Edit tour

Linux Analysis Report
sh4.elf

Overview

General Information

Sample name:	sh4.elf
Analysis ID:	1541253
MD5:	e607d972f00d8bf2043163444a144e20
SHA1:	f48bf81bdecd5cbebd8bc617654c9e398a33202e
SHA256:	c67a5a0e9d5691e2dc3cb8111620c57a32e6daed42bacb3104301522629b271f
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false

Signatures

Executes the "rm" command used to delete files or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541253
Start date and time:	2024-10-24 16:14:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	sh4.elf
Detection:	CLEAN
Classification:	clean1.linELF@0/0@0/0

Warnings

VT rate limit hit for: sh4.elf

Runtime Messages

Command:	/tmp/sh4.elf
PID:	6209
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

sh4.elf (PID: 6209, Parent: 6128, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/sh4.elf

dash New Fork (PID: 6244, Parent: 4331)

rm (PID: 6244, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO

dash New Fork (PID: 6245, Parent: 4331)

cat (PID: 6245, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.3DwdTi16Ey

dash New Fork (PID: 6246, Parent: 4331)

head (PID: 6246, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6247, Parent: 4331)

tr (PID: 6247, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6248, Parent: 4331)

cut (PID: 6248, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6249, Parent: 4331)

cat (PID: 6249, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.3DwdTi16Ey

dash New Fork (PID: 6250, Parent: 4331)

head (PID: 6250, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6251, Parent: 4331)

tr (PID: 6251, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6252, Parent: 4331)

cut (PID: 6252, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6253, Parent: 4331)

rm (PID: 6253, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown

HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2

Source: classification engine

Classification label: clean1.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 6244)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO			Jump to behavior
Source: /usr/bin/dash (PID: 6253)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO			Jump to behavior

Source: /tmp/sh4.elf (PID: 6209)

Queries kernel information via 'uname':

Jump to behavior

Source: sh4.elf, 6209.1.00007ffd02c30000.00007ffd02c51000.rw-.sdmp	Binary or memory string: )Ct'/x86_64/usr/bin/qemu-sh4/tmp/sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sh4.elf
Source: sh4.elf, 6209.1.00007ffd02c30000.00007ffd02c51000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: sh4.elf, 6209.1.0000559c29042000.0000559c290a5000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: sh4.elf, 6209.1.0000559c29042000.0000559c290a5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	ppc.elf	Get hash	malicious	Unknown	Browse
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	garm6.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	sora.m68k.elf	Get hash	malicious	Mirai	Browse
	iLoYpTmnHz.elf	Get hash	malicious	Unknown	Browse
	zOSCVTuLxE.elf	Get hash	malicious	Gafgyt, Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai, Okiru	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	mozi.m.elf	Get hash	malicious	Unknown	Browse
	tftp.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	i486.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai, Okiru	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	ppc.elf	Get hash	malicious	Unknown	Browse
	mozi.m.elf	Get hash	malicious	Unknown	Browse
	tftp.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	i486.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	91.189.91.42
	vwkjebwi686.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	i686.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
CANONICAL-ASGB	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	91.189.91.42
	vwkjebwi686.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	i686.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
AMAZON-02US	https://t.ly/8Lgfk	Get hash	malicious	Unknown	Browse	18.245.31.5
	https://chiquitzinbb.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPWQxbDZOVGc9JnVpZD1VU0VSMTYxMDIwMjRVMTExMDE2NDc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	Due Payment Invoice PISS2024993.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	ATT25322.html	Get hash	malicious	Unknown	Browse	54.216.81.134
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL/	Get hash	malicious	Unknown	Browse	143.204.215.107
	https://app.pandadoc.com/document/v2?token=69b8ae0059c2551a9a27ed1b65653c1a0b5ee1ff	Get hash	malicious	Unknown	Browse	44.236.119.144
	https://app.writesonic.com/share/writing-assistant/d140c48b-3642-43bf-a085-e258c1fb4f03	Get hash	malicious	Unknown	Browse	3.161.75.15
	https://egift.activationshub.com/gift-card/view/8lPFUrjq1LGzg7JHwS8hJJRdL/	Get hash	malicious	Unknown	Browse	143.204.215.66
	Meridian Group Inc - Contact Submission (70.2 KB)	Get hash	malicious	Unknown	Browse	3.141.169.43
	ppc.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
INIT7CH	vqsjh4.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	109.202.202.202
	vwkjebwi686.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	tftp.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	i486.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.464235048958127
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sh4.elf
File size:	55'125 bytes
MD5:	e607d972f00d8bf2043163444a144e20
SHA1:	f48bf81bdecd5cbebd8bc617654c9e398a33202e
SHA256:	c67a5a0e9d5691e2dc3cb8111620c57a32e6daed42bacb3104301522629b271f
SHA512:	5e49377d31a8e26f860a97a7fe9e22ec6f673c6cab2dd36b4cc41bfe6fd2ae6e056163ae0c961e2db420d7bdf39c26df15ac5c0099318775020b6961cbd99171
SSDEEP:	768:7MEoOTVDoshqNHvTfjwbBed8G0lG1l2xeKRm4GNMQ2XP:7MEXDosSHvbcBw8GWIYxlRvqMFXP
TLSH:	0533090391728EA3C0476BB912B78A780723AC724B161E75552DEFF80B07ECCBD99365
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@.,...,...............,...,.A.,.A.....D1....................A...A.................Q.td............................././"O.n........#.@........#.*@.....o&O.n...l.............................

