Edit tour

Linux Analysis Report
FTV9fS92pM.elf

Overview

General Information

Sample Name:	FTV9fS92pM.elf
Original Sample Name:	8d9894d8c3e7e51e0ac7b0bc06b80247.elf
Analysis ID:	877132
MD5:	8d9894d8c3e7e51e0ac7b0bc06b80247
SHA1:	efaf3a219aa99dd5091ac6c28536964be6aa4792
SHA256:	2d021244f11906e91b6ac76e849659d898cbb04ba2c36ec502b16b50dd62cbed
Tags:	32armelfgafgyt
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	877132
Start date and time:	2023-05-28 23:10:19 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	FTV9fS92pM.elf
Original Sample Name:	8d9894d8c3e7e51e0ac7b0bc06b80247.elf
Detection:	MAL
Classification:	mal56.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/FTV9fS92pM.elf
PID:	6227
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

FTV9fS92pM.elf (PID: 6227, Parent: 6122, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/FTV9fS92pM.elf

FTV9fS92pM.elf New Fork (PID: 6229, Parent: 6227)

FTV9fS92pM.elf New Fork (PID: 6231, Parent: 6229)

FTV9fS92pM.elf New Fork (PID: 6233, Parent: 6231)

FTV9fS92pM.elf New Fork (PID: 6238, Parent: 6233)

FTV9fS92pM.elf New Fork (PID: 6242, Parent: 6238)

FTV9fS92pM.elf New Fork (PID: 6247, Parent: 6242)

FTV9fS92pM.elf New Fork (PID: 6251, Parent: 6247)

FTV9fS92pM.elf New Fork (PID: 6255, Parent: 6251)

FTV9fS92pM.elf New Fork (PID: 6259, Parent: 6255)

FTV9fS92pM.elf New Fork (PID: 6263, Parent: 6259)

FTV9fS92pM.elf New Fork (PID: 6267, Parent: 6263)

FTV9fS92pM.elf New Fork (PID: 6274, Parent: 6267)

FTV9fS92pM.elf New Fork (PID: 6278, Parent: 6274)

FTV9fS92pM.elf New Fork (PID: 6282, Parent: 6278)

FTV9fS92pM.elf New Fork (PID: 6286, Parent: 6282)

FTV9fS92pM.elf New Fork (PID: 6290, Parent: 6286)

FTV9fS92pM.elf New Fork (PID: 6295, Parent: 6290)

FTV9fS92pM.elf New Fork (PID: 6299, Parent: 6295)

FTV9fS92pM.elf New Fork (PID: 6303, Parent: 6299)

FTV9fS92pM.elf New Fork (PID: 6307, Parent: 6303)

FTV9fS92pM.elf New Fork (PID: 6312, Parent: 6307)

FTV9fS92pM.elf New Fork (PID: 6316, Parent: 6312)

FTV9fS92pM.elf New Fork (PID: 6321, Parent: 6316)

FTV9fS92pM.elf New Fork (PID: 6327, Parent: 6321)

FTV9fS92pM.elf New Fork (PID: 6331, Parent: 6327)

FTV9fS92pM.elf New Fork (PID: 6335, Parent: 6331)

FTV9fS92pM.elf New Fork (PID: 6339, Parent: 6335)

FTV9fS92pM.elf New Fork (PID: 6343, Parent: 6339)

FTV9fS92pM.elf New Fork (PID: 6348, Parent: 6343)

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: FTV9fS92pM.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: FTV9fS92pM.elf	ReversingLabs: Detection: 67%
Source: FTV9fS92pM.elf	Virustotal: Detection: 65%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:37042 -> 68.183.122.246:666

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246
Source: unknown	TCP traffic detected without corresponding DNS query: 68.183.122.246

Source: classification engine

Classification label: mal56.linELF@0/0@0/0

Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: FTV9fS92pM.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/FTV9fS92pM.elf (PID: 6227)

Queries kernel information via 'uname':

