Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Linux Analysis Report rEwoho1ZZp

Overview

General Information

Sample Name:rEwoho1ZZp
Analysis ID:553321
MD5:4551d1b6498e7221a47926b43f93190a
SHA1:49d569d9953ccc8f65d9f65f5e71d91ed05a31e2
SHA256:e6329513b10f29003a9431a0df38bccf7935679b24b3f6905f3d869647c53043
Tags:elf
Infos:

Detection

Mirai Moobot
Score:88
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara detected Moobot
Sample deletes itself
Contains symbols with names commonly found in malware
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures
All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work
Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:553321
Start date:14.01.2022
Start time:17:00:14
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 28s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:rEwoho1ZZp
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal88.troj.evad.lin@0/0@1/0

Process Tree

  • system is lnxubuntu20
  • rEwoho1ZZp (PID: 5223, Parent: 5117, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/rEwoho1ZZp
  • cleanup

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
rEwoho1ZZpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
  • 0x15aa4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x15b14:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x15b84:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x15bf4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x15c64:$xo1: oMXKNNC\x0D\x17\x0C\x12
rEwoho1ZZpJoeSecurity_MoobotYara detected MoobotJoe Security
    rEwoho1ZZpJoeSecurity_Mirai_8Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      5223.1.0000000096931fd9.00000000c1d9a2ff.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
      • 0x3960:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x39d8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3a50:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3ac8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x3b40:$xo1: oMXKNNC\x0D\x17\x0C\x12
      5223.1.00000000c3675780.000000005050d10e.r-x.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
      • 0x15aa4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x15b14:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x15b84:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x15bf4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x15c64:$xo1: oMXKNNC\x0D\x17\x0C\x12
      5223.1.00000000c3675780.000000005050d10e.r-x.sdmpJoeSecurity_MoobotYara detected MoobotJoe Security

        Jbx Signature Overview

        Click to jump to signature section

        Show All Signature Results

        AV Detection:

        barindex
        Antivirus / Scanner detection for submitted sampleShow sources
        Source: rEwoho1ZZpAvira: detected
        Multi AV Scanner detection for submitted fileShow sources
        Source: rEwoho1ZZpVirustotal: Detection: 53%Perma Link
        Source: rEwoho1ZZpMetadefender: Detection: 37%Perma Link
        Source: rEwoho1ZZpReversingLabs: Detection: 70%

        Networking:

        barindex
        Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
        Source: TrafficSnort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39404 -> 209.141.53.247:55650
        Source: TrafficSnort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 209.141.53.247:55650 -> 192.168.2.23:39404
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:39404 -> 209.141.53.247:55650
        Source: /tmp/rEwoho1ZZp (PID: 5223)Socket: 127.0.0.1::6628
        Source: unknownDNS traffic detected: queries for: smellyoulater.onthewifi.com
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42

        System Summary:

        barindex
        Contains symbols with names commonly found in malwareShow sources
        Source: ELF static info symbol of initial sampleName: attack.c
        Source: ELF static info symbol of initial sampleName: attack_app_http
        Source: ELF static info symbol of initial sampleName: attack_get_opt_int
        Source: ELF static info symbol of initial sampleName: attack_get_opt_ip
        Source: ELF static info symbol of initial sampleName: attack_get_opt_str
        Source: ELF static info symbol of initial sampleName: attack_gre_eth
        Source: ELF static info symbol of initial sampleName: attack_gre_ip
        Source: ELF static info symbol of initial sampleName: attack_icmpecho
        Source: ELF static info symbol of initial sampleName: attack_init
        Source: ELF static info symbol of initial sampleName: attack_method_ovh
        Source: rEwoho1ZZp, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 5223.1.0000000096931fd9.00000000c1d9a2ff.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: 5223.1.00000000c3675780.000000005050d10e.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
        Source: classification engineClassification label: mal88.troj.evad.lin@0/0@1/0
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/5145/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/5145/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/5145/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/5145/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/5145/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/5145/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1582/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1582/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1582/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1582/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1582/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1582/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/3088/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/3088/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/3088/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/3088/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/3088/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/3088/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/230/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/110/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/231/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/111/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/232/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1579/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1579/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1579/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1579/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1579/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1579/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/112/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/233/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1699/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1699/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1699/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1699/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1699/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1699/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/113/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/234/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1335/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1335/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1335/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1335/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1335/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1335/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1698/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1698/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1698/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1698/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1698/maps
        Source: /tmp/rEwoho1ZZp (PID: 5225)File opened: /proc/1698/maps

        Hooking and other Techniques for Hiding and Protection:

        barindex
        Sample deletes itselfShow sources
        Source: /tmp/rEwoho1ZZp (PID: 5223)File: /tmp/rEwoho1ZZpJump to behavior
        Source: /tmp/rEwoho1ZZp (PID: 5223)Queries kernel information via 'uname':
        Source: rEwoho1ZZp, 5223.1.00000000c72745f9.000000000a9504d8.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
        Source: rEwoho1ZZp, 5223.1.000000003f7d3e23.00000000cba6bdfa.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/rEwoho1ZZpSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/rEwoho1ZZp
        Source: rEwoho1ZZp, 5223.1.00000000c72745f9.000000000a9504d8.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: rEwoho1ZZp, 5223.1.000000003f7d3e23.00000000cba6bdfa.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

        Stealing of Sensitive Information:

        barindex
        Yara detected MiraiShow sources
        Source: Yara matchFile source: rEwoho1ZZp, type: SAMPLE
        Yara detected MoobotShow sources
        Source: Yara matchFile source: rEwoho1ZZp, type: SAMPLE
        Source: Yara matchFile source: 5223.1.00000000c3675780.000000005050d10e.r-x.sdmp, type: MEMORY

        Remote Access Functionality:

        barindex
        Yara detected MiraiShow sources
        Source: Yara matchFile source: rEwoho1ZZp, type: SAMPLE
        Yara detected MoobotShow sources
        Source: Yara matchFile source: rEwoho1ZZp, type: SAMPLE
        Source: Yara matchFile source: 5223.1.00000000c3675780.000000005050d10e.r-x.sdmp, type: MEMORY

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionFile Deletion1OS Credential Dumping1Security Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol2SIM Card SwapCarrier Billing Fraud

        Malware Configuration

        No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        rEwoho1ZZp53%VirustotalBrowse
        rEwoho1ZZp37%MetadefenderBrowse
        rEwoho1ZZp70%ReversingLabsLinux.Trojan.Mirai
        rEwoho1ZZp100%AviraLINUX/Mirai.bonb

        Dropped Files

        No Antivirus matches

        Domains

        SourceDetectionScannerLabelLink
        smellyoulater.onthewifi.com1%VirustotalBrowse

        URLs

        No Antivirus matches

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        smellyoulater.onthewifi.com
        		209.141.53.247
        		truetrueunknown

        Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public

        IPDomainCountryFlagASNASN NameMalicious
        209.141.53.247
        		smellyoulater.onthewifi.comUnited States
        		53667PONYNETUStrue
        109.202.202.202
        		unknownSwitzerland
        		13030INIT7CHfalse
        91.189.91.43
        		unknownUnited Kingdom
        		41231CANONICAL-ASGBfalse
        91.189.91.42
        		unknownUnited Kingdom
        		41231CANONICAL-ASGBfalse


        Runtime Messages

        Command:/tmp/rEwoho1ZZp
        Exit Code:0
        Exit Code Info:
        Killed:False
        Standard Output:
        listening to tun0
        Standard Error:

        Joe Sandbox View / Context

        IPs

        No context

        Domains

        No context

        ASN

        No context

        JA3 Fingerprints

        No context

        Dropped Files

        No context

        Created / dropped Files

        No created / dropped files found

        Static File Info

        General

        File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
        Entropy (8bit):6.00226662195754
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:rEwoho1ZZp
        File size:153493
        MD5:4551d1b6498e7221a47926b43f93190a
        SHA1:49d569d9953ccc8f65d9f65f5e71d91ed05a31e2
        SHA256:e6329513b10f29003a9431a0df38bccf7935679b24b3f6905f3d869647c53043
        SHA512:34f80789689c86f1e7d21f1c7970d72ff1366364c75e3db77770032f7f8b395bae2e105dfe87f3a379151ac6be40c49d563a018c9d2594ce96b7b856ca970580
        SSDEEP:3072:xjBBb4dj2DN+a5GIfgpjJCrDbzRz++bU0WM/9kZcg:xjr4dj2p+a5GIfgp1CX5++AxM/92cg
        File Content Preview:.ELF..............(.........4...X.......4. ...(........pPm..P...P...................................hn..hn...............p...p...p.......3...............p...p...p..................Q.td..................................-...L..................@-.,@...0....S

        Static ELF Info

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:ARM
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - System V
        ABI Version:0
        Entry Point Address:0x8194
        Flags:0x4000002
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:5
        Section Header Offset:121432
        Section Header Size:40
        Number of Section Headers:29
        Header String Table Index:26

