Edit tour

Linux Analysis Report
apache2.elf

Overview

General Information

Sample name:	apache2.elf
Analysis ID:	1531793
MD5:	d0cbd0c0874e87321c4470fe47509a66
SHA1:	a9cdec41b05c0d6336e1e870eea281355401b866
SHA256:	55cefdd21b1b72a98650d83384d4ca33e8ba676460c70178242cd41754813b3c
Tags:	user-elfdigest
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531793
Start date and time:	2024-10-11 20:34:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	apache2.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: apache2.elf

Runtime Messages

Command:	/tmp/apache2.elf
PID:	5419
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

apache2.elf (PID: 5419, Parent: 5344, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/apache2.elf

apache2.elf New Fork (PID: 5421, Parent: 5419)

apache2.elf New Fork (PID: 5423, Parent: 5421)

dash New Fork (PID: 5439, Parent: 3590)

rm (PID: 5439, Parent: 3590, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.uv6gGIxdpW /tmp/tmp.NiZdTYIHEX /tmp/tmp.cngHL3w9F2

dash New Fork (PID: 5440, Parent: 3590)

cat (PID: 5440, Parent: 3590, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.uv6gGIxdpW

dash New Fork (PID: 5441, Parent: 3590)

head (PID: 5441, Parent: 3590, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5442, Parent: 3590)

tr (PID: 5442, Parent: 3590, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5443, Parent: 3590)

cut (PID: 5443, Parent: 3590, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5444, Parent: 3590)

cat (PID: 5444, Parent: 3590, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.uv6gGIxdpW

dash New Fork (PID: 5445, Parent: 3590)

head (PID: 5445, Parent: 3590, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5446, Parent: 3590)

tr (PID: 5446, Parent: 3590, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5447, Parent: 3590)

cut (PID: 5447, Parent: 3590, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5448, Parent: 3590)

rm (PID: 5448, Parent: 3590, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.uv6gGIxdpW /tmp/tmp.NiZdTYIHEX /tmp/tmp.cngHL3w9F2

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
apache2.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
apache2.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
apache2.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cf0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
apache2.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1f474:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x214b0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cf0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1f474:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x214b0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cf0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cf98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cfe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1f474:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x214b0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: apache2.elf PID: 5419	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: apache2.elf PID: 5419	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11b63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ca3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ccb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11cf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: apache2.elf PID: 5419	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1500b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x15278:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x17ea5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: apache2.elf PID: 5421	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: apache2.elf PID: 5421	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14da0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14db4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14dc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14df0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: apache2.elf PID: 5421	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x181f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x18465:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x1b092:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 9 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T20:34:49.820439+0200	2846526	1	A Network Trojan was detected	192.168.2.13	37942	160.22.160.59	4444	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: apache2.elf

Avira: detected

Found malware configuration

Source: apache2.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "160.22.160.59:4444"}

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.13:58866 version: TLS 1.2

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/apache2.elf (PID: 5419)

Opens: /proc/net/route

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:37942 -> 160.22.160.59:4444

Source: global traffic

TCP traffic: 192.168.2.13:37942 -> 160.22.160.59:4444

Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	TCP traffic detected without corresponding DNS query: 160.22.160.59
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: apache2.elf	String found in binary or memory: http://fast.no/support/crawler.asp)
Source: apache2.elf	String found in binary or memory: http://feedback.redkolibri.com/
Source: apache2.elf	String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: apache2.elf	String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: apache2.elf	String found in binary or memory: http://www.billybobbot.com/crawler/)

Source: unknown	Network traffic detected: HTTP traffic on port 58866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58866

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.13:58866 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: apache2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: apache2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: apache2.elf PID: 5419, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: apache2.elf PID: 5419, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: apache2.elf PID: 5421, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: apache2.elf PID: 5421, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: apache2.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: apache2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: apache2.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: apache2.elf PID: 5419, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: apache2.elf PID: 5419, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: apache2.elf PID: 5421, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: apache2.elf PID: 5421, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/0@2/0