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001c0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	37624
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000b4	0xb4	0x30	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400100	0x100	0x8000	0x0	0x6	AX	0	0	32
.fini	PROGBITS	0x408100	0x8100	0x24	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x408124	0x8124	0x508	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x41862c	0x862c	0x7c	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x4186a8	0x86a8	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x4186a8	0x86a8	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x4186b0	0x86b0	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x4186b8	0x86b8	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x4186bc	0x86bc	0x200	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x4188bc	0x88bc	0x14	0x4	0x3	WA	0	0	4
.bss	NOBITS	0x4188d0	0x88d0	0x2ea0	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x88d0	0x9b4	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x9284	0x71	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x95a0	0x2590	0x10	0x0		16	251	4
.strtab	STRTAB	0x0	0xbb30	0x1c25	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x862c	0x862c	6.8724	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x862c	0x41862c	0x41862c	0x2a4	0x3144	3.8793	0x6	RW	0x10000	.eh_frame .tbss .ctors .dtors .jcr .data .got .bss
TLS	0x86a8	0x4186a8	0x4186a8	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x408100	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x408124	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x41862c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x4186a8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x4186a8	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x4186b0	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x4186b8	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x4186bc	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x4188bc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x4188d0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
.jmp_loc	.symtab	0x40152a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x4015ca	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x4019ea	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40376a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x403baa	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x4064aa	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x406f2a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x40702a	0	NOTYPE	<unknown>	DEFAULT	2
.jmp_loc	.symtab	0x407aaa	0	NOTYPE	<unknown>	DEFAULT	2
C.3.5229	.symtab	0x408268	12	OBJECT	<unknown>	DEFAULT	4
C.3.5941	.symtab	0x4081d8	12	OBJECT	<unknown>	DEFAULT	4
C.3.5941	.symtab	0x408598	12	OBJECT	<unknown>	DEFAULT	4
C.3.6204	.symtab	0x4081e4	12	OBJECT	<unknown>	DEFAULT	4
C.4.5303	.symtab	0x408580	24	OBJECT	<unknown>	DEFAULT	4
C.4.5942	.symtab	0x4081cc	12	OBJECT	<unknown>	DEFAULT	4
C.5.5949	.symtab	0x4081c0	12	OBJECT	<unknown>	DEFAULT	4
C.8.5347	.symtab	0x40825c	12	OBJECT	<unknown>	DEFAULT	4
L_abort	.symtab	0x4001f0	0	NOTYPE	<unknown>	DEFAULT	2
L_fini	.symtab	0x4001e8	0	NOTYPE	<unknown>	DEFAULT	2
L_init	.symtab	0x4001e4	0	NOTYPE	<unknown>	DEFAULT	2
L_main	.symtab	0x4001e0	0	NOTYPE	<unknown>	DEFAULT	2
L_movmem_2mod4_end	.symtab	0x407c20	0	NOTYPE	<unknown>	DEFAULT	2
L_movmem_loop	.symtab	0x407c3a	0	NOTYPE	<unknown>	DEFAULT	2
L_movmem_start_even	.symtab	0x407c46	0	NOTYPE	<unknown>	DEFAULT	2
L_uClibc_main	.symtab	0x4001ec	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x40441c	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x4188bc	0	OBJECT	<unknown>	HIDDEN	11
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x4186ac	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x4186a8	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x4188b4	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x40827e	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x4186b4	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x4186b0	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x41862c	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x4186a4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x4188b4	4	OBJECT	<unknown>	HIDDEN	10
__GI___close	.symtab	0x403be0	164	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x403bf0	40	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x4188b8	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x400dd0	44	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x404250	180	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40633c	216	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x403be0	164	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x404304	280	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x406f60	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x407ae0	172	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x407060	172	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x406f60	172	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x406f70	40	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x407ae0	172	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x407af0	40	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x403df8	108	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x403eac	68	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x407060	172	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x407070	40	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x40441c	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x402c80	184	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x401c14	64	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x403be0	164	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x4047c8	200	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x404da4	72	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x404dec	60	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x404b08	668	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x401c94	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x4031dc	116	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x404e28	444	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x404304	280	FUNC	<unknown>	HIDDEN	2
__GI_fflush	.symtab	0x4010b0	212	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x401300	516	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x4061ac	212	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40633c	216	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x406280	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x406414	132	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x404fe4	