Edit tour

Linux Analysis Report
OkTC3AlPZZ.elf

Overview

General Information

Sample name:	OkTC3AlPZZ.elf renamed because original name is a hash value
Original sample name:	35dabe2728a4bf848f7049df93ecb036.elf
Analysis ID:	1417438
MD5:	35dabe2728a4bf848f7049df93ecb036
SHA1:	a57b2962d2d645482c84936f0a322bf09fcda04d
SHA256:	0a152100e296908bed608a26265749658d58d7e9913de932ad8f450ac77b15d2
Tags:	32armelfgafgyt
Infos:

Detection

Gafgyt, Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417438
Start date and time:	2024-03-29 09:50:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	OkTC3AlPZZ.elf renamed because original name is a hash value
Original Sample Name:	35dabe2728a4bf848f7049df93ecb036.elf
Detection:	MAL
Classification:	mal96.spre.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/OkTC3AlPZZ.elf
PID:	5528
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

OkTC3AlPZZ.elf (PID: 5528, Parent: 5451, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/OkTC3AlPZZ.elf

OkTC3AlPZZ.elf New Fork (PID: 5530, Parent: 5528)

OkTC3AlPZZ.elf New Fork (PID: 5532, Parent: 5530)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
OkTC3AlPZZ.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
OkTC3AlPZZ.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
OkTC3AlPZZ.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5530.1.00007f905c017000.00007f905c030000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5530.1.00007f905c017000.00007f905c030000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5528.1.00007f905c017000.00007f905c030000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5528.1.00007f905c017000.00007f905c030000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: OkTC3AlPZZ.elf PID: 5528	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: OkTC3AlPZZ.elf PID: 5528	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4223:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4237:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x424b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x425f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x429b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x433b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x434f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x438b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x439f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x43b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: OkTC3AlPZZ.elf PID: 5530	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: OkTC3AlPZZ.elf PID: 5530	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4f0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fe9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ffd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5011:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5025:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5039:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x504d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5061:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5075:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5089:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x509d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: OkTC3AlPZZ.elf

Avira: detected

Found malware configuration

Source: OkTC3AlPZZ.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "193.35.18.56:65490"}

Multi AV Scanner detection for submitted file

Source: OkTC3AlPZZ.elf	ReversingLabs: Detection: 50%
Source: OkTC3AlPZZ.elf	Virustotal: Detection: 58%			Perma Link

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/OkTC3AlPZZ.elf (PID: 5528)

Opens: /proc/net/route

Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 193.35.18.56 ports 0,4,5,6,9,65490

Source: global traffic

TCP traffic: 192.168.2.15:49560 -> 193.35.18.56:65490

Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.35.18.56
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: OkTC3AlPZZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5530.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5528.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: OkTC3AlPZZ.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: OkTC3AlPZZ.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: OkTC3AlPZZ.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: LZRDskidx86?-_-=1IObeENwjmipsvlxx.arm6vlxx.armvlxx.x86_64vlxx.mipsvlxx.arm7vlxx.m68kvlxx.mpslvlxx.ppcvlxx.sh4vlxx.x86vlxx.arm5sys64.m68ksys64.x86sys64.x86_64sys64.arm6sys64.mpslsys64.spcsys64.ar64besys64.sh4sys64.aarch64sys64.i686sys64.arm7sys64.armsys64.mipssys64.arm5IObeENwjmpslIObeENwjarmIObeENwjarm4IObeENwjarm5IObeENwjarm6IObeENwjarm7.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppcdvrhelperhuhudvrsupportmiraiArceusla.bot.0xc2sfuckjewishpeople.mipsfuckjewishpeoplessh.mipsHadesboatnetloligangSakuraDemonbladedemonhohohakaisoramessiahmipsmipselsh4superhx86armv7armv6i686campnig.x86nigpercx86dosbotBOTDOS@DOSBOTDOSBOTperci5perci6percmipspercmpslpercsparkpercm68kpercppcpercsh4percshpercoarmperceightysixpercmips&lperc.shCronx86anacronCronarmCronmipsCronmpslCronspcCronm68kCronppcCronsh4Cronshcnrpox(deleted)killpstreekillallbgpmaplsofarmUser-Agent:/dev/nullSTD/etc/rc.conf/proc/net/tcp/proc/self/exeUPX!/proc/net/route/etc/rc.d/rc.local/bin/shtophtopgrepbashcatnanopssshtelnetdpcbashdvarsshdcurltftpdtelnetvar/Challen