Source: /usr/bin/dash (PID: 5439)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.uv6gGIxdpW /tmp/tmp.NiZdTYIHEX /tmp/tmp.cngHL3w9F2			Jump to behavior
Source: /usr/bin/dash (PID: 5448)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.uv6gGIxdpW /tmp/tmp.NiZdTYIHEX /tmp/tmp.cngHL3w9F2			Jump to behavior

Source: /tmp/apache2.elf (PID: 5419)

Queries kernel information via 'uname':

Jump to behavior

Source: apache2.elf, 5419.1.0000557bcdd4e000.0000557bcde7c000.rw-.sdmp, apache2.elf, 5421.1.0000557bcdd4e000.0000557bcde7c000.rw-.sdmp	Binary or memory string: {U!/etc/qemu-binfmt/arm
Source: apache2.elf, 5419.1.00007ffee592c000.00007ffee594d000.rw-.sdmp, apache2.elf, 5421.1.00007ffee592c000.00007ffee594d000.rw-.sdmp	Binary or memory string: ^x86_64/usr/bin/qemu-arm/tmp/apache2.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/apache2.elf
Source: apache2.elf, 5419.1.0000557bcdd4e000.0000557bcde7c000.rw-.sdmp, apache2.elf, 5421.1.0000557bcdd4e000.0000557bcde7c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: apache2.elf, 5419.1.00007ffee592c000.00007ffee594d000.rw-.sdmp, apache2.elf, 5421.1.00007ffee592c000.00007ffee594d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: apache2.elf, type: SAMPLE
Source: Yara match	File source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: apache2.elf, type: SAMPLE
Source: Yara match	File source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: apache2.elf PID: 5419, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: apache2.elf PID: 5421, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60
Source: Initial sample	User agent string found: Mozilla/5.0 (iPad; U; CPU OS 5_1 like Mac OS X) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B367 Safari/531.21.10 UCBrowser/3.4.3.532
Source: Initial sample	User agent string found: Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; cn) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.8) Gecko/20100723 Ubuntu/10.04 (lucid) Firefox/3.6.8
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: apache2.elf, type: SAMPLE
Source: Yara match	File source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: apache2.elf, type: SAMPLE
Source: Yara match	File source: 5419.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5421.1.00007f7f0c017000.00007f7f0c03b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: apache2.elf PID: 5419, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: apache2.elf PID: 5421, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "160.22.160.59:4444"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
apache2.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.billybobbot.com/crawler/)	0%	URL Reputation	safe
http://fast.no/support/crawler.asp)	0%	URL Reputation	safe