        Sections

        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .initPROGBITS0x80d40xd40x100x00x6AX004
        .textPROGBITS0x80f00xf00x1544c0x00x6AX0016
        .finiPROGBITS0x1d53c0x1553c0x100x00x6AX004
        .rodataPROGBITS0x1d5500x155500x17e80x00x2A008
        .ARM.extabPROGBITS0x1ed380x16d380x180x00x2A004
        .ARM.exidxARM_EXIDX0x1ed500x16d500x1180x00x82AL204
        .eh_framePROGBITS0x270000x170000x40x00x3WA004
        .tbssNOBITS0x270040x170040x80x00x403WAT004
        .init_arrayINIT_ARRAY0x270040x170040x40x00x3WA004
        .fini_arrayFINI_ARRAY0x270080x170080x40x00x3WA004
        .jcrPROGBITS0x2700c0x1700c0x40x00x3WA004
        .gotPROGBITS0x270100x170100xa80x40x3WA004
        .dataPROGBITS0x270b80x170b80x2080x00x3WA004
        .bssNOBITS0x272c00x172c00x30f80x00x3WA004
        .commentPROGBITS0x00x172c00xb0e0x00x0001
        .debug_arangesPROGBITS0x00x17dd00x1400x00x0008
        .debug_pubnamesPROGBITS0x00x17f100x2130x00x0001
        .debug_infoPROGBITS0x00x181230x20430x00x0001
        .debug_abbrevPROGBITS0x00x1a1660x6e20x00x0001
        .debug_linePROGBITS0x00x1a8480xe760x00x0001
        .debug_framePROGBITS0x00x1b6c00x2b80x00x0004
        .debug_strPROGBITS0x00x1b9780x8ca0x10x30MS001
        .debug_locPROGBITS0x00x1c2420x118f0x00x0001
        .debug_rangesPROGBITS0x00x1d3d10x5580x00x0001
        .ARM.attributesARM_ATTRIBUTES0x00x1d9290x160x00x0001
        .shstrtabSTRTAB0x00x1d93f0x1170x00x0001
        .symtabSYMTAB0x00x1dee00x50300x100x0287334
        .strtabSTRTAB0x00x22f100x28850x00x0001

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        EXIDX0x16d500x1ed500x1ed500x1180x1181.79010x4R 0x4.ARM.exidx
        LOAD0x00x80000x80000x16e680x16e683.38910x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
        LOAD0x170000x270000x270000x2c00x33b82.31710x6RW 0x8000.eh_frame .init_array .fini_array .jcr .got .data .bss
        TLS0x170040x270040x270040x00x80.00000x4R 0x4
        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