Jump to behavior

Source: FTV9fS92pM.elf, 6227.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6229.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6231.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6233.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6238.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6242.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6247.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6251.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6255.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6259.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6263.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6267.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6274.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6278.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6282.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6286.1.000056319b43b000.000056319b569000.rw-.sdmp	Binary or memory string: 1V!/etc/qemu-binfmt/arm
Source: FTV9fS92pM.elf, 6227.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6229.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6231.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6233.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6238.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6242.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6247.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6251.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6255.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6259.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6263.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6267.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6274.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6278.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6282.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6286.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/FTV9fS92pM.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/FTV9fS92pM.elf
Source: FTV9fS92pM.elf, 6227.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6229.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6231.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6233.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6238.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6242.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6247.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6251.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6255.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6259.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6263.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6267.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6274.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6278.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6282.1.000056319b43b000.000056319b569000.rw-.sdmp, FTV9fS92pM.elf, 6286.1.000056319b43b000.000056319b569000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: FTV9fS92pM.elf, 6227.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6229.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6231.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6233.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6238.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6242.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6247.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6251.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6255.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6259.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6263.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6267.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6274.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6278.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6282.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp, FTV9fS92pM.elf, 6286.1.00007ffdc5be7000.00007ffdc5c08000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Safari/604.1.38
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; CrOS x86_64 9592.96.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.114 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 535) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Mobile Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.4; HTC Desire 620 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Mobile/14D27
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FTV9fS92pM.elf	68%	ReversingLabs	Linux.Trojan.Gafgyt
FTV9fS92pM.elf	66%	Virustotal		Browse
FTV9fS92pM.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
68.183.122.246	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	9VevysM4Ke.elf	Get hash	malicious	Unknown	Browse
	BcOu0FaWzS.elf	Get hash	malicious	Unknown	Browse
	h2l9861DE5.elf	Get hash	malicious	Unknown	Browse
	a6EOZDfqQQ.elf	Get hash	malicious	Unknown	Browse
	hQR4J20aVM.elf	Get hash	malicious	Unknown	Browse
	0ikWSYe8Se.elf	Get hash	malicious	Unknown	Browse
	ZkTOOwsXyK.elf	Get hash	malicious	Unknown	Browse
	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse
91.189.91.43	9VevysM4Ke.elf	Get hash	malicious	Unknown	Browse
	BcOu0FaWzS.elf	Get hash	malicious	Unknown	Browse
	h2l9861DE5.elf	Get hash	malicious	Unknown	Browse
	a6EOZDfqQQ.elf	Get hash	malicious	Unknown	Browse
	hQR4J20aVM.elf	Get hash	malicious	Unknown	Browse
	0ikWSYe8Se.elf	Get hash	malicious	Unknown	Browse
	ZkTOOwsXyK.elf	Get hash	malicious	Unknown	Browse
	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	9VevysM4Ke.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	BcOu0FaWzS.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	h2l9861DE5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	a6EOZDfqQQ.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	hQR4J20aVM.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	0ikWSYe8Se.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ZkTOOwsXyK.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse	91.189.91.42
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse	91.189.91.42
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse	91.189.91.42
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse	91.189.91.42
INIT7CH	9VevysM4Ke.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	BcOu0FaWzS.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	h2l9861DE5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	a6EOZDfqQQ.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	hQR4J20aVM.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	0ikWSYe8Se.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ZkTOOwsXyK.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	3qH19GzES3.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	lcNr8LzeHM.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mWnlmC2kZM.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	LVtIkAJg0x.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	kLDAOT6z82.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	cPti8fO10q.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	hk8CPy1BAP.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dGxRxV2QNV.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fBVwHYfERC.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sUbUv7slY5.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	acLfUkpQPv.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	1CWQHGs4ZY.elf	Get hash	malicious	Moobot	Browse	109.202.202.202
