	0x9d64	96	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x13178	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x13194	0	NOTYPE	<unknown>	DEFAULT	2
OreoServer	.symtab	0x25024	4	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x25454	16384	OBJECT	<unknown>	DEFAULT	10
RandString	.symtab	0x9858	136	FUNC	<unknown>	DEFAULT	2
Send100UP	.symtab	0xb424	364	FUNC	<unknown>	DEFAULT	2
SendNUKE	.symtab	0xb6fc	364	FUNC	<unknown>	DEFAULT	2
SendOVH	.symtab	0xb14c	364	FUNC	<unknown>	DEFAULT	2
SendPAKI	.symtab	0xb590	364	FUNC	<unknown>	DEFAULT	2
SendZAP	.symtab	0xb2b8	364	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x25004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x25000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x250b8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1b624	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x25410	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1c97c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x250c0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1b924	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2500c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x25008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1cc7c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1cc7c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x250b8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1b624	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x25410	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1c97c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x250c0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1b924	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x250bc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x25414	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x250c4	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11a14	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x142ac	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17404	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x11a3c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x11a68	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13bd0	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x11a94	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2b68c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x14b38	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x15248	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14aa4	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1746c	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17cfc	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17b28	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17ee0	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x175ec	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x11ac0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x175f8	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17604	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15274	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x152a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x152cc	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x11b14	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x152f8	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2b690	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x167b4	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x185b8	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x18244	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x14830	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1366c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11bbc	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18e60	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16500	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x13080	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x164f0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x165fc	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16614	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x13090	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x11c54	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x17440	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x173c8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x143f8	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x146d4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x17f78	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x11cb0	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x13c58	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x15350	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11cdc	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13c84	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x11d0c	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x11d74	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x11da0	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13ce4	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x14614	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x15114	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13d40	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13d70	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11df8	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14bcc	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13d14	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11f04	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x14764	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19028	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x131b0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x132b8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x18148	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x13150	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x18030	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x132d4	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1338c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x16774	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x180f8	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1346c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13660	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16700	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x14904	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1368c	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11e4c	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x18ec4	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11ec4	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11f38	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x153a8	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x153e0	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15450	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15430	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x11e80	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x25010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x25010	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x193a8	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x194d0	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11600	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x116f8	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2b680	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x253d8	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2541c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2541c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14e34	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x250bc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x25414	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x250c4	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2b6b0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x25014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18a28	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1914c	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18900	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x15218	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x15214	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x193a8	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x168a0	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x194e8	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x25018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x190a4	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x18818	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x189b8	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2b678	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2b670	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x17380	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x140f0	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x141b8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x14184	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x141a4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x19218	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18a14	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18e60	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x17440	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x11cb0	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x13c58	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11cdc	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13c84	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x15114	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2b674	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x11e80	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x25204	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2b654	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2b744	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x117dc	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x118c4	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2b76c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2b778	