        Symbols

        NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
        .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        .symtab0x80d40SECTION<unknown>DEFAULT1
        .symtab0x80f00SECTION<unknown>DEFAULT2
        .symtab0x1d53c0SECTION<unknown>DEFAULT3
        .symtab0x1d5500SECTION<unknown>DEFAULT4
        .symtab0x1ed380SECTION<unknown>DEFAULT5
        .symtab0x1ed500SECTION<unknown>DEFAULT6
        .symtab0x270000SECTION<unknown>DEFAULT7
        .symtab0x270040SECTION<unknown>DEFAULT8
        .symtab0x270040SECTION<unknown>DEFAULT9
        .symtab0x270080SECTION<unknown>DEFAULT10
        .symtab0x2700c0SECTION<unknown>DEFAULT11
        .symtab0x270100SECTION<unknown>DEFAULT12
        .symtab0x270b80SECTION<unknown>DEFAULT13
        .symtab0x272c00SECTION<unknown>DEFAULT14
        .symtab0x00SECTION<unknown>DEFAULT15
        .symtab0x00SECTION<unknown>DEFAULT16
        .symtab0x00SECTION<unknown>DEFAULT17
        .symtab0x00SECTION<unknown>DEFAULT18
        .symtab0x00SECTION<unknown>DEFAULT19
        .symtab0x00SECTION<unknown>DEFAULT20
        .symtab0x00SECTION<unknown>DEFAULT21
        .symtab0x00SECTION<unknown>DEFAULT22
        .symtab0x00SECTION<unknown>DEFAULT23
        .symtab0x00SECTION<unknown>DEFAULT24
        .symtab0x00SECTION<unknown>DEFAULT25
        $a.symtab0x80d40NOTYPE<unknown>DEFAULT1
        $a.symtab0x1d53c0NOTYPE<unknown>DEFAULT3
        $a.symtab0x80e00NOTYPE<unknown>DEFAULT1
        $a.symtab0x1d5480NOTYPE<unknown>DEFAULT3
        $a.symtab0x80f00NOTYPE<unknown>DEFAULT2
        $a.symtab0x81340NOTYPE<unknown>DEFAULT2
        $a.symtab0x81940NOTYPE<unknown>DEFAULT2
        $a.symtab0x81d00NOTYPE<unknown>DEFAULT2
        $a.symtab0x822c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x83280NOTYPE<unknown>DEFAULT2
        $a.symtab0x85440NOTYPE<unknown>DEFAULT2
        $a.symtab0x85b00NOTYPE<unknown>DEFAULT2
        $a.symtab0x86200NOTYPE<unknown>DEFAULT2
        $a.symtab0x8a040NOTYPE<unknown>DEFAULT2
        $a.symtab0x8d380NOTYPE<unknown>DEFAULT2
        $a.symtab0x98640NOTYPE<unknown>DEFAULT2
        $a.symtab0xa79c0NOTYPE<unknown>DEFAULT2
        $a.symtab0xaa580NOTYPE<unknown>DEFAULT2
        $a.symtab0xaea40NOTYPE<unknown>DEFAULT2
        $a.symtab0xb3a40NOTYPE<unknown>DEFAULT2
        $a.symtab0xba4c0NOTYPE<unknown>DEFAULT2
        $a.symtab0xc0800NOTYPE<unknown>DEFAULT2
        $a.symtab0xc2b00NOTYPE<unknown>DEFAULT2
        $a.symtab0xc7580NOTYPE<unknown>DEFAULT2
        $a.symtab0xc9b80NOTYPE<unknown>DEFAULT2
        $a.symtab0xd1740NOTYPE<unknown>DEFAULT2
        $a.symtab0xd8700NOTYPE<unknown>DEFAULT2
        $a.symtab0xdfd00NOTYPE<unknown>DEFAULT2
        $a.symtab0xe6800NOTYPE<unknown>DEFAULT2
        $a.symtab0xe6d00NOTYPE<unknown>DEFAULT2
        $a.symtab0xe73c0NOTYPE<unknown>DEFAULT2
        $a.symtab0xe7e00NOTYPE<unknown>DEFAULT2
        $a.symtab0xed680NOTYPE<unknown>DEFAULT2
        $a.symtab0xf0800NOTYPE<unknown>DEFAULT2
        $a.symtab0xf0bc0NOTYPE<unknown>DEFAULT2
        $a.symtab0xf0d40NOTYPE<unknown>DEFAULT2
        $a.symtab0xf2380NOTYPE<unknown>DEFAULT2
        $a.symtab0xf2bc0NOTYPE<unknown>DEFAULT2
        $a.symtab0xfa680NOTYPE<unknown>DEFAULT2
        $a.symtab0xfac40NOTYPE<unknown>DEFAULT2
        $a.symtab0xfb2c0NOTYPE<unknown>DEFAULT2
        $a.symtab0xfc680NOTYPE<unknown>DEFAULT2
        $a.symtab0xfd440NOTYPE<unknown>DEFAULT2
        $a.symtab0xfd6c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x102740NOTYPE<unknown>DEFAULT2
        $a.symtab0x102980NOTYPE<unknown>DEFAULT2
        $a.symtab0x103380NOTYPE<unknown>DEFAULT2
        $a.symtab0x103d80NOTYPE<unknown>DEFAULT2
        $a.symtab0x10cc40NOTYPE<unknown>DEFAULT2
        $a.symtab0x10cec0NOTYPE<unknown>DEFAULT2
        $a.symtab0x10d340NOTYPE<unknown>DEFAULT2
        $a.symtab0x10d580NOTYPE<unknown>DEFAULT2
        $a.symtab0x10d7c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x10de80NOTYPE<unknown>DEFAULT2
        $a.symtab0x10f240NOTYPE<unknown>DEFAULT2
        $a.symtab0x10f800NOTYPE<unknown>DEFAULT2
        $a.symtab0x110140NOTYPE<unknown>DEFAULT2
        $a.symtab0x110a40NOTYPE<unknown>DEFAULT2
        $a.symtab0x111240NOTYPE<unknown>DEFAULT2
        $a.symtab0x111b80NOTYPE<unknown>DEFAULT2
        $a.symtab0x112b40NOTYPE<unknown>DEFAULT2
        $a.symtab0x113c80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1150c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x115200NOTYPE<unknown>DEFAULT2
        $a.symtab0x115b80NOTYPE<unknown>DEFAULT2
        $a.symtab0x116ac0NOTYPE<unknown>DEFAULT2
        $a.symtab0x116c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x117a00NOTYPE<unknown>DEFAULT2
        $a.symtab0x117d80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1181c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1185c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x118a00NOTYPE<unknown>DEFAULT2
        $a.symtab0x119240NOTYPE<unknown>DEFAULT2
        $a.symtab0x119640NOTYPE<unknown>DEFAULT2
        $a.symtab0x119f00NOTYPE<unknown>DEFAULT2
        $a.symtab0x11a200NOTYPE<unknown>DEFAULT2
        $a.symtab0x11a600NOTYPE<unknown>DEFAULT2
        $a.symtab0x11b700NOTYPE<unknown>DEFAULT2
        $a.symtab0x11c400NOTYPE<unknown>DEFAULT2
        $a.symtab0x11d040NOTYPE<unknown>DEFAULT2
        $a.symtab0x11db40NOTYPE<unknown>DEFAULT2
        $a.symtab0x11e9c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x11ebc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x11ef00NOTYPE<unknown>DEFAULT2
        $a.symtab0x11f240NOTYPE<unknown>DEFAULT2
        $a.symtab0x11ff40NOTYPE<unknown>DEFAULT2
        $a.symtab0x127c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x128600NOTYPE<unknown>DEFAULT2
        $a.symtab0x128a40NOTYPE<unknown>DEFAULT2
        $a.symtab0x12a540NOTYPE<unknown>DEFAULT2
        $a.symtab0x12aa80NOTYPE<unknown>DEFAULT2
        $a.symtab0x130180NOTYPE<unknown>DEFAULT2
        $a.symtab0x130500NOTYPE<unknown>DEFAULT2
        $a.symtab0x131100NOTYPE<unknown>DEFAULT2
        $a.symtab0x131200NOTYPE<unknown>DEFAULT2
        $a.symtab0x131300NOTYPE<unknown>DEFAULT2
        $a.symtab0x131d00NOTYPE<unknown>DEFAULT2
        $a.symtab0x132300NOTYPE<unknown>DEFAULT2
        $a.symtab0x132fc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x133f80NOTYPE<unknown>DEFAULT2
        $a.symtab0x134100NOTYPE<unknown>DEFAULT2
        $a.symtab0x1351c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x135440NOTYPE<unknown>DEFAULT2
        $a.symtab0x135880NOTYPE<unknown>DEFAULT2
        $a.symtab0x135fc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x136400NOTYPE<unknown>DEFAULT2
        $a.symtab0x136840NOTYPE<unknown>DEFAULT2
        $a.symtab0x136f80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1373c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x137840NOTYPE<unknown>DEFAULT2
        $a.symtab0x137c40NOTYPE<unknown>DEFAULT2
        $a.symtab0x138080NOTYPE<unknown>DEFAULT2
        $a.symtab0x138780NOTYPE<unknown>DEFAULT2
        $a.symtab0x138c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x139480NOTYPE<unknown>DEFAULT2
        $a.symtab0x1398c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x139fc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x13a480NOTYPE<unknown>DEFAULT2
        $a.symtab0x13ad00NOTYPE<unknown>DEFAULT2
        $a.symtab0x13b180NOTYPE<unknown>DEFAULT2
        $a.symtab0x13b5c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x13bac0NOTYPE<unknown>DEFAULT2
        $a.symtab0x13bc00NOTYPE<unknown>DEFAULT2
        $a.symtab0x13c840NOTYPE<unknown>DEFAULT2
        $a.symtab0x13cf00NOTYPE<unknown>DEFAULT2