http://feedback.redkolibri.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
160.22.160.59:4444	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.baidu.com/search/spider.html)	apache2.elf	false		unknown
http://www.billybobbot.com/crawler/)	apache2.elf	false	URL Reputation: safe	unknown
http://fast.no/support/crawler.asp)	apache2.elf	false	URL Reputation: safe	unknown
http://feedback.redkolibri.com/	apache2.elf	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spider.htm)	apache2.elf	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States		16509	AMAZON-02US	false
160.22.160.59	unknown	unknown		45194	SIPL-ASSysconInfowayPvtLtdIN	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	na.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	n7Nzys6TF5.elf	Get hash	malicious	Mirai	Browse
	6e1rv1WaB3.elf	Get hash	malicious	Mirai	Browse
	R3AhFxlB5h.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	IwoeBDAv8n.elf	Get hash	malicious	Gafgyt	Browse
	na.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	na.elf	Get hash	malicious	Mirai, Moobot	Browse
160.22.160.59	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse
160.22.160.59	boatnet.arm.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	npc_mipsle.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	na.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIPL-ASSysconInfowayPvtLtdIN	ntpd.elf	Get hash	malicious	Gafgyt, Mirai	Browse	160.22.160.59
	8kjULT74JI.elf	Get hash	malicious	Mirai	Browse	103.236.117.221
	79VAlgfTk8.elf	Get hash	malicious	Mirai	Browse	160.22.254.149
	3wpWVfURxT.exe	Get hash	malicious	Unknown	Browse	103.59.205.40
	vDKodMikIj.exe	Get hash	malicious	Unknown	Browse	103.59.205.40
	bSgEe4v0It.elf	Get hash	malicious	Unknown	Browse	111.119.193.10
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	160.22.160.59
	na.elf	Get hash	malicious	Mirai	Browse	45.117.212.27
	na.elf	Get hash	malicious	Gafgyt	Browse	45.117.212.21
	na.elf	Get hash	malicious	Gafgyt	Browse	45.117.212.11
AMAZON-02US	http://boot.uleif.com	Get hash	malicious	Unknown	Browse	76.76.21.21
	https://lessonfulladvocating.z19.web.core.windows.net/	Get hash	malicious	Anonymous Proxy	Browse	54.77.205.105
	https://iceagfd.r.bh.d.sendibt3.com/tr/cl/PjbsIyrZEvBY_Rwsfyw5Jf3lFVOT6oZHgb1SfX63Lb3ae9-gfKb2jlPREqBkpRV4pWkurBsbJBFEH15AJtTYwybPM0qTkZDrUU83xYgtOUx5R28tYfv9FR0maF37xHQF64yZn75cO5R-BikxqcNs-GP05aHxn7akD1lscY1ZXn8Sa5QzaOWc3HI5Bxl8P31E7CLLw2CE-dF5d15hX2uTa_r1cKi-35rM-WIiEe68qdBkTveiUWlcumiEAjlk2Kvi5yjTX_e6daYkRZIdeCzTt2ZiQO8M7mU8cmRhqn7vv3d1nfoyuLqCz_csFUqVodYl0s8BAkd5yMVlDg	Get hash	malicious	Unknown	Browse	143.204.215.107
