Edit tour

Linux Analysis Report
co.elf

Overview

General Information

Sample name:	co.elf
Analysis ID:	1538179
MD5:	947ea7d39dcdd027dabe76be466b3bc7
SHA1:	f172922e091cbf414b331f29822555aab4b618c6
SHA256:	fc713863c1d2e19127c6135c4ee49aadf3130c3f9bc0c935d056ef7f3926635b
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538179
Start date and time:	2024-10-20 18:36:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	co.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/0@2/0

Warnings

VT rate limit hit for: co.elf

Runtime Messages

Command:	/tmp/co.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

co.elf (PID: 5433, Parent: 5359, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/co.elf

co.elf New Fork (PID: 5435, Parent: 5433)

co.elf New Fork (PID: 5437, Parent: 5435)

co.elf New Fork (PID: 5439, Parent: 5437)

co.elf New Fork (PID: 5448, Parent: 5439)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
co.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
co.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5433.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5435.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5448.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5437.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: co.elf PID: 5433	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: co.elf PID: 5435	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: co.elf PID: 5448	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:36:48.092788+0200	2847206	1	A Network Trojan was detected	192.168.2.13	37032	212.224.93.228	666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: co.elf

Avira: detected

Found malware configuration

Source: co.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "212.224.93.228:666"}

Multi AV Scanner detection for submitted file

Source: co.elf

ReversingLabs: Detection: 71%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2847206 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.13:37032 -> 212.224.93.228:666

Source: global traffic

TCP traffic: 192.168.2.13:37032 -> 212.224.93.228:666

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 212.224.93.228
Source: unknown	TCP traffic detected without corresponding DNS query: 212.224.93.228
Source: unknown	TCP traffic detected without corresponding DNS query: 212.224.93.228
Source: unknown	TCP traffic detected without corresponding DNS query: 212.224.93.228
Source: unknown	TCP traffic detected without corresponding DNS query: 212.224.93.228
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: classification engine

Classification label: mal88.troj.linELF@0/0@2/0

Source: co.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: co.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: co.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: co.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: co.elf	ELF static info symbol of initial sample: /home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/_memcpy.S
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/bcopy.S
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/memcpy.S
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/memmove.S
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/memset.S
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/strcmp.S
Source: co.elf	ELF static info symbol of initial sample: libc/string/arm/strlen.S
Source: co.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crt1.S
Source: co.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crti.S
Source: co.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/crtn.S
Source: co.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/sigrestorer.S
Source: co.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/arm/vfork.S

Source: /tmp/co.elf (PID: 5433)

Queries kernel information via 'uname':

Jump to behavior

Source: co.elf, 5433.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp, co.elf, 5435.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp, co.elf, 5437.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp, co.elf, 5448.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: co.elf, 5433.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp, co.elf, 5435.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp, co.elf, 5437.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp, co.elf, 5448.1.000055fb7e5fd000.000055fb7e72b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: co.elf, 5433.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp, co.elf, 5435.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp, co.elf, 5437.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp, co.elf, 5448.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: co.elf, 5433.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp, co.elf, 5435.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp, co.elf, 5437.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp, co.elf, 5448.1.00007fff09eb4000.00007fff09ed5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/co.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/co.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: co.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: co.elf, type: SAMPLE
Source: Yara match	File source: 5433.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: co.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: co.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: co.elf PID: 5448, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.86 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Safari/604.1.38
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; CrOS x86_64 9592.96.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.114 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; Lumia 535) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Mobile Safari/537.36 Edge/14.14393
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.4; HTC Desire 620 Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Mobile/14D27
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: co.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: co.elf, type: SAMPLE
Source: Yara match	File source: 5433.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5437.1.00007f78cc017000.00007f78cc02c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: co.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: co.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: co.elf PID: 5448, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "212.224.93.228:666"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
co.elf	71%	ReversingLabs	Linux.Trojan.Gafgyt
co.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
212.224.93.228:666	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.224.93.228	unknown	Germany		44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
212.224.93.228	ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
212.224.93.228	dc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
185.125.190.26	bin.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x.rar.elf	Get hash	malicious	Xmrig	Browse
	Demon.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	main_m68k.elf	Get hash	malicious	Mirai	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	tftp.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	bin.armv6l.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	t50.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	__min__.elf	Get hash	malicious	Xmrig	Browse	162.213.35.25
	bin.sh.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DE-FIRSTCOLOwwwfirst-colonetDE	ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.224.93.228
	dc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.224.93.228
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	31.172.83.15
CANONICAL-ASGB	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	bin.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	bin.armv5l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	x.rar.elf	Get hash	malicious	Xmrig	Browse	185.125.190.26
	x.rar.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, with debug_info, not stripped
Entropy (8bit):	5.940299694088176
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	co.elf
File size:	120'177 bytes
MD5:	947ea7d39dcdd027dabe76be466b3bc7
SHA1:	f172922e091cbf414b331f29822555aab4b618c6
SHA256:	fc713863c1d2e19127c6135c4ee49aadf3130c3f9bc0c935d056ef7f3926635b
SHA512:	682f44d639f0e4054918b5ca7804431d524103ccf3143d356221da0febf53c80a0f1b5b653140e241b54812e811096789ff2a43f197eb0bb91402ef595df57b2
SSDEEP:	3072:hQrFRNfuLrGhEPOD0Sg3gNlmBoHQuQekQnYW:IFzuaEGQSg3CmBoHQuQekQnYW
TLSH:	76C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120
File Content Preview:	.ELF...a..........(.........4....g......4. ...(......................L...L...............P...P...P.......g..........Q.td..................................-...L."....E..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	92104
Section Header Size:	40
Number of Section Headers:	20
Header String Table Index:	17