        $a.symtab0x146a00NOTYPE<unknown>DEFAULT2
        $a.symtab0x147e00NOTYPE<unknown>DEFAULT2
        $a.symtab0x14ba00NOTYPE<unknown>DEFAULT2
        $a.symtab0x150400NOTYPE<unknown>DEFAULT2
        $a.symtab0x150800NOTYPE<unknown>DEFAULT2
        $a.symtab0x151a80NOTYPE<unknown>DEFAULT2
        $a.symtab0x151c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x152640NOTYPE<unknown>DEFAULT2
        $a.symtab0x1531c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x153dc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x154800NOTYPE<unknown>DEFAULT2
        $a.symtab0x155100NOTYPE<unknown>DEFAULT2
        $a.symtab0x155e80NOTYPE<unknown>DEFAULT2
        $a.symtab0x156e00NOTYPE<unknown>DEFAULT2
        $a.symtab0x157cc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x157ec0NOTYPE<unknown>DEFAULT2
        $a.symtab0x158080NOTYPE<unknown>DEFAULT2
        $a.symtab0x159e00NOTYPE<unknown>DEFAULT2
        $a.symtab0x15aa40NOTYPE<unknown>DEFAULT2
        $a.symtab0x15bf00NOTYPE<unknown>DEFAULT2
        $a.symtab0x162140NOTYPE<unknown>DEFAULT2
        $a.symtab0x162640NOTYPE<unknown>DEFAULT2
        $a.symtab0x166300NOTYPE<unknown>DEFAULT2
        $a.symtab0x166c80NOTYPE<unknown>DEFAULT2
        $a.symtab0x167100NOTYPE<unknown>DEFAULT2
        $a.symtab0x168000NOTYPE<unknown>DEFAULT2
        $a.symtab0x169340NOTYPE<unknown>DEFAULT2
        $a.symtab0x1698c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x169940NOTYPE<unknown>DEFAULT2
        $a.symtab0x169c40NOTYPE<unknown>DEFAULT2
        $a.symtab0x16a1c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x16a240NOTYPE<unknown>DEFAULT2
        $a.symtab0x16a540NOTYPE<unknown>DEFAULT2
        $a.symtab0x16aac0NOTYPE<unknown>DEFAULT2
        $a.symtab0x16ab40NOTYPE<unknown>DEFAULT2
        $a.symtab0x16ae40NOTYPE<unknown>DEFAULT2
        $a.symtab0x16b3c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x16b440NOTYPE<unknown>DEFAULT2
        $a.symtab0x16b700NOTYPE<unknown>DEFAULT2
        $a.symtab0x16bf80NOTYPE<unknown>DEFAULT2
        $a.symtab0x16cd40NOTYPE<unknown>DEFAULT2
        $a.symtab0x16d940NOTYPE<unknown>DEFAULT2
        $a.symtab0x16de80NOTYPE<unknown>DEFAULT2
        $a.symtab0x16e400NOTYPE<unknown>DEFAULT2
        $a.symtab0x1722c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x172a80NOTYPE<unknown>DEFAULT2
        $a.symtab0x172d40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1735c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x173640NOTYPE<unknown>DEFAULT2
        $a.symtab0x173700NOTYPE<unknown>DEFAULT2
        $a.symtab0x173800NOTYPE<unknown>DEFAULT2
        $a.symtab0x173900NOTYPE<unknown>DEFAULT2
        $a.symtab0x173d00NOTYPE<unknown>DEFAULT2
        $a.symtab0x174380NOTYPE<unknown>DEFAULT2
        $a.symtab0x1749c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1753c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x175680NOTYPE<unknown>DEFAULT2
        $a.symtab0x1757c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x175900NOTYPE<unknown>DEFAULT2
        $a.symtab0x175a40NOTYPE<unknown>DEFAULT2
        $a.symtab0x175cc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x176040NOTYPE<unknown>DEFAULT2
        $a.symtab0x176440NOTYPE<unknown>DEFAULT2
        $a.symtab0x176580NOTYPE<unknown>DEFAULT2
        $a.symtab0x1769c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x176dc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1771c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1777c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x177e80NOTYPE<unknown>DEFAULT2
        $a.symtab0x177fc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x179740NOTYPE<unknown>DEFAULT2
        $a.symtab0x17a600NOTYPE<unknown>DEFAULT2
        $a.symtab0x17e040NOTYPE<unknown>DEFAULT2
        $a.symtab0x17e580NOTYPE<unknown>DEFAULT2
        $a.symtab0x17e7c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x17f380NOTYPE<unknown>DEFAULT2
        $a.symtab0x182680NOTYPE<unknown>DEFAULT2
        $a.symtab0x182880NOTYPE<unknown>DEFAULT2
        $a.symtab0x186e80NOTYPE<unknown>DEFAULT2
        $a.symtab0x188280NOTYPE<unknown>DEFAULT2
        $a.symtab0x188a80NOTYPE<unknown>DEFAULT2
        $a.symtab0x18a0c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x18ae80NOTYPE<unknown>DEFAULT2
        $a.symtab0x18b180NOTYPE<unknown>DEFAULT2
        $a.symtab0x18b8c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x18bb80NOTYPE<unknown>DEFAULT2
        $a.symtab0x18d140NOTYPE<unknown>DEFAULT2
        $a.symtab0x195080NOTYPE<unknown>DEFAULT2
        $a.symtab0x1964c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x197680NOTYPE<unknown>DEFAULT2
        $a.symtab0x19a180NOTYPE<unknown>DEFAULT2
        $a.symtab0x19dc40NOTYPE<unknown>DEFAULT2
        $a.symtab0x19ef00NOTYPE<unknown>DEFAULT2
        $a.symtab0x19f900NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a4200NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a4400NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a5300NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a6100NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a7000NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a7ec0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a8300NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a8800NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a8cc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a8f00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1a96c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1aa640NOTYPE<unknown>DEFAULT2
        $a.symtab0x1aadc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ab440NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ad980NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ada40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1addc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ae340NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ae8c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ae980NOTYPE<unknown>DEFAULT2
        $a.symtab0x1afe00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b0040NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b1c40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b21c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b2f80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b3c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b3f00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b4940NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b4d00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b4f40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b5340NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b5a40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1b9c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1be5c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1bf9c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1bff00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c03c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c0880NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c0900NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c0940NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c0c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c0cc0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c0d80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c2f80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c4480NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c4640NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c4c40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c5300NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c5e80NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c6080NOTYPE<unknown>DEFAULT2