	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&why=7WZIz&xf=y&jxwh=7WZIz&xtzwhj=&hi=7WZIz&zfhy=&zwq=frudxdjAjsynslgfxj.htr.fzd.oflfd___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo5MTJhYWJjZjBjZWQ3YTE3MzliOWViMjI2OTgzNmFjODo3OmFiMTk6M2MwNmNjYzRlYzBhY2Q2MTg4MWQ5YTMxZDNlZTRiZmFmOTNhMjg1NDIzMDkzM2QyMzQ2MzYzY2Q5NzJhMDgxYTpoOlQ6VA#cnlhbkBsaW5jb2xubWFpbmVmY3UuY29t	Get hash	malicious	Unknown	Browse	52.49.114.115
	http://url5730.bkb-tours.com/ls/click?upn=u001.RGHmK1hbhRj1emqWdiNhLSLfhiHa5Xgj2PgdNFABoTzAEieA-2BAi72IlbwekEjzmy-2Bbvyjc6OaRM0j3Y4D96jZw-3D-3DG4Tq_wXBdKYou10O603QUzohLrBXWU3YfNwQigQmNAZXWbchq1WxjhMmweu-2FsutHjCUOKgUsL1AEPO-2F1jqLGA03IzQNq4MlBckGxqkEdgu9HqRVlCmnJ85n6wm-2BzvOUq0BPDZXr3-2BluL3-2BDQeHC-2FJZEnOA97FZtVYoDRbgfFeAz8yxoNTU22tvz2JvclHgGtf89SHnjWf9Y4A7r9zOGlPW5-2BVo7wIOqFAMRi9gye4bfLDSU3bIlpe30QNdbCxMefROgxhIvDYCDpKvM0M1pyQuOf8-2FUv9F2qHTHfddQ0u9GJkv7AlxRLbrzO3CG9v2UgkFfULX-2FtaQHUZePeY1INl-2Ft8YWAmD34DRvO7PgOFYUtOHqQc142SVia-2B-2FfcNe-2B-2B1zBlTQ9BN7px54JgZqdkTrLJ8R7Gq78HB-2BrMaRq6RIPVU5xXMCh0hZyKktj6WmBkGu7BBJluAUqE6teQaLicI5acYsjVgsULcigN16VLspLLTfrEjIYuLuQyBjbdTUwkD51X0Waw5zxTpt24hpfPUx5A-2BA-2By5-2BZ9ocOnRbMF7M9MxOy-2Brhoe3cZnH2UdsDnEx5xGprXRBR3ASOpwYm7R9WwhkNlGOXWldZzrIKdhsYYbAbbYOOHH9WeqrWWoAhcKT4soJLl-2F91D78WyflRx6ltvfE0uzNnG7n2zMVOjZWqybChHvbVX2QPCYYbqvz8LfnR745-2BmZg1D4XRCJJ5710Tt-2BtEfNlyxu9OGFgsIZkJt7TvcesWWbtV-2Fs1WKWvJNdRvMj8hMSbwcRp-2BM69Fhor49ffRX3uqERmvbv-2Fw8RjCqwi5t0C7OT0lC6THc9pCVUXIPeNjVJkt7ARDRpbrMjcf0rfyMg-3D-3D	Get hash	malicious	Unknown	Browse	52.222.232.99
	http://nvadvancedpain.org/	Get hash	malicious	HTMLPhisher	Browse	3.136.232.26
	quote894590895pdf.exe	Get hash	malicious	FormBook	Browse	75.2.103.23
	SETTLEMENT-2023-165092-SP-21.html	Get hash	malicious	Unknown	Browse	54.77.0.81
	http://url5730.bkb-tours.com/ls/click?upn=u001.RGHmK1hbhRj1emqWdiNhLSLfhiHa5Xgj2PgdNFABoTzAEieA-2BAi72IlbwekEjzmy-2Bbvyjc6OaRM0j3Y4D96jZw-3D-3Dl_HJ_IaEOxqgZXlhF-2FWeAthks65A7pC1uGLQoAycHsX43qhoY-2F2AfxoNRV5ePdcjR3Gmg3WGISjAQum9P1-2BACjbElY8P-2BeONKCdI2tniCQVsSVCD-2FsxwCAZ-2BQpOtFFL-2FQRhupVHsOvETyg5eKwS2piuqrqBYS71eHVVSueSBFxE1p9DMjbfAk7jH2aVa8b7PXtZRLu-2F9H7mPlyE1h5QrMK3-2BeYw3ElgCtyzumNXeUQn5iTSgDnH8glp8UH-2B3qyZlDpkszcgav-2Bg91yHAam8NfBR-2FyHHiv6QFOu9Jf5KPsoq-2BvHwM83R2h6zfPuiZCwiBV0x6xGa7QYuUJMXLQtymSaQ9jymf0FXVzo6qCk6-2BR4t2uIKIAiS5u0UF5DyZwT-2FZm6FlaC36a-2FQxXEsmDD8tl5XKFrCNeBuJ9d8HzMYjiAuOiNvju638VdmHFwT5QF4N-2FRbMw1xJ4EatDOFuMlfE1D5F2fExgfdT20s1XlM7n6AVpUmLSDaBXI08KtIAKs4nnVpzbWgYVc5HwgnwLJ-2FnDuveTaRIZcaIXPyYlWuc20qaTwUCV1ad5w3IrcqQQQj36ILX27j9UEWSWjuvKNiG9X9yLS7ZlHBN5E5pBrNn6TRIGLKk-2BDpHVK-2B2itIT6IJ4vcsCPz1imvAM2kGFFVJ0xZZ0Tu5-2BnR2Ywu3a8QDcNLD1QJ6a-2BCrhdN3PaffwSiy9JNSjYSCgPvyFq9fdumL1XMcqf3faT80lxPygL1SYQDRNefwuSx8XcYAJhMd8rw6fZxhd3aJKSQZsrrlDkRKfFcSj569IaIMbg1QNvOKSPwcfFwg8LloZ49bGdLmaLDshtAIO3g1ppfgu1pz6O7yOy7-2F-2FUiy7zLw7H-2BUsXvAxc9I3-2BUUw-3D	Get hash	malicious	HTMLPhisher	Browse	3.160.156.17
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	18.245.86.69