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80b0	0xb0	0x11474	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19524	0x11524	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19538	0x11538	0x3744	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x1cc7c	0x14c7c	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x25000	0x15000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x25008	0x15008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x25010	0x15010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x25014	0x15014	0x408	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2541c	0x1541c	0x636c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1541c	0xb68	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x15f88	0xa0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x16028	0x30c	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x16334	0x64	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x16398	0x2e7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x16680	0xa0	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x16720	0xa8	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x16ae8	0x4620	0x10	0x0		19	640	4
.strtab	STRTAB	0x0	0x1b108	0x2469	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x14c80	0x14c80	6.0728	0x5	R E	0x8000	.init .text .fini .rodata .eh_frame
LOAD	0x15000	0x25000	0x25000	0x41c	0x6788	3.0387	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19524	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19538	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1cc7c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x25000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x25008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x25010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x25014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2541c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
$a	.symtab	0x8094	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19524	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19530	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x194e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1951c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x80a4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x80a8	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19534	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x8190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbdb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1338c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1346c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1366c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1368c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1490c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1521c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1550c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1746c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1914c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25000	0	NOTYPE	<unknown>	DEFAULT	6
$d	.symtab	0x25008	0	NOTYPE	<unknown>	DEFAULT	7
$d	.symtab	0x2501c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8174	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25020	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25024	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19564	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x95f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9bc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb58c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbda4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd234	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf66c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1085c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x250b8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x250c0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x11f00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x250c8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1bc24	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12800	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25204	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x140d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2530c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x1445c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25324	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x146d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c850	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253d8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x14bc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253f0	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x151f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2b68c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x153dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c898	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x165f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1689c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x253f8	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x173fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1743c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25410	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x19024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190a0	0	NOTYPE	<unknown>	DEFAULT	2
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/firmware/build/temp-armv5l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.100.4599	.symtab	0x19bfc	144	OBJECT	<unknown>	DEFAULT	4
C.104.4641	.symtab	0x19c8c	144	OBJECT	<unknown>	DEFAULT	4
C.108.4683	.symtab	0x19d1c	144	OBJECT	<unknown>	DEFAULT	4
C.112.4725	.symtab	0x19dac	144	OBJECT	<unknown>	DEFAULT	4
C.116.4767	.symtab	0x19e3c	144	OBJECT	<unknown>	DEFAULT	4
C.120.4809	.symtab	0x19ecc	144	OBJECT	<unknown>	DEFAULT	4
C.124.4850	.symtab	0x1a09c	8	OBJECT	<unknown>	DEFAULT	4
C.128.4885	.symtab	0x1a0a4	8	OBJECT	<unknown>	DEFAULT	4
C.132.4920	.symtab	0x1a0ac	8	OBJECT	<unknown>	DEFAULT	4
C.136.4955	.symtab	0x1a0b4	8	OBJECT	<unknown>	DEFAULT	4
C.140.4990	.symtab	0x1a0bc	8	OBJECT	<unknown>	DEFAULT	4
C.142.5019	.symtab	0x1ae80	12	OBJECT	<unknown>	DEFAULT	4
C.143.5020	.symtab	0x1ae60	12	OBJECT	<unknown>	DEFAULT	4
C.96.4557	.symtab	0x19b6c	144	OBJECT	<unknown>	DEFAULT	4
GetRandomIP	.symtab	0x9d64	96	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x13178	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x13194	0	NOTYPE	<unknown>	DEFAULT	2
OreoServer	.symtab	0x25024	4	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x25454	16384	OBJECT	<unknown>	DEFAULT	10
RandString	.symtab	0x9858	136	FUNC	<unknown>	DEFAULT	2
Send100UP	.symtab	0xb424	364	FUNC	<unknown>	DEFAULT	2
SendNUKE	.symtab	0xb6fc	364	FUNC	<unknown>	DEFAULT	2
SendOVH	.symtab	0xb14c	364	FUNC	<unknown>	DEFAULT	2
SendPAKI	.symtab	0xb590	364	FUNC	<unknown>	DEFAULT	2
SendZAP	.symtab	0xb2b8	364	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x25004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x25000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x250b8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1b624	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x25410	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1c97c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x250c0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1b924	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x2500c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x25008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1cc7c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1cc7c	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x250b8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x1b624	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x25410	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x1c97c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x250c0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x1b924	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x250bc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x25414	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x250c4	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x11a14	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x142ac	328	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x148f8	12	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17404	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x11a3c	44	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x11a68	44	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x13bd0	44	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x11a94	44	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x2b68c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x14b38	148	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x15248	