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x403800	572	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x407484	96	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40633c	216	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x404484	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x4044b8	18	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x4044ca	18	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x4044dc	18	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x4044f0	28	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x40450c	64	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x401d08	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40454c	18	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x401be8	44	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x406728	200	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40302c	204	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x404560	268	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x401b50	36	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x401d48	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x407ba0	108	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x407748	132	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x4077cc	140	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x401680	860	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x406500	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x401a20	150	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x400d80	64	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x4074e4	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40466c	60	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x4046e8	108	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x406f60	172	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x404920	176	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x403a3c	116	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x402d4c	100	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x402ef4	108	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x407ae0	172	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x404a70	152	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x401dc8	128	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x404184	104	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x401e88	128	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x401f4c	144	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x401fdc	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x4030f8	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x4067f0	20	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x404754	116	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x403ab0	224	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x402020	64	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x402f60	204	FUNC	<unknown>	HIDDEN	2
__GI_sscanf	.symtab	0x400fa0	128	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x401ac0	36	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x406524	196	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x4065e8	192	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x401ae4	34	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x401ae4	34	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x4064e0	16	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x401b08	72	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x401560	88	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x4066a8	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x4066f8	48	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x403358	1032	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x401b74	116	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x400dc0	16	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x407858	308	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x4054a0	1552	FUNC	<unknown>	HIDDEN	2
__GI_vsscanf	.symtab	0x401020	144	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x407060	172	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x4186b8	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x4186b8	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x41ae70	4	OBJECT	<unknown>	HIDDEN	12
__atexit_lock	.symtab	0x418890	24	OBJECT	<unknown>	DEFAULT	10
__bss_start	.symtab	0x4188d0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x403e64	72	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x403be0	164	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x403bf0	40	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x4188b8	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x41b3b4	4	OBJECT	<unknown>	HIDDEN	12
__data_start	.symtab	0x4186bc	0	NOTYPE	<unknown>	DEFAULT	10
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__do_global_ctors_aux	.symtab	0x4080c0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x4186bc	0	OBJECT	<unknown>	HIDDEN	10
__environ	.symtab	0x41ae68	4	OBJECT	<unknown>	DEFAULT	12
__errno_location	.symtab	0x400dd0	44	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x41a918	4	OBJECT	<unknown>	HIDDEN	12
__fcntl_nocancel	.symtab	0x404250	180	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x40633c	216	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x4186a8	0	NOTYPE	<unknown>	HIDDEN	6
__fini_array_start	.symtab	0x4186a8	0	NOTYPE	<unknown>	HIDDEN	6
__fork	.symtab	0x403800	572	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x41b740	4	OBJECT	<unknown>	HIDDEN	12
__fork_handlers	.symtab	0x41b744	4	OBJECT	<unknown>	HIDDEN	12
__fork_lock	.symtab	0x41a91c	4	OBJECT	<unknown>	HIDDEN	12
__getdents64	.symtab	0x407634	276	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x4044f0	28	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x4186a8	0	NOTYPE	<unknown>	HIDDEN	6
__init_array_start	.symtab	0x4186a8	0	NOTYPE	<unknown>	HIDDEN	6
__init_brk	.symtab	0x4073f0	84	FUNC	<unknown>	HIDDEN	2
__init_brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_scan_cookie	.symtab	0x405ac4	72	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x403be0	164	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x401c94	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x403ca0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x403d28	136	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	6
__libc_fcntl	.symtab	0x404304	280	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x403800	572	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	6
__libc_nanosleep	.symtab	0x4046e8	108	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x406f60	172	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x407ae0	172	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x401dc8	128	