Source: OkTC3AlPZZ.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5530.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5528.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: OkTC3AlPZZ.elf PID: 5528, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: OkTC3AlPZZ.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.linELF@0/0@2/0

Source: /tmp/OkTC3AlPZZ.elf (PID: 5528)

Queries kernel information via 'uname':

Jump to behavior

Source: OkTC3AlPZZ.elf, 5528.1.00005622ed323000.00005622ed472000.rw-.sdmp, OkTC3AlPZZ.elf, 5530.1.00005622ed323000.00005622ed451000.rw-.sdmp	Binary or memory string: "V!/etc/qemu-binfmt/arm
Source: OkTC3AlPZZ.elf, 5528.1.00005622ed323000.00005622ed472000.rw-.sdmp, OkTC3AlPZZ.elf, 5530.1.00005622ed323000.00005622ed451000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: OkTC3AlPZZ.elf, 5528.1.00007ffed8320000.00007ffed8341000.rw-.sdmp, OkTC3AlPZZ.elf, 5530.1.00007ffed8320000.00007ffed8341000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: OkTC3AlPZZ.elf, 5528.1.00007ffed8320000.00007ffed8341000.rw-.sdmp, OkTC3AlPZZ.elf, 5530.1.00007ffed8320000.00007ffed8341000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/OkTC3AlPZZ.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/OkTC3AlPZZ.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: OkTC3AlPZZ.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: OkTC3AlPZZ.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OkTC3AlPZZ.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OkTC3AlPZZ.elf PID: 5530, type: MEMORYSTR

Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Safari/605.1.1 31.5
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3 17.34
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.1 11.27
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.1 9.83
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3 9.25
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120. 6.94
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117. 2.31
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0. 2.31
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115. 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.3 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Herring/90.1.9310.1 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 OPR/105.0.0. 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.4 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.3 1.16
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.169 Mobile/15E148 Safari/604.
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: OkTC3AlPZZ.elf, type: SAMPLE

Yara detected Mirai

Source: Yara match	File source: OkTC3AlPZZ.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5528.1.00007f905c017000.00007f905c030000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OkTC3AlPZZ.elf PID: 5528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OkTC3AlPZZ.elf PID: 5530, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

Threatname: Gafgyt

{"C2 url": "193.35.18.56:65490"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OkTC3AlPZZ.elf	50%	ReversingLabs	Linux.Trojan.Gafgyt
OkTC3AlPZZ.elf	58%	Virustotal		Browse
OkTC3AlPZZ.elf	100%	Avira	LINUX/Gafgyt.opnd

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
193.35.18.56:65490	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.35.18.56	unknown	Germany		41865	BIALLNET-ASPL	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.35.18.56	D2sLkFb0Il.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	T2bvctwzcE.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	D88pI7Bo4B.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ehDbsf5C6M.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	78mfG4QdNn.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	1zIdRfHN5N.elf	Get hash	malicious	Mirai	Browse
	hiVHXinGE3.elf	Get hash	malicious	Unknown	Browse
	bD3m9BoJzq.elf	Get hash	malicious	Unknown	Browse
	n9wkBW1daO.elf	Get hash	malicious	Mirai	Browse
	lUnktZrfeB.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	T2bvctwzcE.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	D88pI7Bo4B.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	78mfG4QdNn.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	SecuriteInfo.com.Linux.BtcMine.798.28745.31751.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	p8F35SRiO8.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Kie7OQsnAC.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	DHz0sMSRlg.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	dj4jBpJkg6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	7JP4pajFXr.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BIALLNET-ASPL	D2sLkFb0Il.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.56
	T2bvctwzcE.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.56
	D88pI7Bo4B.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.56
	ehDbsf5C6M.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.56
	78mfG4QdNn.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.35.18.56
	t6Bg659hSX.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	Y5sssTW9Ev.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	sDx2bQyU33.elf	Get hash	malicious	Mirai	Browse	193.35.18.164
	oPgt6oZlbo.elf	Get hash	malicious	Unknown	Browse	193.35.18.164
	XKpbIPPjsg.elf	Get hash	malicious	Mirai	Browse	193.35.18.164