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.172540812702139
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	apache2.elf
File size:	210'270 bytes
MD5:	d0cbd0c0874e87321c4470fe47509a66
SHA1:	a9cdec41b05c0d6336e1e870eea281355401b866
SHA256:	55cefdd21b1b72a98650d83384d4ca33e8ba676460c70178242cd41754813b3c
SHA512:	a3d6136f3aaa8eed383a36245791ede2d9c948f3fc75d9f7d2581979ff051fafd3637977bbbd36dc46aa94206aec3219611502488f37a28e1d2b246a8ddbf921
SSDEEP:	6144:3MYzMaiiwXBAratE+r5hZR6e6xV7jwom0wfB5RyAn:3MYzMaiiwXBAoL5hZOzXm0mB5RyAn
TLSH:	32245C24E5404B57C2E323F9B68E824E3B3347E563D7330A5A345BB43FC2B9A1D66925
File Content Preview:	.ELF..............(.........4...........4. ...(........p.6.......... ... ............................7...7...............7...7...7......,u...............8...8...8..................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	173224
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1b7bc	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x238ac	0x1b8ac	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x238c0	0x1b8c0	0x7e04	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2b6c4	0x236c4	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x2b6dc	0x236dc	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x337fc	0x237fc	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x33800	0x23800	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x33800	0x23800	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x33804	0x23804	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x33808	0x23808	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x3380c	0x2380c	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x338bc	0x238bc	0x310	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x33bd0	0x23bcc	0x7158	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x23bcc	0xc52	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x24820	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x24960	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x24b73	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x26bb6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x27298	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x28110	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x283c8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x28c92	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x29e21	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2a379	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2a38f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2a930	0x5d00	0x10	0x0		28	843	4
.strtab	STRTAB	0x0	0x30630	0x2f2e	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x236dc	0x2b6dc	0x2b6dc	0x120	0x120	4.4932	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x237fc	0x237fc	6.3509	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x237fc	0x337fc	0x337fc	0x3d0	0x752c	4.4041	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x23800	0x33800	0x33800	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x238ac	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x238c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x2b6c4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x2b6dc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x337fc	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x33800	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x33800	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x33804	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x33808	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x3380c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x338bc	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x33bd0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x238ac	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x238b8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x855c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x88ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x96bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xacd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb34c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb48c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb5dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe97c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1010c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ebc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ffc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1502c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1679c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1805c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1889c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1900c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1905c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1996c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ada0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1add8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d57c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ece0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f13c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f5f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f62c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x210d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2119c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x213b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x214a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x215b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x215e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x217fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x221cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2230c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2243c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x228a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2300c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2301c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x230d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2311c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23878	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33804	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33800	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x338c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x338c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8558	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x88d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x91f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x96b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26210	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xaa84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xacd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb73c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcef8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd728	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe0d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1039c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10950	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1408c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x14b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29fbc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x339c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a2bc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1511c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1524c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a5e4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x15cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2a5ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a670	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x168e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ba0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16eb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17974	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17e1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x339ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1825c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33a04	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x33a9c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b1dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x187c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1887c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33ab0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x189c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1951c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1969c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33ac8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1a348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1abb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1add4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b070	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b284	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b204	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b5b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33ad8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x33ad4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c29c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b2e8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d1b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dcc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dda8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e48c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ecac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bbc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1edbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f31c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f5ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1faa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fe8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bc0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x207f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2084c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20c68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bc2	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2b3a4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x20d30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x210c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x211d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x212b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x212f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21360	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x215dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x217ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x33bc4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2b3c4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2264c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22ff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.108.5669	.symtab	0x26210	48	OBJECT	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x2b24c	12	OBJECT	<unknown>	DEFAULT	4
C.141.5976	.symtab	0x26684	24	OBJECT	<unknown>	DEFAULT	4
C.196.6576	.symtab	0x26ce0	12	OBJECT	<unknown>	DEFAULT	4
C.197.6577	.symtab	0x26c70	92	OBJECT	<unknown>	DEFAULT	4
C.199.6682	.symtab	0x276a8	1144	OBJECT	<unknown>	DEFAULT	4
C.202.6719	.symtab	0x2926c	24	OBJECT	<unknown>	DEFAULT	4
C.205.6750	.symtab	0x2948c	24	OBJECT	<unknown>	DEFAULT	4
C.216.6888	.symtab	0x296e4	1128	OBJECT	<unknown>	DEFAULT	4
C.257.7184	.symtab	0x29c50	96	OBJECT	<unknown>	DEFAULT	4
C.261.7232	.symtab	0x29de4	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x2b284	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x2b258	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x2a5bc	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x2b2c0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x2b29c	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x2b2b4	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x2b2a8	12	OBJECT	<unknown>	DEFAULT	4
DNSw	.symtab	0x1010c	664	FUNC	<unknown>	DEFAULT	2
HIPER_OVH	.symtab	0xe4e0	468	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x16488	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x164a4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x33c08	16384	OBJECT	<unknown>	DEFAULT	14
Randhex	.symtab	0xf0fc	472	FUNC	<unknown>	DEFAULT	2
SendCloudflare	.symtab	0xcd74	400	FUNC	<unknown>	DEFAULT	2
SendDOMINATE	.symtab	0xf424	1636	FUNC	<unknown>	DEFAULT	2
SendHOME1	.symtab	0xe6b4	356	FUNC	<unknown>	DEFAULT	2
SendHOME2	.symtab	0xe818	356	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xcf04	400	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0xc9dc	460	FUNC	<unknown>	DEFAULT	2
SendOVH_STORM	.symtab	0xd75c	3460	FUNC	<unknown>	DEFAULT	2
SendSTD	.symtab	0xb34c	320	FUNC	<unknown>	DEFAULT	2
SendSTDHEX	.symtab	0xa91c	364	FUNC	<unknown>	DEFAULT	2
SendSTD_HEX	.symtab	0xb5dc	356	FUNC	<unknown>	DEFAULT	2
SendUDP	.symtab	0x9e00	1116	FUNC	<unknown>	DEFAULT	2
UDPRAW	.symtab	0xee5c	336	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x14c98	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x3380c	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x22400	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x22404	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x230b4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x223f8	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x2243c	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x230d8	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x23878	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x22430	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x23048	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x2306c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x23090	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x22360	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x22978	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x223ac	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x339c0	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x29fbc	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x33bc4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x2b3c4	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x339c8	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x2a2bc	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x337fc	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x337fc	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x339c0	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x33bc4	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x339c8	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x19930	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x19914	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x339c4	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x33bc8	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x339cc	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x15100	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x14b0c	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1679c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x19930	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14ba4	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x199c0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x19ae0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x19a50	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x199c0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x199a4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x19ae0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x19ac4	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x19524	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x16fa0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x16fc4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x16f7c	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x19cf8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x19dc8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x19a50	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x19a34	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x167b4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14c98	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x17e78	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x185c4	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1ed70	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x14d40	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x19930	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1add8	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1b540	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1b574	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1b218	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x16af0	116	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1aad0	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x187d8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1b6f0	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14ba4	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1d1d0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1ccc0	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1ce04	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1d6a8	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1ba20	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1905c	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x16278	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1f13c	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1f160	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1edd4	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x162b0	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x14d78	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1ab10	