44	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x14aa4	148	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1746c	384	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x11950	116	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17cfc	484	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17b28	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17ee0	152	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x175ec	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x11ac0	44	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x175f8	12	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17604	304	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15274	44	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x152a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x152cc	44	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x11b14	44	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x152f8	44	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x2b690	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x167b4	236	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x185b8	608	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x18244	528	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x14830	200	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1366c	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x11bbc	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x18e60	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16500	252	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x13080	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x164f0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x165fc	24	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16614	236	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x13090	156	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x11be8	92	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x11c54	44	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x17440	44	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x173c8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x143f8	124	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x146d4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x17f78	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x11cb0	44	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x13c58	44	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x15350	88	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x11cdc	48	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x13c84	44	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	HIDDEN	2
__GI_seteuid	.symtab	0x11d0c	104	FUNC	<unknown>	HIDDEN	2
__GI_setresuid	.symtab	0x11d74	44	FUNC	<unknown>	HIDDEN	2
__GI_setreuid	.symtab	0x11da0	44	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x13ce4	48	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x14614	192	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x15114	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x13d40	48	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x13d70	24	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x11df8	84	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14bcc	420	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x13d14	44	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x11f04	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x14764	204	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19028	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x131b0	264	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x13130	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x132b8	28	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x18148	48	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x13150	96	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x18030	200	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x132d4	184	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1338c	224	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x16774	64	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x180f8	80	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1346c	248	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x13660	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16700	116	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x14904	8	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1368c	108	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x11e4c	44	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x18ec4	52	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x11ec4	52	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x11f38	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x153a8	44	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x153e0	80	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15450	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15430	32	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x11e80	44	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x25010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x25010	0	OBJECT	<unknown>	DEFAULT	8
__aeabi_idiv	.symtab	0x193a8	0	FUNC	<unknown>	DEFAULT	2
__aeabi_idiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_idivmod	.symtab	0x194d0	24	FUNC	<unknown>	DEFAULT	2
__aeabi_ldiv0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x11600	0	FUNC	<unknown>	DEFAULT	2
__aeabi_uidivmod	.symtab	0x116f8	24	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x2b680	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x253d8	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	HIDDEN	2
__bss_end__	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2541c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2541c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14e34	56	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x250bc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x25414	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x250c4	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x2b6b0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x25014	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x18a28	220	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x1914c	204	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x18900	184	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x15218	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x15214	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x118c0	4	FUNC	<unknown>	DEFAULT	2
__divsi3	.symtab	0x193a8	296	FUNC	<unknown>	DEFAULT	2
__dns_lookup	.symtab	0x168a0	2060	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x194e8	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x25018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x190a4	168	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x18818	232	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x189b8	92	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2b678	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x11ef8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
__exit_cleanup	.symtab	0x2b670	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x17380	72	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x13564	20	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x153d4	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x140f0	148	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x141b8	244	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x14184	32	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x141a4	20	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x19218	76	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x18a14	20	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x18e60	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x17440	44	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x11cb0	44	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x13c58	44	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x11cdc	48	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x13c84	44	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x13cb0	52	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x15114	228	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2b674	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x11e78	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x11e80	44	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x25204	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x2b654	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x2b744	24	OBJECT	<unknown>	DEFAULT	10
__modsi3	.symtab	0x117dc	228	FUNC	<unknown>	DEFAULT	2
__muldi3	.symtab	0x118c4	80	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x2b76c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x2b778	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x18b04	52	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x170ac	724	