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x401e88	128	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x401f4c	144	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x4071b2	366	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x4067f0	20	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x41ae64	4	OBJECT	<unknown>	DEFAULT	12
__libc_write	.symtab	0x407060	172	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x4037a0	64	FUNC	<unknown>	HIDDEN	2
__lll_unlock_wake_private	.symtab	0x4037e0	30	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x402984	328	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x4020d0	112	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x4187b4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x41b3c8	888	OBJECT	<unknown>	DEFAULT	12
__malloc_trim	.symtab	0x4028e8	156	FUNC	<unknown>	DEFAULT	2
__movmemSI12_i4	.symtab	0x407c60	14	FUNC	<unknown>	HIDDEN	2
__movmem_i4_even	.symtab	0x407c28	48	FUNC	<unknown>	HIDDEN	2
__movmem_i4_odd	.symtab	0x407c2e	42	FUNC	<unknown>	HIDDEN	2
__movstrSI12_i4	.symtab	0x407c60	14	FUNC	<unknown>	HIDDEN	2
__movstr_i4_even	.symtab	0x407c28	48	FUNC	<unknown>	HIDDEN	2
__movstr_i4_odd	.symtab	0x407c2e	42	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x406f60	172	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x406f70	40	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x41ae6c	4	OBJECT	<unknown>	DEFAULT	12
__preinit_array_end	.symtab	0x4186a8	0	NOTYPE	<unknown>	HIDDEN	6
__preinit_array_start	.symtab	0x4186a8	0	NOTYPE	<unknown>	HIDDEN	6
__progname	.symtab	0x4188ac	4	OBJECT	<unknown>	DEFAULT	10
__progname_full	.symtab	0x4188b0	4	OBJECT	<unknown>	DEFAULT	10
__psfs_do_numeric	.symtab	0x405da8	1028	FUNC	<unknown>	HIDDEN	2
__psfs_do_numeric.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__psfs_parse_spec	.symtab	0x405ba4	516	FUNC	<unknown>	HIDDEN	2
__psfs_parse_spec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__pthread_initialize_minimal	.symtab	0x407320	24	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x403dbe	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x403db0	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x403db0	14	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x403db0	14	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x403db0	14	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x407ae0	172	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x407af0	40	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__rtld_fini	.symtab	0x41ae74	4	OBJECT	<unknown>	HIDDEN	12
__scan_cookie.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__scan_getc	.symtab	0x405b0c	96	FUNC	<unknown>	HIDDEN	2
__scan_ungetc	.symtab	0x405b6c	56	FUNC	<unknown>	HIDDEN	2
__sdivsi3_i4i	.symtab	0x407d50	852	FUNC	<unknown>	HIDDEN	2
__sigjmp_save	.symtab	0x406804	56	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x404210	60	FUNC	<unknown>	DEFAULT	2
__sigsetjmp_intern	.symtab	0x404214	0	NOTYPE	<unknown>	DEFAULT	2
__stdin	.symtab	0x4186d8	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x40798c	80	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x404ffc	192	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x4079dc	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x407a0c	140	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x400f6c	52	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x4186dc	4	OBJECT	<unknown>	DEFAULT	10
__strtofpmax	.symtab	0x406d08	536	FUNC	<unknown>	HIDDEN	2
__strtofpmax.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sys_connect	.symtab	0x401c54	64	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x401d88	64	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x401e48	64	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x401f08	68	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x401520	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x4015c0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x4019e0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x403760	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x403ba0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x4064a0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x406f20	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x407020	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x407aa0	0	NOTYPE	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x4046a8	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x407444	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__sysv_signal	.symtab	0x402060	112	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x40719c	22	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x403df8	108	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x403eac	68	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x403ef0	660	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x4188a8	4	OBJECT	<unknown>	HIDDEN	10
__udivsi3_i4i	.symtab	0x407c80	208	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x407060	172	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x407070	40	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x4075b4	128	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x407528	140	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_brk	.symtab	0x4073b4	60	FUNC	<unknown>	HIDDEN	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x407338	32	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x407358	92	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x41b768	4	OBJECT	<unknown>	DEFAULT	12
_dl_phnum	.symtab	0x41b76c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_gaps	.symtab	0x41b75c	1	OBJECT	<unknown>	DEFAULT	12
_dl_tls_dtv_slotinfo_list	.symtab	0x41b758	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_generation	.symtab	0x41b760	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_max_dtv_idx	.symtab	0x41b750	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_setup	.symtab	0x407160	60	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x41b74c	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_nelem	.symtab	0x41b764	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_size	.symtab	0x41b754	4	OBJECT	<unknown>	DEFAULT	12
_dl_tls_static_used	.symtab	0x41b748	4	OBJECT	<unknown>	DEFAULT	12
_edata	.symtab	0x4188d0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x41b770	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x40441c	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x408100	0	FUNC	<unknown>	HIDDEN	3
_fixed_buffers	.symtab	0x418914	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x4000b4	0	FUNC	<unknown>	HIDDEN	1