	t8Nktbyd94.elf	Get hash	malicious	Moobot	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.944566827792492
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	FTV9fS92pM.elf
File size:	127723
MD5:	8d9894d8c3e7e51e0ac7b0bc06b80247
SHA1:	efaf3a219aa99dd5091ac6c28536964be6aa4792
SHA256:	2d021244f11906e91b6ac76e849659d898cbb04ba2c36ec502b16b50dd62cbed
SHA512:	b9e76835cc722e6bad2dbb6379d24b221b2aff3120761d3a5884652d3282a0bfddbb1468c9d37d12d1fce0d340de1ab9d18f7493a2413f054b82eaf4e2f2b402
SSDEEP:	3072:H63VpNeuWDGeQf8sRCBt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCBt3ZmyVUQuiXfQd6W
TLSH:	3CC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................X...X...............`...`...`.......g..........Q.td..................................-...L."....H..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x120ac	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1a15c	0x1215c	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1a170	0x12170	0x3744	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1d8b4	0x158b4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x26000	0x16000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x26008	0x16008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x26010	0x16010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x26014	0x16014	0x408	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2641c	0x1641c	0x636c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1641c	0xb68	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x16f88	0x120	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x170a8	0x578	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17620	0xb4	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x176d4	0x8bd	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x17f94	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x18034	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x183fc	0x48d0	0x10	0x0		19	647	4
.strtab	STRTAB	0x0	0x1cccc	0x261f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x158b8	0x158b8	6.0864	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x16000	0x26000	0x26000	0x41c	0x6788	3.0196	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1a15c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1a170	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1d8b4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x26000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x26008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x26010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x26014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2641c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a15c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a168	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1a16c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbdb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1338c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1366c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1368c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1490c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1521c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1550c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1678c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1723c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1777c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1947c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x26008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2601c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a19c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x95f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9bc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb58c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbda4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf66c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1085c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x260b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x260c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x260c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1c85c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12800	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26204	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x140d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2630c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1445c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26324	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x146d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d488	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x263d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14bc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x263f0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x151f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c68c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x153dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d4d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16888	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x263f8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1758c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1804c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18cbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26410	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x191b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19230	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv4l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.100.4599	.symtab	0x1a834	144	OBJECT	<unknown>	DEFAULT	4
C.104.4641	.symtab	0x1a8c4	144	OBJECT	<unknown>	DEFAULT	4
C.108.4683	.symtab	0x1a954	144	OBJECT	<unknown>	DEFAULT	4
C.112.4725	.symtab	0x1a9e4	144	OBJECT	<unknown>	DEFAULT	4
C.116.4767	.symtab	0x1aa74	144	OBJECT	<unknown>	DEFAULT	4
C.120.4809	.symtab	0x1ab04	144	OBJECT	<unknown>	DEFAULT	4
C.124.4850	.symtab	0x1acd4	8	OBJECT	<unknown>	DEFAULT	4
C.128.4885	.symtab	0x1acdc	8	OBJECT	<unknown>	DEFAULT	4
C.132.4920	.symtab	0x1ace4	8	OBJECT	<unknown>	DEFAULT	4
C.136.4955	.symtab	0x1acec	8	OBJECT	<unknown>	DEFAULT	4
C.140.4990	.symtab	0x1acf4	8	OBJECT	<unknown>	DEFAULT	4
C.142.5019	.symtab	0x1bab8	12	OBJECT	<unknown>	DEFAULT	4
C.143.5020	.symtab	0x1ba98	12	OBJECT	<unknown>	DEFAULT	4
C.96.4557	.symtab	0x1a7a4	144	OBJECT	<unknown>	DEFAULT	4
GetRandomIP	.symtab	0x9d64	96	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x13178	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x13194	0	NOTYPE	<unknown>	DEFAULT	2
OreoServer	.symtab	0x26024	4	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x26454	16384	OBJECT	<unknown>	DEFAULT	10
RandString	.symtab	0x9858	136	FUNC	<unknown>	DEFAULT	2
Send100UP	.symtab	0xb424	364	FUNC	<unknown>	DEFAULT	2
SendNUKE	.symtab	0xb6fc	364	FUNC	<unknown>	DEFAULT	2
SendOVH	.symtab	0xb14c	364	FUNC	<unknown>	DEFAULT	2
SendPAKI	.symtab	0xb590	364	FUNC	<unknown>	DEFAULT	2