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1ab24	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1ab38	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x16a20	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x16a3c	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1e1cc	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x20d94	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x21118	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1ab4c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x196ac	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14da4	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x16b64	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1ab74	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1abb4	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0x16900	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x168f0	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x169f8	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e0d4	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x169dc	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x16950	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1fc04	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1f88c	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x183e0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x14ddc	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1e034	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0x150a8	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14ebc	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x212f4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1dbe0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x16390	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x21370	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1f62c	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1dcd0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x163a0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1a930	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1ee38	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1abc8	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1ac48	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x16930	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x16920	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x199c0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1afb8	196	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x211dc	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x196f4	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x17fb8	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x18278	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1f650	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x19ae0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1b12c	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x16c34	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1aca8	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14f38	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x16ce8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x16da4	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x14fbc	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x16e2c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x184d8	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1a9d8	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x16eb8	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1ad14	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x197e4	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x15120	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x16e74	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x15150	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x18308	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x21250	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x217fc	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x164c0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1ddb0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x16440	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x16440	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x165b0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1de9c	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x21380	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x16460	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1f700	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x165d4	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1dff4	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1dee0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1df30	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x166a0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x168c0	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1df7c	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x185e4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x189e8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1e058	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x14ffc	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x150d0	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x212b4	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x15184	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1ada0	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1502c	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1b5bc	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1b634	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1b610	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x19a50	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x33808	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x33808	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x230b4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x23048	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x2306c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x23090	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x21920	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x2227c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x2227c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x22260	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x2230c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x21920	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x22294	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x222dc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x222f4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x222c4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x222ac	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x21fc0	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x21d30	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x21914	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x2191c	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x21c7c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x21c54	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x149b4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x14ae0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x21cd0	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x1aa80	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x21c30	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x148a0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x1499c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x21cbc	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x23014	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x2300c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x23004	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x38350	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x33ab0	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x3ad28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x33bcc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x33bcc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x19d74	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x19930	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x20cb0	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x19914	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x221dc	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x339c4	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x33bc8	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x339cc	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x3a8e4	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x338bc	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1fea0	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x214a0	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x1aa78	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1aa6c	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x14af8	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x21fc0	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x149b4	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1ff98	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x33804	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x338bc	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x21868	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x213b4	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x21554	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x3ad28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x38348	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x221dc	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x15100	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x2b7fc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x2b6dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x37df8	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x21c7c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x14b0c	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d57c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x33808	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x33804	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x2230c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x21cd0	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x21c54	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x21cbc	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x21c30	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x1905c	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x3ace0	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x3ace4	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x37dfc	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x33800	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x221cc	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x20d48	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1eff4	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1ab4c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x196ac	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1679c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x227b8	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x228a0	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x23038	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x22834	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x22958	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x23040	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x2311c	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x23830	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x22abc	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x221cc	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x33804	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x33800	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x221d4	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x19930	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x16af0	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x19b50	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x19bd8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x14ba4	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1905c	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x3ace8	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1ac48	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x199c0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x19ae0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x16c34	112	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x14f38	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x16ce8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x16da4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1eaa4	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1a9d8	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x38344	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x1a8ac	132	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1502c	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x19a50	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x194c0	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x19428	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x2b3a4	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x221d4	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x17a48	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x16fe8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x339d4	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x3a968	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x17998	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x21d30	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x3ad1c	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x3ad20	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x221dc	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x199c0	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x215b4	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x20854	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x199a4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x3834c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x33800	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x33800	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x33acc	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x33ad0	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1ecd4	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x19cbc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x19cb4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x19ae0	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x215e4	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x19ac4	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x19524	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x3ad14	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x33bc3	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x3a8ec	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x33bc2	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x2301c	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x38354	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x3ad18	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x3ad24	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x16fa0	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x16fc4	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x16f7c	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x210d8	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1edc8	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x33ae4	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1f320	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1f378	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1f454	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1bea0	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1f51c	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1f5f0	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1f54c	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1c1c4	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1c2a0	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x33ae8	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x2191c	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x16aac	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x16bf0	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x16ca4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x16d58	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1a9ac	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1ac08	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x2119c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1aa90	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x14ef4	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1ea80	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x19cf8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x19dc8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x19e20	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x33ac8	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x148a0	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x19a50	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x19a34	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x167b4	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1ef48	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1ee7c	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x37c08	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x3ad28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x15254	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x3a910	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x3a938	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x339d0	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1ece0	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x33bbc	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x1ed18	88	FUNC	<unknown>	HIDDEN	2