        $a.symtab0x1c74c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1cc940NOTYPE<unknown>DEFAULT2
        $a.symtab0x1cc9c0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1cca40NOTYPE<unknown>DEFAULT2
        $a.symtab0x1ccac0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1cd680NOTYPE<unknown>DEFAULT2
        $a.symtab0x1cdac0NOTYPE<unknown>DEFAULT2
        $a.symtab0x1d4c00NOTYPE<unknown>DEFAULT2
        $a.symtab0x1d5080NOTYPE<unknown>DEFAULT2
        $d.symtab0x81280NOTYPE<unknown>DEFAULT2
        $d.symtab0x270080NOTYPE<unknown>DEFAULT10
        $d.symtab0x81800NOTYPE<unknown>DEFAULT2
        $d.symtab0x270040NOTYPE<unknown>DEFAULT9
        $d.symtab0x81c40NOTYPE<unknown>DEFAULT2
        $d.symtab0x83200NOTYPE<unknown>DEFAULT2
        $d.symtab0x89cc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x8d240NOTYPE<unknown>DEFAULT2
        $d.symtab0x98240NOTYPE<unknown>DEFAULT2
        $d.symtab0xaea00NOTYPE<unknown>DEFAULT2
        $d.symtab0xb3a00NOTYPE<unknown>DEFAULT2
        $d.symtab0xba480NOTYPE<unknown>DEFAULT2
        $d.symtab0xc07c0NOTYPE<unknown>DEFAULT2
        $d.symtab0xc2a00NOTYPE<unknown>DEFAULT2
        $d.symtab0xc7500NOTYPE<unknown>DEFAULT2
        $d.symtab0xc9b00NOTYPE<unknown>DEFAULT2
        $d.symtab0xd1700NOTYPE<unknown>DEFAULT2
        $d.symtab0xd86c0NOTYPE<unknown>DEFAULT2
        $d.symtab0xdfcc0NOTYPE<unknown>DEFAULT2
        $d.symtab0xe67c0NOTYPE<unknown>DEFAULT2
        $d.symtab0xed640NOTYPE<unknown>DEFAULT2
        $d.symtab0xf0180NOTYPE<unknown>DEFAULT2
        $d.symtab0xf0cc0NOTYPE<unknown>DEFAULT2
        $d.symtab0xf22c0NOTYPE<unknown>DEFAULT2
        $d.symtab0xf2b40NOTYPE<unknown>DEFAULT2
        $d.symtab0xfa2c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x270b80NOTYPE<unknown>DEFAULT13
        $d.symtab0x270bc0NOTYPE<unknown>DEFAULT13
        $d.symtab0x270c00NOTYPE<unknown>DEFAULT13
        $d.symtab0x270c40NOTYPE<unknown>DEFAULT13
        $d.symtab0xfab40NOTYPE<unknown>DEFAULT2
        $d.symtab0xfb1c0NOTYPE<unknown>DEFAULT2
        $d.symtab0xfc500NOTYPE<unknown>DEFAULT2
        $d.symtab0xfd340NOTYPE<unknown>DEFAULT2
        $d.symtab0x102940NOTYPE<unknown>DEFAULT2
        $d.symtab0x103300NOTYPE<unknown>DEFAULT2
        $d.symtab0x103d00NOTYPE<unknown>DEFAULT2
        $d.symtab0x10be00NOTYPE<unknown>DEFAULT2
        $d.symtab0x270c80NOTYPE<unknown>DEFAULT13
        $d.symtab0x00NOTYPE<unknown>DEFAULT21
        $d.symtab0x200NOTYPE<unknown>DEFAULT21
        $d.symtab0x260NOTYPE<unknown>DEFAULT21
        $d.symtab0x2c0NOTYPE<unknown>DEFAULT21
        $d.symtab0x4c0NOTYPE<unknown>DEFAULT21
        $d.symtab0x530NOTYPE<unknown>DEFAULT21
        $d.symtab0x115b00NOTYPE<unknown>DEFAULT2
        $d.symtab0x1169c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x117900NOTYPE<unknown>DEFAULT2
        $d.symtab0x117d40NOTYPE<unknown>DEFAULT2
        $d.symtab0x118180NOTYPE<unknown>DEFAULT2
        $d.symtab0x118580NOTYPE<unknown>DEFAULT2
        $d.symtab0x1189c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1191c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x119600NOTYPE<unknown>DEFAULT2
        $d.symtab0x119ec0NOTYPE<unknown>DEFAULT2
        $d.symtab0x11a5c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x11b540NOTYPE<unknown>DEFAULT2
        $d.symtab0x11c380NOTYPE<unknown>DEFAULT2
        $d.symtab0x11cf80NOTYPE<unknown>DEFAULT2
        $d.symtab0x11dac0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1dcdc0NOTYPE<unknown>DEFAULT4
        $d.symtab0x11e880NOTYPE<unknown>DEFAULT2
        $d.symtab0x11eb80NOTYPE<unknown>DEFAULT2
        $d.symtab0x11eec0NOTYPE<unknown>DEFAULT2
        $d.symtab0x11fec0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1279c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1dd1c0NOTYPE<unknown>DEFAULT4
        $d.symtab0x12a500NOTYPE<unknown>DEFAULT2
        $d.symtab0x12a9c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x12fe80NOTYPE<unknown>DEFAULT2
        $d.symtab0x270cc0NOTYPE<unknown>DEFAULT13
        $d.symtab0x1dd240NOTYPE<unknown>DEFAULT4
        $d.symtab0x131080NOTYPE<unknown>DEFAULT2
        $d.symtab0x132f40NOTYPE<unknown>DEFAULT2
        $d.symtab0x1350c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1dda80NOTYPE<unknown>DEFAULT4
        $d.symtab0x135800NOTYPE<unknown>DEFAULT2
        $d.symtab0x135f40NOTYPE<unknown>DEFAULT2
        $d.symtab0x136380NOTYPE<unknown>DEFAULT2
        $d.symtab0x1367c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x136f00NOTYPE<unknown>DEFAULT2
        $d.symtab0x137340NOTYPE<unknown>DEFAULT2
        $d.symtab0x1377c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x137c00NOTYPE<unknown>DEFAULT2
        $d.symtab0x138000NOTYPE<unknown>DEFAULT2
        $d.symtab0x138700NOTYPE<unknown>DEFAULT2
        $d.symtab0x138bc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x139400NOTYPE<unknown>DEFAULT2
        $d.symtab0x139840NOTYPE<unknown>DEFAULT2
        $d.symtab0x139f40NOTYPE<unknown>DEFAULT2
        $d.symtab0x13a400NOTYPE<unknown>DEFAULT2
        $d.symtab0x13ac80NOTYPE<unknown>DEFAULT2
        $d.symtab0x13b100NOTYPE<unknown>DEFAULT2
        $d.symtab0x13b540NOTYPE<unknown>DEFAULT2
        $d.symtab0x13ba80NOTYPE<unknown>DEFAULT2
        $d.symtab0x13c780NOTYPE<unknown>DEFAULT2
        $d.symtab0x1467c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x270d00NOTYPE<unknown>DEFAULT13
        $d.symtab0x147c40NOTYPE<unknown>DEFAULT2
        $d.symtab0x14b800NOTYPE<unknown>DEFAULT2
        $d.symtab0x150240NOTYPE<unknown>DEFAULT2
        $d.symtab0x150780NOTYPE<unknown>DEFAULT2
        $d.symtab0x151940NOTYPE<unknown>DEFAULT2
        $d.symtab0x270e80NOTYPE<unknown>DEFAULT13
        $d.symtab0x152480NOTYPE<unknown>DEFAULT2
        $d.symtab0x153000NOTYPE<unknown>DEFAULT2
        $d.symtab0x153c00NOTYPE<unknown>DEFAULT2
        $d.symtab0x154640NOTYPE<unknown>DEFAULT2
        $d.symtab0x271000NOTYPE<unknown>DEFAULT13
        $d.symtab0x271980NOTYPE<unknown>DEFAULT13
        $d.symtab0x1550c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x155dc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x156d00NOTYPE<unknown>DEFAULT2
        $d.symtab0x157c00NOTYPE<unknown>DEFAULT2
        $d.symtab0x1e9140NOTYPE<unknown>DEFAULT4
        $d.symtab0x159d00NOTYPE<unknown>DEFAULT2
        $d.symtab0x15a840NOTYPE<unknown>DEFAULT2
        $d.symtab0x271ac0NOTYPE<unknown>DEFAULT13
        $d.symtab0x15bcc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x161e80NOTYPE<unknown>DEFAULT2
        $d.symtab0x162600NOTYPE<unknown>DEFAULT2
        $d.symtab0x166080NOTYPE<unknown>DEFAULT2
        $d.symtab0x167f40NOTYPE<unknown>DEFAULT2
        $d.symtab0x169200NOTYPE<unknown>DEFAULT2
        $d.symtab0x169300NOTYPE<unknown>DEFAULT2
        $d.symtab0x169c00NOTYPE<unknown>DEFAULT2
        $d.symtab0x16a500NOTYPE<unknown>DEFAULT2
        $d.symtab0x16ae00NOTYPE<unknown>DEFAULT2
        $d.symtab0x16ccc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x16d800NOTYPE<unknown>DEFAULT2
        $d.symtab0x16de00NOTYPE<unknown>DEFAULT2
        $d.symtab0x16e340NOTYPE<unknown>DEFAULT2
        $d.symtab0x171e00NOTYPE<unknown>DEFAULT2
        $d.symtab0x271c40NOTYPE<unknown>DEFAULT13
        $d.symtab0x172a00NOTYPE<unknown>DEFAULT2
        $d.symtab0x172d00NOTYPE<unknown>DEFAULT2
        $d.symtab0x173500NOTYPE<unknown>DEFAULT2
        $d.symtab0x173cc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x174300NOTYPE<unknown>DEFAULT2
        $d.symtab0x174980NOTYPE<unknown>DEFAULT2