SendZAP	.symtab	0xb2b8	364	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x26004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x26000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x260b8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1c25c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x26410	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1d5b4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x260c0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1c55c	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2600c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x26008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1d8b4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1d8b4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x260b8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1c25c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x26410	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1d5b4	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x260c0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1c55c	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x260bc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x26414	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x260c4	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11a14	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x142ac	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17594	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x11a3c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x11a68	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13bd0	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x11a94	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2c68c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x14b38	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x15248	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14aa4	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x175fc	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17e8c	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17cb8	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x18070	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1777c	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x11ac0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17788	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17794	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15274	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x152a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x152cc	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x11b14	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x152f8	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2c690	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x16944	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x18748	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x183d4	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x14830	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1366c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11bbc	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18ff0	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16690	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x13080	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16680	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1678c	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x167a4	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x13090	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x11c54	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x175d0	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x17558	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x143f8	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x146d4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x18108	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x11cb0	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x13c58	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x15350	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11cdc	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13c84	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x11d0c	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x11d74	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x11da0	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13ce4	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x14614	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x15114	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13d40	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13d70	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11df8	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14bcc	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13d14	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11f04	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x14764	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x191b8	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x131b0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x132b8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x182d8	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x13150	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x181c0	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x132d4	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1338c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x16904	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x18288	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1346c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13660	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16890	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x14904	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1368c	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11e4c	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x19054	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11ec4	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11f38	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x153a8	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x153e0	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15450	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15430	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x11e80	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x26010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x26010	0	OBJECT	<unknown>	DEFAULT	8
__adddf3	.symtab	0x19684	736	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmpeq	.symtab	0x1a054	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdcmple	.symtab	0x1a054	20	FUNC	<unknown>	DEFAULT	2
__aeabi_cdrcmple	.symtab	0x1a038	48	FUNC	<unknown>	DEFAULT	2
__aeabi_d2uiz	.symtab	0x1a0cc	84	FUNC	<unknown>	DEFAULT	2
__aeabi_dadd	.symtab	0x19684	736	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpeq	.symtab	0x1a068	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpge	.symtab	0x1a0a4	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmpgt	.symtab	0x1a0b8	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmple	.symtab	0x1a090	20	FUNC	<unknown>	DEFAULT	2
__aeabi_dcmplt	.symtab	0x1a07c	20	FUNC	<unknown>	DEFAULT	2
__aeabi_ddiv	.symtab	0x19da0	516	FUNC	<unknown>	DEFAULT	2
__aeabi_dmul	.symtab	0x19a78	808	FUNC	<unknown>	DEFAULT	2
__aeabi_drsub	.symtab	0x19678	0	FUNC	<unknown>	DEFAULT	2
__aeabi_dsub	.symtab	0x19680	740	FUNC	<unknown>	DEFAULT	2
__aeabi_f2d	.symtab	0x199b8	64	FUNC	<unknown>	DEFAULT	2
__aeabi_i2d	.symtab	0x1998c	44	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv	.symtab	0x19538	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x19660	24	FUNC	<unknown>	DEFAULT	2
__aeabi_l2d	.symtab	0x19a0c	108	