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_pthread_cleanup_pop_restore	.symtab	0x403ddc	28	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x403dcc	16	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x4041f0	4	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x4001c0	30	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x4050bc	732	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x400dfc	116	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x4186e0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x4188f4	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_dec_use	.symtab	0x401184	380	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x418910	4	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_del_lock	.symtab	0x418900	12	OBJECT	<unknown>	DEFAULT	12
_stdio_openlist_use_count	.symtab	0x41890c	4	OBJECT	<unknown>	DEFAULT	12
_stdio_streams	.symtab	0x4186e8	204	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x400e70	252	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x4186e4	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_ll	.symtab	0x406af0	536	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_ll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x405398	56	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x402c80	184	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ack	.symtab	0x4005a0	412	FUNC	<unknown>	DEFAULT	2
authBytes	.symtab	0x4186c8	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that	.symtab	0x41a914	4	OBJECT	<unknown>	DEFAULT	12
bind	.symtab	0x401c14	64	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x402804	228	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x403be0	164	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x4047c8	200	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cncHost	.symtab	0x4186c4	4	OBJECT	<unknown>	DEFAULT	10
commands_parse	.symtab	0x400740	332	FUNC	<unknown>	DEFAULT	2
completed.4720	.symtab	0x4188d0	1	OBJECT	<unknown>	DEFAULT	12
connect	.symtab	0x401c94	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectToCNC	.symtab	0x4008a0	244	FUNC	<unknown>	DEFAULT	2
crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decpt_str	.symtab	0x4085a4	2	OBJECT	<unknown>	DEFAULT	4
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endianness	.symtab	0x4188ec	4	OBJECT	<unknown>	DEFAULT	12
ensure	.symtab	0x400a80	192	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x41ae68	4	OBJECT	<unknown>	DEFAULT	12
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	6
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x4031dc	116	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fclose	.symtab	0x404e28	444	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x404304	280	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0x404890	144	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x4049d0	160	FUNC	<unknown>	DEFAULT	2
fetchLocalAddress	.symtab	0x400b40	204	FUNC	<unknown>	DEFAULT	2
fflush	.symtab	0x4010b0	212	FUNC	<unknown>	DEFAULT	2
fflush.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x401300	516	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x4061ac	212	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40633c	216	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x406280	188	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x406414	132	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x404fe4	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x403800	572	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x41a920	1348	OBJECT	<unknown>	DEFAULT	12
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400160	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x402acc	384	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x407484	96	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getDeviceName	.symtab	0x4009a0	204	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x4061ac	212	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x40633c	216	FUNC	<unknown>	DEFAULT	2
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x404484	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x4044b8	18	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x4044ca	18	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x4044dc	18	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x4044f0	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x40450c	64	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x401d08	64	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40454c	18	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	6
index	.symtab	0x406524	196	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x401be8	44	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x406728	200	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x407120	64	FUNC	<unknown>	DEFAULT	2
initstate	.symtab	0x402e1c	120	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40302c	204	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x404560	268	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x401b50	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0x401d48	64	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
localAddress	.symtab	0x4188f0	4	OBJECT	<unknown>	DEFAULT	12
lseek64	.symtab	0x407ba0	108	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x400c20	324	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x402140	1732	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x402c4c	52	FUNC	<unknown>	DEFAULT	2
mbrtowc	.symtab	0x407748	132	FUNC	<unknown>	DEFAULT	2
mbrtowc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbsnrtowcs	.symtab	0x4077cc	140	FUNC	<unknown>	DEFAULT	2
mbsnrtowcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mbstate.5512	.symtab	0x41b3b8	8	OBJECT	<unknown>	DEFAULT	12
mbstate.5513	.symtab	0x41b3c0	8	OBJECT	<unknown>	DEFAULT	12
memcpy	.symtab	0x401680	860	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x406500	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x401a20	150	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x400d80	64	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mount.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x4074e4	68	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x40466c	60	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x4187cc	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x4187e4	24	OBJECT	<unknown>	DEFAULT	10
nan_inf_str.2417	.symtab	0x408614	21	OBJECT	<unknown>	DEFAULT	4
nan_inf_str.6307	.symtab	0x408600	11	OBJECT	<unknown>	DEFAULT	4
nanosleep	.symtab	0x4046e8	108	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nil_string	.symtab	0x40860c	6	OBJECT	<unknown>	DEFAULT	4
nprocessors_onln	.symtab	0x403250	264	FUNC	<unknown>	DEFAULT	2