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x18b04	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x170ac	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2b67c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x173c8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18b38	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x253f8	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2b684	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2b75c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2b77c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13e64	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13e88	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13e40	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x250d4	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x19264	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1550c	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17734	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x155c8	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x12058	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1bc24	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x192c0	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17af8	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x192ec	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15700	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12120	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x250d8	4	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x151f8	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1521c	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14ec8	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x253f0	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11600	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11710	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x12150	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x173e0	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2b780	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2b784	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x2541c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2b68c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x11a14	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19524	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x29460	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1219c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x159f8	1640	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2b690	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15804	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16060	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12814	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x12acc	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x128ac	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x128e4	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x12a80	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2b6c4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17800	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11fe8	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x250dc	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x250e0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17bbc	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x2945c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x250f8	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x29458	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x25114	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x12068	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x25110	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1490c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15874	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1bcf4	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x158a8	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12220	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x142ac	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x13070	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2b66c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2b688	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17404	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x2b464	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x2b474	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x25030	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1951c	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x11a3c	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_tcp_udp	.symtab	0x9f1c	448	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2555	.symtab	0x2541c	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x92f8	636	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9dc4	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x25028	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x25020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x11a94	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2b678	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2b68c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x14b38	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x15248	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14aa4	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1c898	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1746c	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x9228	208	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x29454	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x90a4	388	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x8e1c	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17cfc	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17b28	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x17ee0	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1c884	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x175ec	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x25014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x25418	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x14000	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x175f8	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x175f8	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17604	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getHost	.symtab	0x979c	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x109f4	740	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15274	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x152a0	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x152cc	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x13c28	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x152f8	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x25440	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x2b640	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2b690	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x19564	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x13730	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13754	20	FUNC	<unknown>	DEFAULT	2
i.3637	.symtab	0x25034	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x131b0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x167b4	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x185b8	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x18454	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x18244	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x18178	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10868	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x25208	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x14500	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x14830	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ioctl_keepalive	.symtab	0xe538	304	FUNC	<unknown>	DEFAULT	2
ioctl_pid	.symtab	0x25438	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x1366c	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x11eac	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11bbc	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9bcc	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18e60	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x2544c	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x10cd8	2344	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x2543c	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0xa1ec	276	FUNC	<unknown>	DEFAULT	2
makeVSEPacket	.symtab	0xa300	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13eac	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16500	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x13080	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x164f0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x165fc	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x16614	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x13090	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x2530c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x25324	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2b694	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x2b460	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x136f8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1371c	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x25444	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x25420	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2b6b4	4	OBJECT	<unknown>	DEFAULT	10
ourPublicIP	.symtab	0x2b6b8	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0xbdb0	3464	FUNC	<unknown>	DEFAULT	2