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x19964	40	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11600	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x116f8	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ul2d	.symtab	0x199f8	128	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2c680	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x263d8	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2641c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2641c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14e34	56	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x19fb4	132	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x260bc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x26414	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x260c4	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2c6b0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x26014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18bb8	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x192dc	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18a90	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x15218	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x15214	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__divdf3	.symtab	0x19da0	516	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x19538	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x16a30	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x1a120	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x26018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x19234	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x189a8	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x18b48	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2c678	4	OBJECT	<unknown>	DEFAULT	10
__eqdf2	.symtab	0x19fb4	132	FUNC	<unknown>	DEFAULT	2
__errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2c670	4	OBJECT	<unknown>	HIDDEN	10
__extendsfdf2	.symtab	0x199b8	64	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fixunsdfsi	.symtab	0x1a0cc	84	FUNC	<unknown>	DEFAULT	2
__floatdidf	.symtab	0x19a0c	108	FUNC	<unknown>	DEFAULT	2
__floatsidf	.symtab	0x1998c	44	FUNC	<unknown>	DEFAULT	2
__floatundidf	.symtab	0x199f8	128	FUNC	<unknown>	DEFAULT	2
__floatunsidf	.symtab	0x19964	40	FUNC	<unknown>	DEFAULT	2
__gedf2	.symtab	0x19fa4	148	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x17510	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x19fa4	148	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x140f0	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x141b8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x14184	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x141a4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__ledf2	.symtab	0x19fac	140	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x193a8	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18ba4	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18ff0	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x175d0	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x11cb0	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x13c58	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11cdc	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13c84	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x15114	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2c674	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x11e80	44	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x19fac	140	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x26204	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2c654	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2c744	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x117dc	228	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x19a78	808	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x118c4	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2c76c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2c778	4	OBJECT	<unknown>	HIDDEN	10
__nedf2	.symtab	0x19fb4	132	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x18c94	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1723c	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2c67c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x26000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x17558	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18cc8	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x263f8	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2c684	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2c75c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2c77c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13e64	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13e88	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13e40	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x260d4	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x193f4	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1550c	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x178c4	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x155c8	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x12058	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1c85c	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x19450	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17c88	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1947c	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15700	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12120	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x260d8	4	OBJECT	<unknown>	DEFAULT	9
__subdf3	.symtab	0x19680	740	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x151f8	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1521c	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14ec8	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x263f0	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11600	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11710	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x12150	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x17570	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2c780	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2c784	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x2641c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2c788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2c68c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x11a14	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1a15c	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2a460	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1219c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x159f8	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2c690	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15804	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x161f0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12814	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x12acc	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x128ac	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x128e4	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x12a80	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2c6c4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17990	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11fe8	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x260dc	