object.4732	.symtab	0x4188d4	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x406f60	172	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x404920	176	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.4718	.symtab	0x4186c0	0	OBJECT	<unknown>	DEFAULT	10
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
printf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
program_invocation_name	.symtab	0x4188b0	4	OBJECT	<unknown>	DEFAULT	10
program_invocation_short_name	.symtab	0x4188ac	4	OBJECT	<unknown>	DEFAULT	10
pudp	.symtab	0x400360	316	FUNC	<unknown>	DEFAULT	2
putchar.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars	.symtab	0x4085c4	18	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x403a3c	116	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x402d38	20	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random	.symtab	0x402d4c	100	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x4081f0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x402ef4	108	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x418810	128	OBJECT	<unknown>	DEFAULT	10
read	.symtab	0x407ae0	172	FUNC	<unknown>	DEFAULT	2
readdir64	.symtab	0x404a70	152	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x40683c	692	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x401dc8	128	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rindex	.symtab	0x4066a8	80	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x404184	104	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sc_getc	.symtab	0x405ab0	20	FUNC	<unknown>	DEFAULT	2
scan_getwc	.symtab	0x4053d0	208	FUNC	<unknown>	DEFAULT	2
send	.symtab	0x401e88	128	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendto	.symtab	0x401f4c	144	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setjmp	.symtab	0x404200	4	FUNC	<unknown>	DEFAULT	2
setsockopt	.symtab	0x401fdc	68	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x402db0	108	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x4030f8	228	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x4067f0	20	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigjmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x404754	116	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x403ab0	224	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
snprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x402020	64	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
spec_allowed	.symtab	0x4085e0	16	OBJECT	<unknown>	DEFAULT	4
spec_base	.symtab	0x4085f0	15	OBJECT	<unknown>	DEFAULT	4
spec_chars	.symtab	0x4085ac	23	OBJECT	<unknown>	DEFAULT	4
spec_flags	.symtab	0x4085a8	4	OBJECT	<unknown>	DEFAULT	4
spec_ranges	.symtab	0x4085d8	8	OBJECT	<unknown>	DEFAULT	4
srand	.symtab	0x402e94	96	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x402e94	96	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x402f60	204	FUNC	<unknown>	DEFAULT	2
sscanf	.symtab	0x400fa0	128	FUNC	<unknown>	DEFAULT	2
sscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
static_dtv	.symtab	0x41ae78	512	OBJECT	<unknown>	DEFAULT	12
static_map	.symtab	0x41b380	52	OBJECT	<unknown>	DEFAULT	12
static_slotinfo	.symtab	0x41b078	776	OBJECT	<unknown>	DEFAULT	12
std	.symtab	0x4004a0	232	FUNC	<unknown>	DEFAULT	2
stderr	.symtab	0x4186d4	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x4186cc	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x4186d0	4	OBJECT	<unknown>	DEFAULT	10
strcat	.symtab	0x401ac0	36	FUNC	<unknown>	DEFAULT	2
strcat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x406524	196	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchrnul	.symtab	0x4065e8	192	FUNC	<unknown>	DEFAULT	2
strchrnul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x401ae4	34	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x401ae4	34	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x4064e0	16	FUNC	<unknown>	DEFAULT	2
strcspn	.symtab	0x401b08	72	FUNC	<unknown>	DEFAULT	2
strcspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strlen	.symtab	0x401560	88	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x4066a8	80	FUNC	<unknown>	DEFAULT	2
strrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x4066f8	48	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysconf	.symtab	0x403358	1032	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sysv_signal	.symtab	0x402060	112	FUNC	<unknown>	DEFAULT	2
sysv_signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcgetattr	.symtab	0x401b74	116	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
time	.symtab	0x400dc0	16	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
udp	.symtab	0x400200	348	FUNC	<unknown>	DEFAULT	2
ungetc	.symtab	0x407858	308	FUNC	<unknown>	DEFAULT	2
ungetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unsafe_state	.symtab	0x4187fc	20	OBJECT	<unknown>	DEFAULT	10
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vfscanf	.symtab	0x4054a0	1552	FUNC	<unknown>	DEFAULT	2
vfscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsscanf	.symtab	0x401020	144	FUNC	<unknown>	DEFAULT	2
vsscanf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x407060	172	FUNC	<unknown>	DEFAULT	2
xstatconv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 16:14:55.586837053 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 24, 2024 16:15:00.961807966 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 24, 2024 16:15:01.729648113 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 24, 2024 16:15:17.343451977 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 24, 2024 16:15:18.348941088 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.348965883 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.348982096 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.349142075 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.349226952 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.351440907 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.357516050 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.589025974 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.589253902 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.589401960 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.594777107 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.827419996 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.827727079 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.829334974 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:18.835155964 CEST	443	33606	54.171.230.55	192.168.2.23
Oct 24, 2024 16:15:18.835227966 CEST	33606	443	192.168.2.23	54.171.230.55
Oct 24, 2024 16:15:27.582073927 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 24, 2024 16:15:31.677479029 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 24, 2024 16:15:58.297790051 CEST	43928	443	192.168.2.23	91.189.91.42