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.073830005992535
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	OkTC3AlPZZ.elf
File size:	166'435 bytes
MD5:	35dabe2728a4bf848f7049df93ecb036
SHA1:	a57b2962d2d645482c84936f0a322bf09fcda04d
SHA256:	0a152100e296908bed608a26265749658d58d7e9913de932ad8f450ac77b15d2
SHA512:	b1eef7afe05f252132b19bc5ba1a2b7d14b8ff9912b36bc88d836ece847cf6e739535354f34ecd655e3c6d7d3b6e9f35f546df0c4da30ecd4842ca93092941b5
SSDEEP:	3072:EEz42nad2snP1yJShni71cvvK5SXeN+NV7sWmJhny2qAQYzc:znad2sn9yqi7mvvKcXeN+NV7sWmJhnyL
TLSH:	F2F3E619F6418723C1E32775B68E9E4A3B3247D473DB730A66346BF43BC269A1D22D09
File Content Preview:	.ELF..............(.........4...........4. ...(........pt...t...t... ... ...............................................................tx..........................................Q.td..................................-...L..................G.F.G.F.G.F.G.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81d0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	130984
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x13b30	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1bc20	0x13c20	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1bc30	0x13c30	0x4f2c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x20b5c	0x18b5c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x20b74	0x18b74	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29000	0x19000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x29004	0x19004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29004	0x19004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x29008	0x19008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2900c	0x1900c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x29010	0x19010	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x290c0	0x190c0	0x630	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x296f0	0x196f0	0x7184	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x196f0	0xc2e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a320	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1a460	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1a673	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1c6b6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1cd98	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1dc10	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1dec8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1e792	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1f921	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1fe79	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1fe8f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x20430	0x57c0	0x10	0x0		28	776	4
.strtab	STRTAB	0x0	0x25bf0	0x2e33	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x18b74	0x20b74	0x20b74	0x120	0x120	4.4963	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x18c94	0x18c94	6.2850	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19000	0x29000	0x29000	0x6f0	0x7874	4.4963	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x19004	0x29004	0x29004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1bc20	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1bc30	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x20b5c	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x20b74	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x29000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x29004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x29004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x29008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2900c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x29010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x290c0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x296f0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1bc20	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1bc2c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x812c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x93c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ccc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa5ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xafcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb0f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbbf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd63c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xede4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf02c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfeb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1005c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1012c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1022c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1171c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1317c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1320c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1329c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1398c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13abc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1451c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1492c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15db4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1739c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1790c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1948c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a76c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1accc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b44c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x290c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8200	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x290c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x832c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8b50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8d0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8dac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x902c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x93ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9cc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9eb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa18c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xafc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb0ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xba1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc88c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd354	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xd540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd62c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd69c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd6e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd7b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd7f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd83c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd880	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x294e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f46c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x294ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1f76c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x294f4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fa6c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xdb30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdcd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fd6c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xddac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdefc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe330	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe3d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe52c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29500	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x294fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xed20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fddc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xefd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf56c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x295e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fde4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fe68	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xfe84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1002c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1031c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1038c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x105ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x295e8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29600	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x117bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29618	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x296b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11a80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x209d4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11f44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1275c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x127d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1342c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13594	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13cec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13df4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13e84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1491c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a80	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x159ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ed8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1655c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ba0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17044	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296e8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1752c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1899c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296ee	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20b3c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18f6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19414	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1952c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1959c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1980c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1a9c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$t	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
C.11.5548	.symtab	0x20a44	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1fd6c	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x20a50	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1fd84	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1fdb4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1fd90	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1fda8	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1fd9c	12	OBJECT	<unknown>	DEFAULT	4
JoinName	.symtab	0x30404	80	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0xf968	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0xf984	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x2972c	16384	OBJECT	<unknown>	DEFAULT	14
SendHTTP	.symtab	0xb890	408	FUNC	<unknown>	DEFAULT	2
SendHTTPCloudflare	.symtab	0xbbf4	400	FUNC	<unknown>	DEFAULT	2
SendHTTPHex	.symtab	0xba28	460	FUNC	<unknown>	DEFAULT	2