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x260e0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17d4c	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x2a45c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x260f8	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x2a458	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x26114	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x12068	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x26110	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1490c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15874	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1c92c	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x158a8	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12220	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x142ac	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x13070	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2c66c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2c688	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17594	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x2c464	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x2c474	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x26030	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1a154	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x11a3c	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_tcp_udp	.symtab	0x9f1c	448	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2555	.symtab	0x2641c	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x92f8	636	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9dc4	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x26028	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x26020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x11a94	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2c678	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2c68c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x14b38	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x15248	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14aa4	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1d4d0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x175fc	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x9228	208	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x2a454	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x90a4	388	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x8e1c	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17e8c	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17cb8	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x18070	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1d4bc	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1777c	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x26014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x26418	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x14000	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x17788	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x17788	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17794	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getHost	.symtab	0x979c	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x109f4	740	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x19088	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15274	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x152a0	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x152cc	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x13c28	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x152f8	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x26440	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x2c640	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2c690	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x1a19c	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x13730	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13754	20	FUNC	<unknown>	DEFAULT	2
i.3637	.symtab	0x26034	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x131b0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x16944	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x18748	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x185e4	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x183d4	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x18308	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10868	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x26208	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x14500	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x14830	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ioctl_keepalive	.symtab	0xe538	304	FUNC	<unknown>	DEFAULT	2
ioctl_pid	.symtab	0x26438	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x1366c	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x11eac	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11bbc	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9bcc	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18ff0	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x2644c	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x10cd8	2344	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x2643c	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0xa1ec	276	FUNC	<unknown>	DEFAULT	2
makeVSEPacket	.symtab	0xa300	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13eac	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16690	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x13080	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x16680	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x1678c	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x167a4	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x13090	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x2630c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x26324	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2c694	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x2c460	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x136f8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1371c	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x26444	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x26420	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2c6b4	4	OBJECT	<unknown>	DEFAULT	10
ourPublicIP	.symtab	0x2c6b8	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0xbdb0	3464	FUNC	<unknown>	DEFAULT	2
p.2553	.symtab	0x2601c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x9574	128	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x2c6c0	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x11c54	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x175d0	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x11c80	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1c884	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x88e0	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8508	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x86f8	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8574	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xe668	8704	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1c898	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x17558	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x143f4	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x143f8	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1d488	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x146d4	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x26358	128	OBJECT	<unknown>	DEFAULT	9