        $d.symtab0x175380NOTYPE<unknown>DEFAULT2
        $d.symtab0x175c40NOTYPE<unknown>DEFAULT2
        $d.symtab0x176000NOTYPE<unknown>DEFAULT2
        $d.symtab0x176400NOTYPE<unknown>DEFAULT2
        $d.symtab0x176980NOTYPE<unknown>DEFAULT2
        $d.symtab0x176d80NOTYPE<unknown>DEFAULT2
        $d.symtab0x177180NOTYPE<unknown>DEFAULT2
        $d.symtab0x177740NOTYPE<unknown>DEFAULT2
        $d.symtab0x177e00NOTYPE<unknown>DEFAULT2
        $d.symtab0x17a4c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x17dfc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x17f340NOTYPE<unknown>DEFAULT2
        $d.symtab0x182580NOTYPE<unknown>DEFAULT2
        $d.symtab0x186b40NOTYPE<unknown>DEFAULT2
        $d.symtab0x188980NOTYPE<unknown>DEFAULT2
        $d.symtab0x189f00NOTYPE<unknown>DEFAULT2
        $d.symtab0x271dc0NOTYPE<unknown>DEFAULT13
        $d.symtab0x271d80NOTYPE<unknown>DEFAULT13
        $d.symtab0x18ae40NOTYPE<unknown>DEFAULT2
        $d.symtab0x194e80NOTYPE<unknown>DEFAULT2
        $d.symtab0x1ecf00NOTYPE<unknown>DEFAULT4
        $d.symtab0x199fc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x19dac0NOTYPE<unknown>DEFAULT2
        $d.symtab0x19ee80NOTYPE<unknown>DEFAULT2
        $d.symtab0x1a5280NOTYPE<unknown>DEFAULT2
        $d.symtab0x1a6080NOTYPE<unknown>DEFAULT2
        $d.symtab0x1a6f80NOTYPE<unknown>DEFAULT2
        $d.symtab0x1a7e40NOTYPE<unknown>DEFAULT2
        $d.symtab0x1a9680NOTYPE<unknown>DEFAULT2
        $d.symtab0x1aa5c0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1aac40NOTYPE<unknown>DEFAULT2
        $d.symtab0x1ab340NOTYPE<unknown>DEFAULT2
        $d.symtab0x1ad700NOTYPE<unknown>DEFAULT2
        $d.symtab0x1add00NOTYPE<unknown>DEFAULT2
        $d.symtab0x1ae800NOTYPE<unknown>DEFAULT2
        $d.symtab0x1afd80NOTYPE<unknown>DEFAULT2
        $d.symtab0x1b1c00NOTYPE<unknown>DEFAULT2
        $d.symtab0x1b2f40NOTYPE<unknown>DEFAULT2
        $d.symtab0x1b3bc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1b4900NOTYPE<unknown>DEFAULT2
        $d.symtab0x1b5a00NOTYPE<unknown>DEFAULT2
        $d.symtab0x1c2dc0NOTYPE<unknown>DEFAULT2
        $d.symtab0x1cc840NOTYPE<unknown>DEFAULT2
        $d.symtab0x580NOTYPE<unknown>DEFAULT21
        $d.symtab0x00NOTYPE<unknown>DEFAULT23
        $d.symtab0x23c0NOTYPE<unknown>DEFAULT21
        $d.symtab0xe390NOTYPE<unknown>DEFAULT23
        $d.symtab0x271d00NOTYPE<unknown>DEFAULT13
        $d.symtab0x1e9a20NOTYPE<unknown>DEFAULT4
        C.11.5548.symtab0x1e98012OBJECT<unknown>DEFAULT4
        C.5.5083.symtab0x1dcdc24OBJECT<unknown>DEFAULT4
        C.7.5370.symtab0x1e98c12OBJECT<unknown>DEFAULT4
        C.7.6078.symtab0x1dcf412OBJECT<unknown>DEFAULT4
        C.7.6109.symtab0x1ecc812OBJECT<unknown>DEFAULT4
        C.7.6182.symtab0x1eca412OBJECT<unknown>DEFAULT4
        C.8.6110.symtab0x1ecbc12OBJECT<unknown>DEFAULT4
        C.9.6119.symtab0x1ecb012OBJECT<unknown>DEFAULT4
        LOCAL_ADDR.symtab0x29dc84OBJECT<unknown>DEFAULT14
        Laligned.symtab0x131f80NOTYPE<unknown>DEFAULT2
        Llastword.symtab0x132140NOTYPE<unknown>DEFAULT2
        _Exit.symtab0x173d0104FUNC<unknown>DEFAULT2
        _GLOBAL_OFFSET_TABLE_.symtab0x270100OBJECT<unknown>HIDDEN12
        _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _Unwind_Complete.symtab0x1c0904FUNC<unknown>HIDDEN2
        _Unwind_DeleteException.symtab0x1c09444FUNC<unknown>HIDDEN2
        _Unwind_ForcedUnwind.symtab0x1cd4436FUNC<unknown>HIDDEN2
        _Unwind_GetCFA.symtab0x1c0888FUNC<unknown>HIDDEN2
        _Unwind_GetDataRelBase.symtab0x1c0cc12FUNC<unknown>HIDDEN2
        _Unwind_GetLanguageSpecificData.symtab0x1cd6868FUNC<unknown>HIDDEN2
        _Unwind_GetRegionStart.symtab0x1d50852FUNC<unknown>HIDDEN2
        _Unwind_GetTextRelBase.symtab0x1c0c012FUNC<unknown>HIDDEN2
        _Unwind_RaiseException.symtab0x1ccd836FUNC<unknown>HIDDEN2
        _Unwind_Resume.symtab0x1ccfc36FUNC<unknown>HIDDEN2
        _Unwind_Resume_or_Rethrow.symtab0x1cd2036FUNC<unknown>HIDDEN2
        _Unwind_VRS_Get.symtab0x1bff076FUNC<unknown>HIDDEN2
        _Unwind_VRS_Pop.symtab0x1c608324FUNC<unknown>HIDDEN2
        _Unwind_VRS_Set.symtab0x1c03c76FUNC<unknown>HIDDEN2
        _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __C_ctype_b.symtab0x271d04OBJECT<unknown>DEFAULT13
        __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __C_ctype_b_data.symtab0x1e9a2768OBJECT<unknown>DEFAULT4
        __EH_FRAME_BEGIN__.symtab0x270000OBJECT<unknown>DEFAULT7
        __FRAME_END__.symtab0x270000OBJECT<unknown>DEFAULT7
        __GI___C_ctype_b.symtab0x271d04OBJECT<unknown>HIDDEN13
        __GI___close.symtab0x16950100FUNC<unknown>HIDDEN2
        __GI___close_nocancel.symtab0x1693424FUNC<unknown>HIDDEN2
        __GI___ctype_b.symtab0x271d44OBJECT<unknown>HIDDEN13
        __GI___errno_location.symtab0x11e9c32FUNC<unknown>HIDDEN2
        __GI___fcntl_nocancel.symtab0x11520152FUNC<unknown>HIDDEN2
        __GI___fgetc_unlocked.symtab0x19dc4300FUNC<unknown>HIDDEN2
        __GI___glibc_strerror_r.symtab0x133f824FUNC<unknown>HIDDEN2
        __GI___libc_close.symtab0x16950100FUNC<unknown>HIDDEN2
        __GI___libc_fcntl.symtab0x115b8244FUNC<unknown>HIDDEN2
        __GI___libc_open.symtab0x169e0100FUNC<unknown>HIDDEN2
        __GI___libc_read.symtab0x16b00100FUNC<unknown>HIDDEN2
        __GI___libc_write.symtab0x16a70100FUNC<unknown>HIDDEN2
        __GI___open.symtab0x169e0100FUNC<unknown>HIDDEN2
        __GI___open_nocancel.symtab0x169c424FUNC<unknown>HIDDEN2
        __GI___read.symtab0x16b00100FUNC<unknown>HIDDEN2
        __GI___read_nocancel.symtab0x16ae424FUNC<unknown>HIDDEN2
        __GI___sigaddset.symtab0x13ca836FUNC<unknown>HIDDEN2
        __GI___sigdelset.symtab0x13ccc36FUNC<unknown>HIDDEN2
        __GI___sigismember.symtab0x13c8436FUNC<unknown>HIDDEN2
        __GI___uClibc_fini.symtab0x16d18124FUNC<unknown>HIDDEN2
        __GI___uClibc_init.symtab0x16de888FUNC<unknown>HIDDEN2
        __GI___write.symtab0x16a70100FUNC<unknown>HIDDEN2
        __GI___write_nocancel.symtab0x16a5424FUNC<unknown>HIDDEN2
        __GI___xpg_strerror_r.symtab0x13410268FUNC<unknown>HIDDEN2
        __GI__exit.symtab0x173d0104FUNC<unknown>HIDDEN2
        __GI_abort.symtab0x15080296FUNC<unknown>HIDDEN2
        __GI_accept.symtab0x13588116FUNC<unknown>HIDDEN2
        __GI_atoi.symtab0x157cc32FUNC<unknown>HIDDEN2
        __GI_bind.symtab0x135fc68FUNC<unknown>HIDDEN2
        __GI_brk.symtab0x1ae3488FUNC<unknown>HIDDEN2
        __GI_close.symtab0x16950100FUNC<unknown>HIDDEN2
        __GI_closedir.symtab0x11a60272FUNC<unknown>HIDDEN2
        __GI_config_close.symtab0x17d8852FUNC<unknown>HIDDEN2
        __GI_config_open.symtab0x17dbc72FUNC<unknown>HIDDEN2
        __GI_config_read.symtab0x17a60808FUNC<unknown>HIDDEN2
        __GI_connect.symtab0x13684116FUNC<unknown>HIDDEN2
        __GI_exit.symtab0x159e0196FUNC<unknown>HIDDEN2
        __GI_fclose.symtab0x17f38816FUNC<unknown>HIDDEN2
        __GI_fcntl.symtab0x115b8244FUNC<unknown>HIDDEN2
        __GI_fflush_unlocked.symtab0x19a18940FUNC<unknown>HIDDEN2
        __GI_fgetc.symtab0x19508324FUNC<unknown>HIDDEN2
        __GI_fgetc_unlocked.symtab0x19dc4300FUNC<unknown>HIDDEN2
        __GI_fgets.symtab0x1964c284FUNC<unknown>HIDDEN2
        __GI_fgets_unlocked.symtab0x19ef0160FUNC<unknown>HIDDEN2
        __GI_fopen.symtab0x1826832FUNC<unknown>HIDDEN2
        __GI_fork.symtab0x16264972FUNC<unknown>HIDDEN2
        __GI_fputs_unlocked.symtab0x1301856FUNC<unknown>HIDDEN2
        __GI_fseek.symtab0x1afe036FUNC<unknown>HIDDEN2
        __GI_fseeko64.symtab0x1b004448FUNC<unknown>HIDDEN2
        __GI_fstat.symtab0x17438100FUNC<unknown>HIDDEN2
        __GI_fwrite_unlocked.symtab0x13050188FUNC<unknown>HIDDEN2