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x2b67c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x25000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14e28	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x173c8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x18b38	808	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x253f8	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x2b684	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x2b75c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x2b77c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x13e64	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x13e88	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x13e40	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x250d4	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x19264	92	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1550c	188	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17734	204	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x155c8	312	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x12058	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3929	.symtab	0x1bc24	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x192c0	44	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17af8	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x192ec	188	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15700	260	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x12120	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x250d8	4	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x151f8	28	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1521c	44	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x14dbc	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e6c	92	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14ec8	588	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x253f0	4	OBJECT	<unknown>	HIDDEN	9
__udivsi3	.symtab	0x11600	248	FUNC	<unknown>	DEFAULT	2
__umodsi3	.symtab	0x11710	204	FUNC	<unknown>	DEFAULT	2
__vfork	.symtab	0x11920	40	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x13578	232	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_end__	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x12150	76	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x173e0	36	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x2b780	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x2b784	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x2541c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2b788	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x2b68c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x11a14	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19524	4	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x29460	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1219c	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x159f8	1640	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x2b690	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x8094	4	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15804	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16060	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x12814	152	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x12acc	1220	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x128ac	56	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x128e4	412	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x12a80	76	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14e30	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x2b6c4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x8190	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x17800	760	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x11fe8	112	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x250dc	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x250e0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x17bbc	320	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x2945c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x250f8	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x29458	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x25114	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x12068	184	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x25110	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1490c	408	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15874	52	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1bcf4	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x158a8	336	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x12220	1524	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x142ac	328	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x148f8	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x13070	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x2b66c	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2789	.symtab	0x2b688	4	OBJECT	<unknown>	DEFAULT	10
bot.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17404	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x13d88	184	FUNC	<unknown>	DEFAULT	2
buf.2613	.symtab	0x2b464	16	OBJECT	<unknown>	DEFAULT	10
buf.4901	.symtab	0x2b474	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x25030	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x1951c	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x8128	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8188	0	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0x11a3c	44	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_tcp_udp	.symtab	0x9f1c	448	FUNC	<unknown>	DEFAULT	2
close	.symtab	0x11a68	44	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2555	.symtab	0x2541c	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x13bd0	44	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x92f8	636	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x11c44	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x9dc4	344	FUNC	<unknown>	DEFAULT	2
currentServer	.symtab	0x25028	4	OBJECT	<unknown>	DEFAULT	9
data_start	.symtab	0x25020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x11a94	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2b678	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x2b68c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x14b38	148	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x15248	44	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x14aa4	148	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1c898	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x1746c	384	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x11950	116	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x119c4	80	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x9228	208	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x29454	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x90a4	388	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x8e1c	648	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x17cfc	484	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17b28	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x17ee0	152	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1c884	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x175ec	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
force_to_data	.symtab	0x25014	0	OBJECT	<unknown>	DEFAULT	9
force_to_data	.symtab	0x25418	0	OBJECT	<unknown>	DEFAULT	9
fork	.symtab	0x11ac0	44	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x12f90	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8130	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x14000	240	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x175f8	12	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x175f8	12	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x17604	304	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x12fc4	172	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getHost	.symtab	0x979c	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x109f4	740	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x18ef8	304	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x11aec	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15274	44	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x152a0	44	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x152cc	44	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x13818	68	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1385c	884	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x11b14	44	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x11b40	44	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x13bfc	44	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x13c28	48	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x152f8	44	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gotIP	.symtab	0x25440	4	OBJECT	<unknown>	DEFAULT	10