Trim	.symtab	0x8b80	308	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0xd63c	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x29010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1a774	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1a778	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1b428	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1a76c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1a7b0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1b44c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1bbec	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1a7a4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1b3bc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1b3e0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1b404	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1a6d4	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1acec	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1a720	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x294e4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1f46c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x294ec	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1f76c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x294f4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x1fa6c	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x29000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x29000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x294e4	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x294ec	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x294f4	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x130b0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x13094	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x294e8	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x294f0	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x294f8	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0xdd90	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xd4b0	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x15db4	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0xfd38	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x130b0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xd548	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x13140	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x13260	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x131d0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x13140	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x13124	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x13260	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x13244	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x12ca0	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x105dc	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x10600	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x105b8	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x13478	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x13548	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x131d0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x131b4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0xfd50	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0xd63c	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x115f4	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x11d40	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17344	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x130b0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xda3c	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1444c	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x14480	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x14124	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1012c	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x11f54	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x145fc	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xd548	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x15a08	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x15614	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x15db4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0xf59c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0xf6b8	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0xddb0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x127d8	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0xf758	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x17534	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x17558	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x13b30	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0xf790	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x15db4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x13b94	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x13bc0	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x13bd4	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x13be8	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1005c	28	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2	.symtab	0x10078	112	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x168e0	724	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x18fd0	836	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x19354	132	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x13bfc	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x12e28	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x13c24	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x101a0	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x13c5c	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x13c9c	20	FUNC	<unknown>	HIDDEN	2
__GI_htonl	.symtab	0xff3c	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0xff2c	16	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x10034	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x167e8	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x10018	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0xff8c	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x17e40	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x17ac8	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x11b5c	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0xd6e4	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0xfe8c	36	FUNC	<unknown>	HIDDEN	2
__GI_isspace	.symtab	0xd9b4	40	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xd7c4	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x19530	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16370	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0xf870	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x195a0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x16460	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x16484	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0xf880	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1398c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x173a8	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x13cb0	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x13d30	96	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0xff6c	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0xff5c	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x13140	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xdc1c	196	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x19418	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x12e70	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x11734	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x119f4	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x17948	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x13260	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x14038	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x10270	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x13d90	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xd884	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x10324	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x103e0	136	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x10468	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x11c54	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13a34	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x104f4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x13dfc	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x12f60	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0xddd0	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x104b0	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xde00	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x11a84	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1948c	100	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x19a2c	108	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0xf9a0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x16564	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0xf920	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0xf920	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0xfa90	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x16650	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x195b0	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0xf940	96	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0xfab4	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0xfb70	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x167a8	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x16694	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x166e4	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0xfc3c	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0xfe5c	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x16730	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x11d60	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x12164	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0xfeb0	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xd908	48	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0xd9dc	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0xda0c	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x194f0	64	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xde34	208	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x13e88	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0xd938	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x144c8	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x14540	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1451c	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x131d0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2900c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2900c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1b428	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1b3bc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1b3e0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1b404	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x19c94	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1a5f0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1a5f0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1a5d4	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1a680	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x19c94	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1a608	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1a650	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1a668	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1a638	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1a620	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1a334	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1a0a4	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x19c88	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x19c90	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x19ff0	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x19fc8	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x19b44	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x19c70	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1a044	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x13ae0	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x19fa4	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xd388	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xd484	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1a030	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1b388	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1b380	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1b378	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2fe98	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x296c4	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x30874	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x296f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x296f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x134f4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x130b0	100	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x18eec	152	FUNC	<unknown>	HIDDEN	2
__close_nocancel	.symtab	0x13094	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1a550	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x294e8	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x294f0	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x294f8	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x303dc	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x290c0	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x180dc	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x196d0	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13ad4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13ac8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xd49c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1a334	