        __GI_getc_unlocked.symtab0x19dc4300FUNC<unknown>HIDDEN2
        __GI_getdtablesize.symtab0x1753c44FUNC<unknown>HIDDEN2
        __GI_getegid.symtab0x1756820FUNC<unknown>HIDDEN2
        __GI_geteuid.symtab0x1757c20FUNC<unknown>HIDDEN2
        __GI_getgid.symtab0x1759020FUNC<unknown>HIDDEN2
        __GI_getpagesize.symtab0x175a440FUNC<unknown>HIDDEN2
        __GI_getpid.symtab0x166c872FUNC<unknown>HIDDEN2
        __GI_getrlimit.symtab0x175cc56FUNC<unknown>HIDDEN2
        __GI_getsockname.symtab0x136f868FUNC<unknown>HIDDEN2
        __GI_gettimeofday.symtab0x1760464FUNC<unknown>HIDDEN2
        __GI_getuid.symtab0x1764420FUNC<unknown>HIDDEN2
        __GI_inet_addr.symtab0x1351c40FUNC<unknown>HIDDEN2
        __GI_inet_aton.symtab0x1a96c248FUNC<unknown>HIDDEN2
        __GI_initstate_r.symtab0x155e8248FUNC<unknown>HIDDEN2
        __GI_ioctl.symtab0x116c0224FUNC<unknown>HIDDEN2
        __GI_isatty.symtab0x1a8cc36FUNC<unknown>HIDDEN2
        __GI_kill.symtab0x117a056FUNC<unknown>HIDDEN2
        __GI_listen.symtab0x1378464FUNC<unknown>HIDDEN2
        __GI_lseek64.symtab0x1b534112FUNC<unknown>HIDDEN2
        __GI_memchr.symtab0x1a440240FUNC<unknown>HIDDEN2
        __GI_memcpy.symtab0x131104FUNC<unknown>HIDDEN2
        __GI_memmove.symtab0x131204FUNC<unknown>HIDDEN2
        __GI_mempcpy.symtab0x1b4d036FUNC<unknown>HIDDEN2
        __GI_memrchr.symtab0x1a530224FUNC<unknown>HIDDEN2
        __GI_memset.symtab0x13130156FUNC<unknown>HIDDEN2
        __GI_mmap.symtab0x1722c124FUNC<unknown>HIDDEN2
        __GI_mremap.symtab0x1765868FUNC<unknown>HIDDEN2
        __GI_munmap.symtab0x1769c64FUNC<unknown>HIDDEN2
        __GI_nanosleep.symtab0x1771c96FUNC<unknown>HIDDEN2
        __GI_open.symtab0x169e0100FUNC<unknown>HIDDEN2
        __GI_opendir.symtab0x11c40196FUNC<unknown>HIDDEN2
        __GI_raise.symtab0x16710240FUNC<unknown>HIDDEN2
        __GI_random.symtab0x151c0164FUNC<unknown>HIDDEN2
        __GI_random_r.symtab0x15480144FUNC<unknown>HIDDEN2
        __GI_read.symtab0x16b00100FUNC<unknown>HIDDEN2
        __GI_readdir.symtab0x11db4232FUNC<unknown>HIDDEN2
        __GI_readdir64.symtab0x17974236FUNC<unknown>HIDDEN2
        __GI_readlink.symtab0x1181c64FUNC<unknown>HIDDEN2
        __GI_recv.symtab0x13808112FUNC<unknown>HIDDEN2
        __GI_recvfrom.symtab0x138c0136FUNC<unknown>HIDDEN2
        __GI_sbrk.symtab0x1777c108FUNC<unknown>HIDDEN2
        __GI_select.symtab0x118a0132FUNC<unknown>HIDDEN2
        __GI_send.symtab0x1398c112FUNC<unknown>HIDDEN2
        __GI_sendto.symtab0x13a48136FUNC<unknown>HIDDEN2
        __GI_setsid.symtab0x1192464FUNC<unknown>HIDDEN2
        __GI_setsockopt.symtab0x13ad072FUNC<unknown>HIDDEN2
        __GI_setstate_r.symtab0x156e0236FUNC<unknown>HIDDEN2
        __GI_sigaction.symtab0x172d4136FUNC<unknown>HIDDEN2
        __GI_sigaddset.symtab0x13b5c80FUNC<unknown>HIDDEN2
        __GI_sigemptyset.symtab0x13bac20FUNC<unknown>HIDDEN2
        __GI_signal.symtab0x13bc0196FUNC<unknown>HIDDEN2
        __GI_sigprocmask.symtab0x11964140FUNC<unknown>HIDDEN2
        __GI_sleep.symtab0x16800300FUNC<unknown>HIDDEN2
        __GI_socket.symtab0x13b1868FUNC<unknown>HIDDEN2
        __GI_sprintf.symtab0x11ef052FUNC<unknown>HIDDEN2
        __GI_srandom_r.symtab0x15510216FUNC<unknown>HIDDEN2
        __GI_strchr.symtab0x1a610240FUNC<unknown>HIDDEN2
        __GI_strchrnul.symtab0x1a700236FUNC<unknown>HIDDEN2
        __GI_strcmp.symtab0x1a42028FUNC<unknown>HIDDEN2
        __GI_strcoll.symtab0x1a42028FUNC<unknown>HIDDEN2
        __GI_strcspn.symtab0x1a7ec68FUNC<unknown>HIDDEN2
        __GI_strlen.symtab0x131d096FUNC<unknown>HIDDEN2
        __GI_strnlen.symtab0x13230204FUNC<unknown>HIDDEN2
        __GI_strrchr.symtab0x1a83080FUNC<unknown>HIDDEN2
        __GI_strspn.symtab0x1a88076FUNC<unknown>HIDDEN2
        __GI_strstr.symtab0x132fc252FUNC<unknown>HIDDEN2
        __GI_strtol.symtab0x157ec28FUNC<unknown>HIDDEN2
        __GI_sysconf.symtab0x15bf01572FUNC<unknown>HIDDEN2
        __GI_tcgetattr.symtab0x1a8f0124FUNC<unknown>HIDDEN2
        __GI_time.symtab0x119f048FUNC<unknown>HIDDEN2
        __GI_times.symtab0x177e820FUNC<unknown>HIDDEN2
        __GI_unlink.symtab0x11a2064FUNC<unknown>HIDDEN2
        __GI_vsnprintf.symtab0x11f24208FUNC<unknown>HIDDEN2
        __GI_wcrtomb.symtab0x17e0484FUNC<unknown>HIDDEN2
        __GI_wcsnrtombs.symtab0x17e7c188FUNC<unknown>HIDDEN2
        __GI_wcsrtombs.symtab0x17e5836FUNC<unknown>HIDDEN2
        __GI_write.symtab0x16a70100FUNC<unknown>HIDDEN2
        __JCR_END__.symtab0x2700c0OBJECT<unknown>DEFAULT11
        __JCR_LIST__.symtab0x2700c0OBJECT<unknown>DEFAULT11
        ___Unwind_ForcedUnwind.symtab0x1cd4436FUNC<unknown>HIDDEN2
        ___Unwind_RaiseException.symtab0x1ccd836FUNC<unknown>HIDDEN2
        ___Unwind_Resume.symtab0x1ccfc36FUNC<unknown>HIDDEN2
        ___Unwind_Resume_or_Rethrow.symtab0x1cd2036FUNC<unknown>HIDDEN2
        __adddf3.symtab0x1b5b0784FUNC<unknown>HIDDEN2
        __aeabi_cdcmpeq.symtab0x1bf0c24FUNC<unknown>HIDDEN2
        __aeabi_cdcmple.symtab0x1bf0c24FUNC<unknown>HIDDEN2
        __aeabi_cdrcmple.symtab0x1bef052FUNC<unknown>HIDDEN2
        __aeabi_d2uiz.symtab0x1bf9c84FUNC<unknown>HIDDEN2
        __aeabi_dadd.symtab0x1b5b0784FUNC<unknown>HIDDEN2
        __aeabi_dcmpeq.symtab0x1bf2424FUNC<unknown>HIDDEN2
        __aeabi_dcmpge.symtab0x1bf6c24FUNC<unknown>HIDDEN2
        __aeabi_dcmpgt.symtab0x1bf8424FUNC<unknown>HIDDEN2
        __aeabi_dcmple.symtab0x1bf5424FUNC<unknown>HIDDEN2
        __aeabi_dcmplt.symtab0x1bf3c24FUNC<unknown>HIDDEN2
        __aeabi_ddiv.symtab0x1bc50524FUNC<unknown>HIDDEN2
        __aeabi_dmul.symtab0x1b9c0656FUNC<unknown>HIDDEN2
        __aeabi_drsub.symtab0x1b5a40FUNC<unknown>HIDDEN2
        __aeabi_dsub.symtab0x1b5ac788FUNC<unknown>HIDDEN2
        __aeabi_f2d.symtab0x1b90c64FUNC<unknown>HIDDEN2
        __aeabi_i2d.symtab0x1b8e440FUNC<unknown>HIDDEN2
        __aeabi_idiv.symtab0x113c80FUNC<unknown>HIDDEN2
        __aeabi_idivmod.symtab0x114f424FUNC<unknown>HIDDEN2
        __aeabi_l2d.symtab0x1b96096FUNC<unknown>HIDDEN2
        __aeabi_read_tp.symtab0x173808FUNC<unknown>DEFAULT2
        __aeabi_ui2d.symtab0x1b8c036FUNC<unknown>HIDDEN2
        __aeabi_uidiv.symtab0x112b40FUNC<unknown>HIDDEN2
        __aeabi_uidivmod.symtab0x113b024FUNC<unknown>HIDDEN2
        __aeabi_ul2d.symtab0x1b94c116FUNC<unknown>HIDDEN2
        __aeabi_unwind_cpp_pr0.symtab0x1cca48FUNC<unknown>HIDDEN2
        __aeabi_unwind_cpp_pr1.symtab0x1cc9c8FUNC<unknown>HIDDEN2
        __aeabi_unwind_cpp_pr2.symtab0x1cc948FUNC<unknown>HIDDEN2
        __app_fini.symtab0x278604OBJECT<unknown>HIDDEN14
        __atexit_lock.symtab0x271ac24OBJECT<unknown>DEFAULT13
        __bss_end__.symtab0x2a3b80NOTYPE<unknown>DEFAULTSHN_ABS
        __bss_start.symtab0x272c00NOTYPE<unknown>DEFAULTSHN_ABS
        __bss_start__.symtab0x272c00NOTYPE<unknown>DEFAULTSHN_ABS
        __check_one_fd.symtab0x16d9484FUNC<unknown>DEFAULT2
        __close.symtab0x16950100FUNC<unknown>DEFAULT2
        __close_nocancel.symtab0x1693424FUNC<unknown>DEFAULT2
        __cmpdf2.symtab0x1be6c132FUNC<unknown>HIDDEN2
        __ctype_b.symtab0x271d44OBJECT<unknown>DEFAULT13
        __curbrk.symtab0x29dc44OBJECT<unknown>HIDDEN14
        __cxa_begin_cleanup.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __cxa_call_unexpected.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __cxa_type_match.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __data_start.symtab0x270b80NOTYPE<unknown>DEFAULT13
        __default_rt_sa_restorer.symtab0x173740FUNC<unknown>DEFAULT2
        __default_sa_restorer.symtab0x173680FUNC<unknown>DEFAULT2