h.4900	.symtab	0x2b640	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x2b690	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x19564	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x13730	36	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x13754	20	FUNC	<unknown>	DEFAULT	2
i.3637	.symtab	0x25034	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x131b0	264	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x137f4	36	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x167b4	236	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x137e8	12	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x13768	128	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x185b8	608	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x18454	356	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x18244	528	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x18178	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x10868	396	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x81cc	212	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x25208	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x14500	152	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x14830	200	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x11b6c	80	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ioctl_keepalive	.symtab	0xe538	304	FUNC	<unknown>	DEFAULT	2
ioctl_pid	.symtab	0x25438	4	OBJECT	<unknown>	DEFAULT	10
isatty	.symtab	0x1366c	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isspace	.symtab	0x11eac	24	FUNC	<unknown>	DEFAULT	2
isspace.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x11bbc	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/_memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/bcopy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memmove.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/arm/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/sigrestorer.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/arm/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x9bcc	408	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x18e60	100	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x2544c	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x10cd8	2344	FUNC	<unknown>	DEFAULT	2
mainCommSock	.symtab	0x2543c	4	OBJECT	<unknown>	DEFAULT	10
makeIPPacket	.symtab	0xa1ec	276	FUNC	<unknown>	DEFAULT	2
makeVSEPacket	.symtab	0xa300	312	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x13eac	340	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x16500	252	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x13080	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x164f0	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x165fc	24	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x16614	236	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x13090	156	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x2530c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x25324	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x2b694	24	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x15324	44	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1066	.symtab	0x2b460	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x136f8	36	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1371c	20	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x25444	8	OBJECT	<unknown>	DEFAULT	10
object.2636	.symtab	0x25420	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x11be8	92	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x2b6b4	4	OBJECT	<unknown>	DEFAULT	10
ourPublicIP	.symtab	0x2b6b8	4	OBJECT	<unknown>	DEFAULT	10
ovhl7	.symtab	0xbdb0	3464	FUNC	<unknown>	DEFAULT	2
p.2553	.symtab	0x2501c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x9574	128	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x2b6c0	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x11c54	44	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x17440	44	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x11c80	48	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4141	.symtab	0x1bc4c	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x88e0	1008	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8508	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x86f8	488	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x8574	388	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0xe668	8704	FUNC	<unknown>	DEFAULT	2
qual_chars.4147	.symtab	0x1bc60	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x173c8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x143f4	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x82a0	312	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x143f8	124	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1c850	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x146d4	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x25358	128	OBJECT	<unknown>	DEFAULT	9
rangechoice	.symtab	0x2502c	4	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x17f78	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x11cb0	44	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x13c58	44	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x98e0	748	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x15350	88	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x2b6bc	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0xa438	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x11cdc	48	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x13c84	44	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendFLUX	.symtab	0xd908	1284	FUNC	<unknown>	DEFAULT	2
sendHEX	.symtab	0xbc00	432	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0xb868	920	FUNC	<unknown>	DEFAULT	2
sendLDAP	.symtab	0xa774	420	FUNC	<unknown>	DEFAULT	2
sendNTP	.symtab	0xa918	420	FUNC	<unknown>	DEFAULT	2
sendSNMP	.symtab	0xaabc	420	FUNC	<unknown>	DEFAULT	2
sendSSDP	.symtab	0xae04	420	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0xa5d0	420	FUNC	<unknown>	DEFAULT	2
sendTCP	.symtab	0xd240	1736	FUNC	<unknown>	DEFAULT	2
sendTELNET	.symtab	0xafa8	420	FUNC	<unknown>	DEFAULT	2
sendTFTP	.symtab	0xac60	420	FUNC	<unknown>	DEFAULT	2
sendUDP	.symtab	0xcb38	1800	FUNC	<unknown>	DEFAULT	2
sendVSE	.symtab	0xde0c	1836	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x13cb0	52	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
seteuid	.symtab	0x11d0c	104	FUNC	<unknown>	DEFAULT	2
seteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setresuid	.symtab	0x11d74	44	FUNC	<unknown>	DEFAULT	2
setresuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setreuid	.symtab	0x11da0	44	FUNC	<unknown>	DEFAULT	2
setreuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x13ce4	48	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x14474	140	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x14614	192	FUNC	<unknown>	DEFAULT	2
setuid	.symtab	0x11dcc	44	FUNC	<unknown>	DEFAULT	2
setuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaction	.symtab	0x15114	228	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T18:36:48.092788+0200	2847206	ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin	1	192.168.2.13	37032	212.224.93.228	666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 18:36:48.060420036 CEST	37032	666	192.168.2.13	212.224.93.228
Oct 20, 2024 18:36:48.065318108 CEST	666	37032	212.224.93.228	192.168.2.13
Oct 20, 2024 18:36:48.065396070 CEST	37032	666	192.168.2.13	212.224.93.228
Oct 20, 2024 18:36:48.092787981 CEST	37032	666	192.168.2.13	212.224.93.228
Oct 20, 2024 18:36:48.097814083 CEST	666	37032	212.224.93.228	192.168.2.13
Oct 20, 2024 18:36:49.155625105 CEST	666	37032	212.224.93.228	192.168.2.13
Oct 20, 2024 18:36:49.155893087 CEST	37032	666	192.168.2.13	212.224.93.228
Oct 20, 2024 18:36:49.822747946 CEST	666	37032	212.224.93.228	192.168.2.13
Oct 20, 2024 18:36:49.822963953 CEST	37032	666	192.168.2.13	212.224.93.228
Oct 20, 2024 18:37:00.476727962 CEST	48202	443	192.168.2.13	185.125.190.26
Oct 20, 2024 18:37:30.940650940 CEST	48202	443	192.168.2.13	185.125.190.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 18:39:35.382599115 CEST	50433	53	192.168.2.13	8.8.8.8
Oct 20, 2024 18:39:35.382734060 CEST	35665	53	192.168.2.13	8.8.8.8
Oct 20, 2024 18:39:35.389489889 CEST	53	50433	8.8.8.8	192.168.2.13
Oct 20, 2024 18:39:35.389797926 CEST	53	35665	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 18:39:35.382599115 CEST	192.168.2.13	8.8.8.8	0xc894	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:39:35.382734060 CEST	192.168.2.13	8.8.8.8	0x891b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 18:39:35.389489889 CEST	8.8.8.8	192.168.2.13	0xc894	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Oct 20, 2024 18:39:35.389489889 CEST	8.8.8.8	192.168.2.13	0xc894	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: co.elf PID: 5433, Parent PID: 5359