p.2553	.symtab	0x2501c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x9574	128	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x2b6c0	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x11c54	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x17440	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x11c80	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1bc4c	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x88e0	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8508	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x86f8	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8574	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xe668	8704	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1bc60	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x173c8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x143f4	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x143f8	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1c850	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x146d4	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x25358	128	OBJECT	<unknown>	DEFAULT	9
rangechoice	.symtab	0x2502c	4	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x17f78	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x11cb0	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x13c58	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x98e0	748	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x15350	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x2b6bc	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0xa438	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x11cdc	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x13c84	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendFLUX	.symtab	0xd908	1284	FUNC	<unknown>	DEFAULT	2
sendHEX	.symtab	0xbc00	432	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0xb868	920	FUNC	<unknown>	DEFAULT	2
sendLDAP	.symtab	0xa774	420	FUNC	<unknown>	DEFAULT	2
sendNTP	.symtab	0xa918	420	FUNC	<unknown>	DEFAULT	2
sendSNMP	.symtab	0xaabc	420	FUNC	<unknown>	DEFAULT	2
sendSSDP	.symtab	0xae04	420	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0xa5d0	420	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0xd240	1736	FUNC	<unknown>	DEFAULT	2
sendTELNET	.symtab	0xafa8	420	FUNC	<unknown>	DEFAULT	2
sendTFTP	.symtab	0xac60	420	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0xcb38	1800	FUNC	<unknown>	DEFAULT	2
sendVSE	.symtab	0xde0c	1836	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x13cb0	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x11d0c	104	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x11d74	44	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x11da0	44	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x13ce4	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x14474	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x14614	192	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x11dcc	44	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x15114	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 51
• 666 undefined
• 443 (HTTPS)
• 80 (HTTP)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2023 22:39:10.967864990 CEST	37042	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:11.069803953 CEST	666	37042	68.183.122.246	192.168.2.23
May 28, 2023 22:39:12.658567905 CEST	42836	443	192.168.2.23	91.189.91.43
May 28, 2023 22:39:13.426609039 CEST	42516	80	192.168.2.23	109.202.202.202
May 28, 2023 22:39:16.076878071 CEST	37044	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:16.175025940 CEST	666	37044	68.183.122.246	192.168.2.23
May 28, 2023 22:39:21.179523945 CEST	37046	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:21.277288914 CEST	666	37046	68.183.122.246	192.168.2.23
May 28, 2023 22:39:26.283653021 CEST	37048	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:26.384095907 CEST	666	37048	68.183.122.246	192.168.2.23
May 28, 2023 22:39:28.017771006 CEST	43928	443	192.168.2.23	91.189.91.42
May 28, 2023 22:39:31.388751030 CEST	37050	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:31.487021923 CEST	666	37050	68.183.122.246	192.168.2.23
May 28, 2023 22:39:36.492942095 CEST	37052	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:36.589193106 CEST	666	37052	68.183.122.246	192.168.2.23
May 28, 2023 22:39:38.257277966 CEST	42836	443	192.168.2.23	91.189.91.43
May 28, 2023 22:39:41.593993902 CEST	37054	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:41.691071033 CEST	666	37054	68.183.122.246	192.168.2.23
May 28, 2023 22:39:44.400852919 CEST	42516	80	192.168.2.23	109.202.202.202
May 28, 2023 22:39:46.701040030 CEST	37056	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:46.798851967 CEST	666	37056	68.183.122.246	192.168.2.23
May 28, 2023 22:39:51.804248095 CEST	37058	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:51.906764984 CEST	666	37058	68.183.122.246	192.168.2.23
May 28, 2023 22:39:55.240026951 CEST	23	50766	199.193.92.134	192.168.2.23
May 28, 2023 22:39:55.240204096 CEST	50766	23	192.168.2.23	199.193.92.134
May 28, 2023 22:39:56.909420013 CEST	37060	666	192.168.2.23	68.183.122.246
May 28, 2023 22:39:57.005399942 CEST	666	37060	68.183.122.246	192.168.2.23
May 28, 2023 22:40:02.008433104 CEST	37062	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:02.113579988 CEST	666	37062	68.183.122.246	192.168.2.23
May 28, 2023 22:40:07.116877079 CEST	37064	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:07.213185072 CEST	666	37064	68.183.122.246	192.168.2.23
May 28, 2023 22:40:08.975549936 CEST	43928	443	192.168.2.23	91.189.91.42
May 28, 2023 22:40:12.219074965 CEST	37066	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:12.323880911 CEST	666	37066	68.183.122.246	192.168.2.23
May 28, 2023 22:40:17.328552961 CEST	37068	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:17.431792974 CEST	666	37068	68.183.122.246	192.168.2.23
May 28, 2023 22:40:22.436575890 CEST	37070	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:22.534255981 CEST	666	37070	68.183.122.246	192.168.2.23
May 28, 2023 22:40:27.540218115 CEST	37072	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:27.638189077 CEST	666	37072	68.183.122.246	192.168.2.23
May 28, 2023 22:40:29.454565048 CEST	42836	443	192.168.2.23	91.189.91.43
May 28, 2023 22:40:32.651972055 CEST	37074	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:32.750442028 CEST	666	37074	68.183.122.246	192.168.2.23
May 28, 2023 22:40:37.756084919 CEST	37076	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:37.858565092 CEST	666	37076	68.183.122.246	192.168.2.23
May 28, 2023 22:40:42.863696098 CEST	37078	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:42.965344906 CEST	666	37078	68.183.122.246	192.168.2.23
May 28, 2023 22:40:47.970124006 CEST	37080	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:48.071700096 CEST	666	37080	68.183.122.246	192.168.2.23
May 28, 2023 22:40:53.076431990 CEST	37082	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:53.178028107 CEST	666	37082	68.183.122.246	192.168.2.23
May 28, 2023 22:40:58.182742119 CEST	37084	666	192.168.2.23	68.183.122.246
May 28, 2023 22:40:58.280695915 CEST	666	37084	68.183.122.246	192.168.2.23
May 28, 2023 22:41:03.285470009 CEST	37086	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:03.383047104 CEST	666	37086	68.183.122.246	192.168.2.23
May 28, 2023 22:41:08.386800051 CEST	37088	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:08.482907057 CEST	666	37088	68.183.122.246	192.168.2.23
May 28, 2023 22:41:13.488802910 CEST	37090	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:13.590240955 CEST	666	37090	68.183.122.246	192.168.2.23
May 28, 2023 22:41:18.594877958 CEST	37092	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:18.692589045 CEST	666	37092	68.183.122.246	192.168.2.23
May 28, 2023 22:41:23.697231054 CEST	37094	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:23.794892073 CEST	666	37094	68.183.122.246	192.168.2.23
May 28, 2023 22:41:28.798120022 CEST	37096	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:28.896245956 CEST	666	37096	68.183.122.246	192.168.2.23
May 28, 2023 22:41:33.901973009 CEST	37098	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:33.999568939 CEST	666	37098	68.183.122.246	192.168.2.23
May 28, 2023 22:41:39.005108118 CEST	37100	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:39.106614113 CEST	666	37100	68.183.122.246	192.168.2.23
May 28, 2023 22:41:44.112505913 CEST	37102	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:44.208842993 CEST	666	37102	68.183.122.246	192.168.2.23
May 28, 2023 22:41:49.215596914 CEST	37104	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:49.329452038 CEST	666	37104	68.183.122.246	192.168.2.23
May 28, 2023 22:41:54.404846907 CEST	37106	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:54.501111031 CEST	666	37106	68.183.122.246	192.168.2.23
May 28, 2023 22:41:59.505330086 CEST	37108	666	192.168.2.23	68.183.122.246
May 28, 2023 22:41:59.603696108 CEST	666	37108	68.183.122.246	192.168.2.23
May 28, 2023 22:42:04.613858938 CEST	37110	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:04.711464882 CEST	666	37110	68.183.122.246	192.168.2.23
May 28, 2023 22:42:09.716394901 CEST	37112	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:09.817184925 CEST	666	37112	68.183.122.246	192.168.2.23
May 28, 2023 22:42:14.821311951 CEST	37114	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:14.920342922 CEST	666	37114	68.183.122.246	192.168.2.23
May 28, 2023 22:42:19.926198959 CEST	37116	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:20.027709961 CEST	666	37116	68.183.122.246	192.168.2.23
May 28, 2023 22:42:25.031810045 CEST	37118	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:25.127932072 CEST	666	37118	68.183.122.246	192.168.2.23
May 28, 2023 22:42:30.133797884 CEST	37120	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:30.235619068 CEST	666	37120	68.183.122.246	192.168.2.23
May 28, 2023 22:42:35.241571903 CEST	37122	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:35.353394032 CEST	666	37122	68.183.122.246	192.168.2.23
May 28, 2023 22:42:40.356756926 CEST	37124	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:40.455171108 CEST	666	37124	68.183.122.246	192.168.2.23
May 28, 2023 22:42:45.459790945 CEST	37126	666	192.168.2.23	68.183.122.246
May 28, 2023 22:42:45.557492018 CEST	666	37126	68.183.122.246	192.168.2.23