rangechoice	.symtab	0x2602c	4	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x18108	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 49
• 666 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2023 23:11:05.271347046 CEST	42836	443	192.168.2.23	91.189.91.43
May 28, 2023 23:11:05.418178082 CEST	37042	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:05.520114899 CEST	666	37042	68.183.122.246	192.168.2.23
May 28, 2023 23:11:06.295489073 CEST	42516	80	192.168.2.23	109.202.202.202
May 28, 2023 23:11:10.528561115 CEST	37044	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:10.626997948 CEST	666	37044	68.183.122.246	192.168.2.23
May 28, 2023 23:11:15.631751060 CEST	37046	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:15.731794119 CEST	666	37046	68.183.122.246	192.168.2.23
May 28, 2023 23:11:20.374674082 CEST	43928	443	192.168.2.23	91.189.91.42
May 28, 2023 23:11:20.739238977 CEST	37048	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:20.837136984 CEST	666	37048	68.183.122.246	192.168.2.23
May 28, 2023 23:11:25.841862917 CEST	37050	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:25.939728975 CEST	666	37050	68.183.122.246	192.168.2.23
May 28, 2023 23:11:30.946633101 CEST	37052	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:31.042918921 CEST	666	37052	68.183.122.246	192.168.2.23
May 28, 2023 23:11:32.662184000 CEST	42836	443	192.168.2.23	91.189.91.43
May 28, 2023 23:11:36.048688889 CEST	37054	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:36.145100117 CEST	666	37054	68.183.122.246	192.168.2.23
May 28, 2023 23:11:36.757867098 CEST	42516	80	192.168.2.23	109.202.202.202
May 28, 2023 23:11:41.153778076 CEST	37056	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:41.254703999 CEST	666	37056	68.183.122.246	192.168.2.23
May 28, 2023 23:11:46.269845963 CEST	37058	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:46.368297100 CEST	666	37058	68.183.122.246	192.168.2.23
May 28, 2023 23:11:51.370311022 CEST	37060	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:51.466445923 CEST	666	37060	68.183.122.246	192.168.2.23
May 28, 2023 23:11:56.468488932 CEST	37062	666	192.168.2.23	68.183.122.246
May 28, 2023 23:11:56.569866896 CEST	666	37062	68.183.122.246	192.168.2.23
May 28, 2023 23:12:01.332469940 CEST	43928	443	192.168.2.23	91.189.91.42
May 28, 2023 23:12:01.573185921 CEST	37064	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:01.669503927 CEST	666	37064	68.183.122.246	192.168.2.23
May 28, 2023 23:12:06.680445910 CEST	37066	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:06.782001972 CEST	666	37066	68.183.122.246	192.168.2.23
May 28, 2023 23:12:11.786427021 CEST	37068	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:11.883991003 CEST	666	37068	68.183.122.246	192.168.2.23
May 28, 2023 23:12:16.889656067 CEST	37070	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:16.987380028 CEST	666	37070	68.183.122.246	192.168.2.23
May 28, 2023 23:12:21.992175102 CEST	37072	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:22.089781046 CEST	666	37072	68.183.122.246	192.168.2.23
May 28, 2023 23:12:27.095622063 CEST	37074	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:27.195879936 CEST	666	37074	68.183.122.246	192.168.2.23
May 28, 2023 23:12:32.200620890 CEST	37076	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:32.302083015 CEST	666	37076	68.183.122.246	192.168.2.23
May 28, 2023 23:12:37.307425976 CEST	37078	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:37.409868956 CEST	666	37078	68.183.122.246	192.168.2.23
May 28, 2023 23:12:42.421359062 CEST	37080	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:42.523056984 CEST	666	37080	68.183.122.246	192.168.2.23
May 28, 2023 23:12:47.529376030 CEST	37082	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:47.632441044 CEST	666	37082	68.183.122.246	192.168.2.23
May 28, 2023 23:12:52.637231112 CEST	37084	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:52.735371113 CEST	666	37084	68.183.122.246	192.168.2.23
May 28, 2023 23:12:57.741353035 CEST	37086	666	192.168.2.23	68.183.122.246
May 28, 2023 23:12:57.839700937 CEST	666	37086	68.183.122.246	192.168.2.23
May 28, 2023 23:13:02.849179983 CEST	37088	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:02.945384979 CEST	666	37088	68.183.122.246	192.168.2.23
May 28, 2023 23:13:07.950910091 CEST	37090	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:08.052603960 CEST	666	37090	68.183.122.246	192.168.2.23
May 28, 2023 23:13:13.057393074 CEST	37092	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:13.158204079 CEST	666	37092	68.183.122.246	192.168.2.23
May 28, 2023 23:13:18.167876959 CEST	37094	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:18.265403032 CEST	666	37094	68.183.122.246	192.168.2.23
May 28, 2023 23:13:23.269983053 CEST	37096	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:23.369339943 CEST	666	37096	68.183.122.246	192.168.2.23
May 28, 2023 23:13:28.375077963 CEST	37098	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:28.472762108 CEST	666	37098	68.183.122.246	192.168.2.23
May 28, 2023 23:13:33.478393078 CEST	37100	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:33.580543995 CEST	666	37100	68.183.122.246	192.168.2.23
May 28, 2023 23:13:38.588210106 CEST	37102	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:38.685189009 CEST	666	37102	68.183.122.246	192.168.2.23
May 28, 2023 23:13:43.690510988 CEST	37104	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:43.792109966 CEST	666	37104	68.183.122.246	192.168.2.23
May 28, 2023 23:13:48.797233105 CEST	37106	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:48.893439054 CEST	666	37106	68.183.122.246	192.168.2.23
May 28, 2023 23:13:53.898132086 CEST	37108	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:53.995850086 CEST	666	37108	68.183.122.246	192.168.2.23
May 28, 2023 23:13:59.001328945 CEST	37110	666	192.168.2.23	68.183.122.246
May 28, 2023 23:13:59.116532087 CEST	666	37110	68.183.122.246	192.168.2.23
May 28, 2023 23:14:04.125020027 CEST	37112	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:04.223994970 CEST	666	37112	68.183.122.246	192.168.2.23
May 28, 2023 23:14:09.234015942 CEST	37114	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:09.332534075 CEST	666	37114	68.183.122.246	192.168.2.23
May 28, 2023 23:14:14.343072891 CEST	37116	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:14.444732904 CEST	666	37116	68.183.122.246	192.168.2.23
May 28, 2023 23:14:19.450237989 CEST	37118	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:19.546751976 CEST	666	37118	68.183.122.246	192.168.2.23
May 28, 2023 23:14:24.553724051 CEST	37120	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:24.658863068 CEST	666	37120	68.183.122.246	192.168.2.23
May 28, 2023 23:14:29.665577888 CEST	37122	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:29.762031078 CEST	666	37122	68.183.122.246	192.168.2.23
May 28, 2023 23:14:34.772665024 CEST	37124	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:34.870461941 CEST	666	37124	68.183.122.246	192.168.2.23
May 28, 2023 23:14:39.875869989 CEST	37126	666	192.168.2.23	68.183.122.246
May 28, 2023 23:14:39.973572016 CEST	666	37126	68.183.122.246	192.168.2.23