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T20:34:49.820439+0200	2846526	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	37942	160.22.160.59	4444	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 20:34:49.813802004 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:34:49.818887949 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:34:49.818945885 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:34:49.820439100 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:34:49.825323105 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:34:53.823051929 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:34:53.823362112 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:34:54.124267101 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:34:54.124453068 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:34:59.677869081 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:34:59.677915096 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:34:59.678181887 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:34:59.678242922 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:34:59.678308964 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:34:59.678395987 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:34:59.679615974 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:34:59.684503078 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:35:00.259030104 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:35:00.259196997 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:35:00.259651899 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:35:00.264847040 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:35:00.544251919 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:35:00.544615984 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:35:00.547025919 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:35:00.552316904 CEST	443	58866	54.171.230.55	192.168.2.13
Oct 11, 2024 20:35:00.552386999 CEST	58866	443	192.168.2.13	54.171.230.55
Oct 11, 2024 20:35:53.827522039 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:35:53.827847004 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:35:54.141505003 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:35:54.141659975 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:36:53.993655920 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:36:53.993947983 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:36:54.142132044 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:36:54.142246008 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:37:53.830831051 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:37:53.830979109 CEST	37942	4444	192.168.2.13	160.22.160.59
Oct 11, 2024 20:37:54.143474102 CEST	4444	37942	160.22.160.59	192.168.2.13
Oct 11, 2024 20:37:54.143594027 CEST	37942	4444	192.168.2.13	160.22.160.59