System Behavior

Analysis Process: ZkTOOwsXyK.elf PID: 6228, Parent PID: 6126

General

Start time:	22:39:09
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	/tmp/ZkTOOwsXyK.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6230, Parent PID: 6228

General

Start time:	22:39:10
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6232, Parent PID: 6230

General

Start time:	22:39:10
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6234, Parent PID: 6232

General

Start time:	22:39:10
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6240, Parent PID: 6234

General

Start time:	22:39:15
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6244, Parent PID: 6240

General

Start time:	22:39:20
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6249, Parent PID: 6244

General

Start time:	22:39:25
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6253, Parent PID: 6249

General

Start time:	22:39:30
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6257, Parent PID: 6253

General

Start time:	22:39:35
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6261, Parent PID: 6257

General

Start time:	22:39:40
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6265, Parent PID: 6261

General

Start time:	22:39:45
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6269, Parent PID: 6265

General

Start time:	22:39:51
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6274, Parent PID: 6269

General

Start time:	22:39:56
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6280, Parent PID: 6274

General

Start time:	22:40:01
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6284, Parent PID: 6280

General

Start time:	22:40:06
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6288, Parent PID: 6284

General

Start time:	22:40:11
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6292, Parent PID: 6288

General

Start time:	22:40:16
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6296, Parent PID: 6292

General

Start time:	22:40:21
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6301, Parent PID: 6296

General

Start time:	22:40:26
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6305, Parent PID: 6301

General

Start time:	22:40:31
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6309, Parent PID: 6305

General

Start time:	22:40:36
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6313, Parent PID: 6309

General

Start time:	22:40:42
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6318, Parent PID: 6313

General

Start time:	22:40:47
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6322, Parent PID: 6318

General

Start time:	22:40:52
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6327, Parent PID: 6322

General

Start time:	22:40:57
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6333, Parent PID: 6327

General

Start time:	22:41:02
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6337, Parent PID: 6333

General

Start time:	22:41:07
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6341, Parent PID: 6337

General

Start time:	22:41:12
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6345, Parent PID: 6341

General

Start time:	22:41:17
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6349, Parent PID: 6345

General

Start time:	22:41:22
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6354, Parent PID: 6349

General

Start time:	22:41:28
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6358, Parent PID: 6354

General

Start time:	22:41:33
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6362, Parent PID: 6358

General

Start time:	22:41:38
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6366, Parent PID: 6362

General

Start time:	22:41:43
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6370, Parent PID: 6366

General

Start time:	22:41:48
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6377, Parent PID: 6370

General

Start time:	22:41:53
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6383, Parent PID: 6377

General

Start time:	22:41:58
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6387, Parent PID: 6383

General

Start time:	22:42:03
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6391, Parent PID: 6387

General

Start time:	22:42:08
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6395, Parent PID: 6391

General

Start time:	22:42:14
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6399, Parent PID: 6395

General

Start time:	22:42:19
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6406, Parent PID: 6399

General

Start time:	22:42:24
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6411, Parent PID: 6406

General

Start time:	22:42:29
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6415, Parent PID: 6411

General

Start time:	22:42:34
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6419, Parent PID: 6415

General

Start time:	22:42:39
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6423, Parent PID: 6419

General

Start time:	22:42:44
Start date:	28/05/2023
Path:	/tmp/ZkTOOwsXyK.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ZkTOOwsXyK.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ZkTOOwsXyK.elf PID: 6228, Parent PID: 6126

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6230, Parent PID: 6228

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6232, Parent PID: 6230

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: ZkTOOwsXyK.elf PID: 6234, Parent PID: 6232

General

Process Activities

Process Forked

Linux Analysis Report
ZkTOOwsXyK.elf