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 24, 2024 16:15:18.348982096 CEST	54.171.230.55	443	192.168.2.23	33606	CN=motd.ubuntu.com CN=R11, O=Let's Encrypt, C=US	CN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Oct 21 10:21:37 CEST 2024 Wed Mar 13 01:00:00 CET 2024	Sun Jan 19 09:21:36 CET 2025 Sat Mar 13 00:59:59 CET 2027
Oct 24, 2024 16:15:18.348982096 CEST	54.171.230.55	443	192.168.2.23	33606	CN=R11, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027

System Behavior

Analysis Process: sh4.elf PID: 6209, Parent PID: 6128

General

Start time (UTC):	14:14:55
Start date (UTC):	24/10/2024
Path:	/tmp/sh4.elf
Arguments:	/tmp/sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Chronological Activities

Analysis Process: dash PID: 6244, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6244, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6245, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6245, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.3DwdTi16Ey
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6246, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6246, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6247, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6247, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6248, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6248, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6249, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 6249, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.3DwdTi16Ey
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: dash PID: 6250, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: head PID: 6250, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Chronological Activities

Analysis Process: dash PID: 6251, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: tr PID: 6251, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Chronological Activities

Analysis Process: dash PID: 6252, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cut PID: 6252, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Chronological Activities

Analysis Process: dash PID: 6253, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6253, Parent PID: 4331

General

Start time (UTC):	14:15:18
Start date (UTC):	24/10/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.3DwdTi16Ey /tmp/tmp.oMjial0suc /tmp/tmp.tYZ1IjG1gO
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

HTTPS Connections

System Behavior

Analysis Process: sh4.elf PID: 6209, Parent PID: 6128

General

Chronological Activities

Analysis Process: dash PID: 6244, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6244, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6245, Parent PID: 4331

General

Chronological Activities

Analysis Process: cat PID: 6245, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6246, Parent PID: 4331

General

Chronological Activities

Analysis Process: head PID: 6246, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6247, Parent PID: 4331

General

Chronological Activities

Linux Analysis Report
sh4.elf