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 20:37:33.598988056 CEST	45358	53	192.168.2.13	1.1.1.1
Oct 11, 2024 20:37:33.599092007 CEST	40407	53	192.168.2.13	1.1.1.1
Oct 11, 2024 20:37:33.606952906 CEST	53	40407	1.1.1.1	192.168.2.13
Oct 11, 2024 20:37:33.607178926 CEST	53	45358	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 20:37:33.598988056 CEST	192.168.2.13	1.1.1.1	0xce99	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 11, 2024 20:37:33.599092007 CEST	192.168.2.13	1.1.1.1	0x2154	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 20:37:33.607178926 CEST	1.1.1.1	192.168.2.13	0xce99	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 11, 2024 20:37:33.607178926 CEST	1.1.1.1	192.168.2.13	0xce99	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 11, 2024 20:34:59.678181887 CEST	54.171.230.55	443	192.168.2.13	58866	CN=motd.ubuntu.com CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Tue Aug 06 10:27:48 CEST 2024 Wed Mar 13 01:00:00 CET 2024	Mon Nov 04 09:27:47 CET 2024 Sat Mar 13 00:59:59 CET 2027
Oct 11, 2024 20:34:59.678181887 CEST	54.171.230.55	443	192.168.2.13	58866	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027

System Behavior

Analysis Process: apache2.elf PID: 5419, Parent PID: 5344

General

Start time (UTC):	18:34:48
Start date (UTC):	11/10/2024
Path:	/tmp/apache2.elf
Arguments:	/tmp/apache2.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: apache2.elf PID: 5421, Parent PID: 5419

General

Start time (UTC):	18:34:48
Start date (UTC):	11/10/2024
Path:	/tmp/apache2.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: apache2.elf PID: 5423, Parent PID: 5421

General

Start time (UTC):	18:34:48
Start date (UTC):	11/10/2024
Path:	/tmp/apache2.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: dash PID: 5439, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5439, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.uv6gGIxdpW /tmp/tmp.NiZdTYIHEX /tmp/tmp.cngHL3w9F2
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 5440, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5440, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.uv6gGIxdpW
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 5441, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 5441, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 5442, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 5442, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 5443, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 5443, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 5444, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5444, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.uv6gGIxdpW
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 5445, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 5445, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 5446, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 5446, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 5447, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 5447, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 5448, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 5448, Parent PID: 3590

General

Start time (UTC):	18:34:59
Start date (UTC):	11/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.uv6gGIxdpW /tmp/tmp.NiZdTYIHEX /tmp/tmp.cngHL3w9F2
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report apache2.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Connections

System Behavior

Analysis Process: apache2.elf PID: 5419, Parent PID: 5344

General

Chronological Activities

Analysis Process: apache2.elf PID: 5421, Parent PID: 5419

General

Chronological Activities

Analysis Process: apache2.elf PID: 5423, Parent PID: 5421

General

Chronological Activities

Analysis Process: dash PID: 5439, Parent PID: 3590

Linux Analysis Report
apache2.elf