System Behavior

Analysis Process: FTV9fS92pM.elf PID: 6227, Parent PID: 6122

General

Start time:	23:11:04
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	/tmp/FTV9fS92pM.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6229, Parent PID: 6227

General

Start time:	23:11:04
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6231, Parent PID: 6229

General

Start time:	23:11:04
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6233, Parent PID: 6231

General

Start time:	23:11:04
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6238, Parent PID: 6233

General

Start time:	23:11:09
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6242, Parent PID: 6238

General

Start time:	23:11:14
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6247, Parent PID: 6242

General

Start time:	23:11:19
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6251, Parent PID: 6247

General

Start time:	23:11:24
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6255, Parent PID: 6251

General

Start time:	23:11:29
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6259, Parent PID: 6255

General

Start time:	23:11:34
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6263, Parent PID: 6259

General

Start time:	23:11:39
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6267, Parent PID: 6263

General

Start time:	23:11:45
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6274, Parent PID: 6267

General

Start time:	23:11:50
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6278, Parent PID: 6274

General

Start time:	23:11:55
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6282, Parent PID: 6278

General

Start time:	23:12:00
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6286, Parent PID: 6282

General

Start time:	23:12:05
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6290, Parent PID: 6286

General

Start time:	23:12:10
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6295, Parent PID: 6290

General

Start time:	23:12:15
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6299, Parent PID: 6295

General

Start time:	23:12:20
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6303, Parent PID: 6299

General

Start time:	23:12:25
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6307, Parent PID: 6303

General

Start time:	23:12:31
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6312, Parent PID: 6307

General

Start time:	23:12:36
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6316, Parent PID: 6312

General

Start time:	23:12:41
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6321, Parent PID: 6316

General

Start time:	23:12:46
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6327, Parent PID: 6321

General

Start time:	23:12:51
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6331, Parent PID: 6327

General

Start time:	23:12:56
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6335, Parent PID: 6331

General

Start time:	23:13:01
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6339, Parent PID: 6335

General

Start time:	23:13:06
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6343, Parent PID: 6339

General

Start time:	23:13:11
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6348, Parent PID: 6343

General

Start time:	23:13:17
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6353, Parent PID: 6348

General

Start time:	23:13:22
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6357, Parent PID: 6353

General

Start time:	23:13:27
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6361, Parent PID: 6357

General

Start time:	23:13:32
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6365, Parent PID: 6361

General

Start time:	23:13:37
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6371, Parent PID: 6365

General

Start time:	23:13:42
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6378, Parent PID: 6371

General

Start time:	23:13:47
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6384, Parent PID: 6378

General

Start time:	23:13:52
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6388, Parent PID: 6384

General

Start time:	23:13:57
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6392, Parent PID: 6388

General

Start time:	23:14:02
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6396, Parent PID: 6392

General

Start time:	23:14:08
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6400, Parent PID: 6396

General

Start time:	23:14:13
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6407, Parent PID: 6400

General

Start time:	23:14:18
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6412, Parent PID: 6407

General

Start time:	23:14:23
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6416, Parent PID: 6412

General

Start time:	23:14:28
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6420, Parent PID: 6416

General

Start time:	23:14:33
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6424, Parent PID: 6420

General

Start time:	23:14:38
Start date:	28/05/2023
Path:	/tmp/FTV9fS92pM.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report FTV9fS92pM.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: FTV9fS92pM.elf PID: 6227, Parent PID: 6122

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6229, Parent PID: 6227

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6231, Parent PID: 6229

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: FTV9fS92pM.elf PID: 6233, Parent PID: 6231

General

Process Activities

Process Forked

Linux Analysis Report
FTV9fS92pM.elf