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x19b44	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x181d4	2064	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x812c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x29008	0	OBJECT	<unknown>	DEFAULT	10
__dso_handle	.symtab	0x290c0	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x19a98	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x195e4	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x19784	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x30874	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2fe90	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1a550	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xdd90	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x20c94	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x20b74	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2f940	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x19ff0	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xd4b0	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x15db4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2900c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x29008	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1a680	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1a044	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x19fc8	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1a030	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x19fa4	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x127d8	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x3082c	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x30830	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2f944	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x29004	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1a540	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x18f84	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x173ec	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x13bfc	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x12e28	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0xfd38	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1ab2c	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1ac14	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1b3ac	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1aba8	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1accc	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1b3b4	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1b490	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1bba4	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1ae30	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1a540	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x29008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x29004	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1a548	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x130b0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1012c	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x132d0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x13358	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0xd548	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x127d8	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x30834	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x13d30	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x13140	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x13260	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x10270	112	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xd884	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x10324	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x103e0	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x17078	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13a34	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2fe8c	4	OBJECT	<unknown>	DEFAULT	14
__libc_waitpid	.symtab	0xd938	124	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x131d0	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x12c3c	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x12ba4	152	FUNC	<unknown>	HIDDEN	2
__local_nameserver	.symtab	0x20b3c	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1a548	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x111c4	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x10624	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x295e8	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x304b4	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x11114	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1a0a4	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x30868	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x3086c	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x1a550	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x13140	100	FUNC	<unknown>	DEFAULT	2
__open_etc_hosts	.symtab	0x197e4	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x18a90	1116	FUNC	<unknown>	HIDDEN	2
__open_nocancel	.symtab	0x13124	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2fe94	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x29004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x29004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x296e0	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x296e4	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x172a8	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1343c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x13434	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x13434	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x13434	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x13434	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x13260	100	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x19814	536	FUNC	<unknown>	HIDDEN	2
__read_nocancel	.symtab	0x13244	24	FUNC	<unknown>	DEFAULT	2
__register_atfork	.symtab	0x12ca0	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x30860	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x296ef	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x303e4	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x296ee	1	OBJECT	<unknown>	HIDDEN	13
__restore_core_regs	.symtab	0x1b390	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2fe9c	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x30864	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x30870	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x105dc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10600	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x105b8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x19314	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1739c	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2950c	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x17718	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1492c	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17770	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x14a08	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x17838	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1790c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x17868	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x14b48	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xe548	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29510	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x19c90	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x100e8	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x1022c	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x102e0	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x10394	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x13a08	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x13cf0	64	FUNC	<unknown>	DEFAULT	2
__syscall_poll	.symtab	0x193d8	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x13af0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0xd840	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x17054	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x13478	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x13548	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x135a0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x296dc	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0xd388	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x131d0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x131b4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0xfd50	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x13f8c	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x13ec0	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2f750	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x30874	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x811d	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8121	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8129	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x810d	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x8111	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x8115	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x8119	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8125	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0xe578	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x3045c	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x30484	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x295e4	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x172b4	56	FUNC	<unknown>	DEFAULT	2
_dl_init_static_tls	.symtab	0x296e8	4	OBJECT	<unknown>	DEFAULT	13
_dl_nothread_init_static_tls	.symtab	0x172ec	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x30858	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x3085c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x3084c	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x30848	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x30850	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x30840	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x16fec	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x3083c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x30854	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x30844	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x30838	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x296f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x30874	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0xd63c	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1bc20	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2d750	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xe5cc	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x14e20	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x14c24	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x15ee0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xed44	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xf02c	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xede4	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xee28	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xefd8	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1344c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x13444	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x13abc	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x304ac	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x81d0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0xdf04	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xe364	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x29514	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2d730	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x15758	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2d74c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2d73c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2d748	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x29518	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0xe3e4	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x294fc	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x11d7c	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x14c98	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1fe78	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x14cc4	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xe650	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x115f4	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xd6a4	64	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
allowed_bin_names	.symtab	0x293a0	52	OBJECT	<unknown>	DEFAULT	13
allowed_bin_names_size	.symtab	0x293d4	4	OBJECT	<unknown>	DEFAULT	13