General

Start time (UTC):	16:36:46
Start date (UTC):	20/10/2024
Path:	/tmp/co.elf
Arguments:	/tmp/co.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: co.elf PID: 5435, Parent PID: 5433

General

Start time (UTC):	16:36:46
Start date (UTC):	20/10/2024
Path:	/tmp/co.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: co.elf PID: 5437, Parent PID: 5435

General

Start time (UTC):	16:36:46
Start date (UTC):	20/10/2024
Path:	/tmp/co.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: co.elf PID: 5439, Parent PID: 5437

General

Start time (UTC):	16:36:46
Start date (UTC):	20/10/2024
Path:	/tmp/co.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: co.elf PID: 5448, Parent PID: 5439

General

Start time (UTC):	16:36:46
Start date (UTC):	20/10/2024
Path:	/tmp/co.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report co.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: co.elf PID: 5433, Parent PID: 5359

General

Chronological Activities

Analysis Process: co.elf PID: 5435, Parent PID: 5433

General

Chronological Activities

Analysis Process: co.elf PID: 5437, Parent PID: 5435

General

Chronological Activities

Analysis Process: co.elf PID: 5439, Parent PID: 5437

General

Chronological Activities

Analysis Process: co.elf PID: 5448, Parent PID: 5439

General

Chronological Activities

Linux Analysis Report
co.elf