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 09:51:08.649719000 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:08.831558943 CET	65490	49560	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:08.831631899 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:09.660032034 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:09.841892958 CET	65490	49560	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:09.842024088 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:11.675934076 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:11.857522011 CET	65490	49560	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:11.857724905 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:15.835906029 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:16.022150993 CET	65490	49560	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:16.022536039 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:24.027879000 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:24.209516048 CET	65490	49560	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:24.209852934 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:40.155200958 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:40.336970091 CET	65490	49560	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:40.337224960 CET	49560	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:43.680531979 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:43.865206003 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:43.865499973 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:43.868412018 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:44.052923918 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:54.243400097 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:54.243629932 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:51:54.428302050 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:51:54.428379059 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:52:54.249815941 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:52:54.250097990 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:52:54.434770107 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:52:54.434885025 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:53:54.256870985 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:53:54.256933928 CET	49562	65490	192.168.2.15	193.35.18.56
Mar 29, 2024 09:53:54.443840981 CET	65490	49562	193.35.18.56	192.168.2.15
Mar 29, 2024 09:53:54.443892956 CET	49562	65490	192.168.2.15	193.35.18.56

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 09:53:53.887279034 CET	41444	53	192.168.2.15	1.1.1.1
Mar 29, 2024 09:53:53.887331009 CET	49808	53	192.168.2.15	1.1.1.1
Mar 29, 2024 09:53:53.984335899 CET	53	41444	1.1.1.1	192.168.2.15
Mar 29, 2024 09:53:53.984596014 CET	53	49808	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 09:53:53.887279034 CET	192.168.2.15	1.1.1.1	0xc9a2	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 09:53:53.887331009 CET	192.168.2.15	1.1.1.1	0x2af7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 09:53:53.984335899 CET	1.1.1.1	192.168.2.15	0xc9a2	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Mar 29, 2024 09:53:53.984335899 CET	1.1.1.1	192.168.2.15	0xc9a2	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: OkTC3AlPZZ.elf PID: 5528, Parent PID: 5451

General

Start time (UTC):	08:51:07
Start date (UTC):	29/03/2024
Path:	/tmp/OkTC3AlPZZ.elf
Arguments:	/tmp/OkTC3AlPZZ.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: OkTC3AlPZZ.elf PID: 5530, Parent PID: 5528

General

Start time (UTC):	08:51:08
Start date (UTC):	29/03/2024
Path:	/tmp/OkTC3AlPZZ.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: OkTC3AlPZZ.elf PID: 5532, Parent PID: 5530

General

Start time (UTC):	08:51:08
Start date (UTC):	29/03/2024
Path:	/tmp/OkTC3AlPZZ.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report OkTC3AlPZZ.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: OkTC3AlPZZ.elf PID: 5528, Parent PID: 5451

General

Chronological Activities

Analysis Process: OkTC3AlPZZ.elf PID: 5530, Parent PID: 5528

General

Chronological Activities

Analysis Process: OkTC3AlPZZ.elf PID: 5532, Parent PID: 5530

General

Linux Analysis Report
OkTC3AlPZZ.elf