        __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __div0.symtab0x1150c20FUNC<unknown>HIDDEN2
        __divdf3.symtab0x1bc50524FUNC<unknown>HIDDEN2
        __divsi3.symtab0x113c8300FUNC<unknown>HIDDEN2
        __do_global_dtors_aux.symtab0x80f00FUNC<unknown>DEFAULT2
        __do_global_dtors_aux_fini_array_entry.symtab0x270080OBJECT<unknown>DEFAULT10
        __end__.symtab0x2a3b80NOTYPE<unknown>DEFAULTSHN_ABS
        __environ.symtab0x278584OBJECT<unknown>DEFAULT14
        __eqdf2.symtab0x1be6c132FUNC<unknown>HIDDEN2
        __errno_location.symtab0x11e9c32FUNC<unknown>DEFAULT2
        __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __exidx_end.symtab0x1ee680NOTYPE<unknown>DEFAULTSHN_ABS
        __exidx_start.symtab0x1ed500NOTYPE<unknown>DEFAULTSHN_ABS
        __exit_cleanup.symtab0x273084OBJECT<unknown>HIDDEN14
        __extendsfdf2.symtab0x1b90c64FUNC<unknown>HIDDEN2
        __fcntl_nocancel.symtab0x11520152FUNC<unknown>DEFAULT2
        __fgetc_unlocked.symtab0x19dc4300FUNC<unknown>DEFAULT2
        __fini_array_end.symtab0x2700c0NOTYPE<unknown>HIDDEN10
        __fini_array_start.symtab0x270080NOTYPE<unknown>HIDDEN10
        __fixunsdfsi.symtab0x1bf9c84FUNC<unknown>HIDDEN2
        __floatdidf.symtab0x1b96096FUNC<unknown>HIDDEN2
        __floatsidf.symtab0x1b8e440FUNC<unknown>HIDDEN2
        __floatundidf.symtab0x1b94c116FUNC<unknown>HIDDEN2
        __floatunsidf.symtab0x1b8c036FUNC<unknown>HIDDEN2
        __fork.symtab0x16264972FUNC<unknown>DEFAULT2
        __fork_generation_pointer.symtab0x2a3844OBJECT<unknown>HIDDEN14
        __fork_handlers.symtab0x2a3884OBJECT<unknown>HIDDEN14
        __fork_lock.symtab0x2730c4OBJECT<unknown>HIDDEN14
        __frame_dummy_init_array_entry.symtab0x270040OBJECT<unknown>DEFAULT9
        __gedf2.symtab0x1be5c148FUNC<unknown>HIDDEN2
        __getdents.symtab0x1749c160FUNC<unknown>HIDDEN2
        __getdents64.symtab0x1ae98328FUNC<unknown>HIDDEN2
        __getpagesize.symtab0x175a440FUNC<unknown>DEFAULT2
        __getpid.symtab0x166c872FUNC<unknown>DEFAULT2
        __glibc_strerror_r.symtab0x133f824FUNC<unknown>DEFAULT2
        __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __gnu_Unwind_Find_exidx.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __gnu_Unwind_ForcedUnwind.symtab0x1c44828FUNC<unknown>HIDDEN2
        __gnu_Unwind_RaiseException.symtab0x1c530184FUNC<unknown>HIDDEN2
        __gnu_Unwind_Restore_VFP.symtab0x1ccc80FUNC<unknown>HIDDEN2
        __gnu_Unwind_Resume.symtab0x1c4c4108FUNC<unknown>HIDDEN2
        __gnu_Unwind_Resume_or_Rethrow.symtab0x1c5e832FUNC<unknown>HIDDEN2
        __gnu_Unwind_Save_VFP.symtab0x1ccd00FUNC<unknown>HIDDEN2
        __gnu_unwind_execute.symtab0x1cdac1812FUNC<unknown>HIDDEN2
        __gnu_unwind_frame.symtab0x1d4c072FUNC<unknown>HIDDEN2
        __gnu_unwind_pr_common.symtab0x1c74c1352FUNC<unknown>DEFAULT2
        __gtdf2.symtab0x1be5c148FUNC<unknown>HIDDEN2
        __h_errno_location.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __init_array_end.symtab0x270080NOTYPE<unknown>HIDDEN9
        __init_array_start.symtab0x270040NOTYPE<unknown>HIDDEN9
        __ledf2.symtab0x1be64140FUNC<unknown>HIDDEN2
        __libc_accept.symtab0x13588116FUNC<unknown>DEFAULT2
        __libc_close.symtab0x16950100FUNC<unknown>DEFAULT2
        __libc_connect.symtab0x13684116FUNC<unknown>DEFAULT2
        __libc_disable_asynccancel.symtab0x16b70136FUNC<unknown>HIDDEN2
        __libc_enable_asynccancel.symtab0x16bf8220FUNC<unknown>HIDDEN2
        __libc_errno.symtab0x04TLS<unknown>HIDDEN8
        __libc_fcntl.symtab0x115b8244FUNC<unknown>DEFAULT2
        __libc_fork.symtab0x16264972FUNC<unknown>DEFAULT2
        __libc_h_errno.symtab0x44TLS<unknown>HIDDEN8
        __libc_multiple_threads.symtab0x2a38c4OBJECT<unknown>HIDDEN14
        __libc_nanosleep.symtab0x1771c96FUNC<unknown>DEFAULT2
        __libc_open.symtab0x169e0100FUNC<unknown>DEFAULT2
        __libc_read.symtab0x16b00100FUNC<unknown>DEFAULT2
        __libc_recv.symtab0x13808112FUNC<unknown>DEFAULT2
        __libc_recvfrom.symtab0x138c0136FUNC<unknown>DEFAULT2
        __libc_select.symtab0x118a0132FUNC<unknown>DEFAULT2
        __libc_send.symtab0x1398c112FUNC<unknown>DEFAULT2
        __libc_sendto.symtab0x13a48136FUNC<unknown>DEFAULT2
        __libc_setup_tls.symtab0x1ab68560FUNC<unknown>DEFAULT2
        __libc_sigaction.symtab0x172d4136FUNC<unknown>DEFAULT2
        __libc_stack_end.symtab0x278544OBJECT<unknown>DEFAULT14
        __libc_write.symtab0x16a70100FUNC<unknown>DEFAULT2
        __lll_lock_wait_private.symtab0x16630152FUNC<unknown>HIDDEN2
        __ltdf2.symtab0x1be64140FUNC<unknown>HIDDEN2
        __malloc_consolidate.symtab0x14c50436FUNC<unknown>HIDDEN2
        __malloc_largebin_index.symtab0x13cf0120FUNC<unknown>DEFAULT2
        __malloc_lock.symtab0x270d024OBJECT<unknown>DEFAULT13
        __malloc_state.symtab0x2a00c888OBJECT<unknown>DEFAULT14
        __malloc_trim.symtab0x14ba0176FUNC<unknown>DEFAULT2
        __muldf3.symtab0x1b9c0656FUNC<unknown>HIDDEN2
        __nedf2.symtab0x1be6c132FUNC<unknown>HIDDEN2
        __nptl_deallocate_tsd.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __open.symtab0x169e0100FUNC<unknown>DEFAULT2
        __open_nocancel.symtab0x169c424FUNC<unknown>DEFAULT2
        __pagesize.symtab0x2785c4OBJECT<unknown>DEFAULT14
        __preinit_array_end.symtab0x270040NOTYPE<unknown>HIDDEN8
        __preinit_array_start.symtab0x270040NOTYPE<unknown>HIDDEN8
        __progname.symtab0x271c84OBJECT<unknown>DEFAULT13
        __progname_full.symtab0x271cc4OBJECT<unknown>DEFAULT13
        __pthread_initialize_minimal.symtab0x1ad9812FUNC<unknown>DEFAULT2
        __pthread_mutex_init.symtab0x16cdc8FUNC<unknown>DEFAULT2
        __pthread_mutex_lock.symtab0x16cd48FUNC<unknown>DEFAULT2
        __pthread_mutex_trylock.symtab0x16cd48FUNC<unknown>DEFAULT2
        __pthread_mutex_unlock.symtab0x16cd48FUNC<unknown>DEFAULT2
        __pthread_return_0.symtab0x16cd48FUNC<unknown>DEFAULT2
        __pthread_unwind.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __read.symtab0x16b00100FUNC<unknown>DEFAULT2
        __read_nocancel.symtab0x16ae424FUNC<unknown>DEFAULT2
        __register_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
        __restore_core_regs.symtab0x1ccac28FUNC<unknown>HIDDEN2
        __rtld_fini.symtab0x278644OBJECT<unknown>HIDDEN14
        __sigaddset.symtab0x13ca836FUNC<unknown>DEFAULT2
        __sigdelset.symtab0x13ccc36FUNC<unknown>DEFAULT2
        __sigismember.symtab0x13c8436FUNC<unknown>DEFAULT2
        __sigjmp_save.symtab0x1b4f464FUNC<unknown>HIDDEN2
        __sigsetjmp.symtab0x1ae8c12FUNC<unknown>DEFAULT2
        __stdin.symtab0x271e84OBJECT<unknown>DEFAULT13
        __stdio_READ.symtab0x1b1c488FUNC<unknown>HIDDEN2
        __stdio_WRITE.symtab0x1b21c220FUNC<unknown>HIDDEN2
        __stdio_adjust_position.symtab0x1b2f8200FUNC<unknown>HIDDEN2
        __stdio_fwrite.symtab0x186e8320FUNC<unknown>HIDDEN2
        __stdio_rfill.symtab0x1b3c048FUNC<unknown>HIDDEN2
        __stdio_seek.symtab0x1b49460FUNC<unknown>HIDDEN2
        __stdio_trans2r_o.symtab0x1b3f0164FUNC<unknown>HIDDEN2
        __stdio_trans2w_o.symtab0x18a0c220FUNC<unknown>HIDDEN2
        __stdio_wcommit.symtab0x18ae848FUNC<unknown>HIDDEN2
        __stdout.symtab0x271ec4OBJECT<unknown>DEFAULT13
        __subdf3.symtab0x1b5ac788FUNC<unknown>HIDDEN2
        __sys_accept.symtab0x1354468FUNC<unknown>DEFAULT2
        __sys_connect.symtab0x1364068FUNC<unknown>DEFAULT2
        __sys_recv.symtab0x137c468FUNC<unknown>DEFAULT2
        __sys_recvfrom.symtab0x1387872FUNC<unknown>DEFAULT2
        __sys_send.symtab0x1394868FUNC<unknown>DEFAULT2
        __sys_sendto.symtab0x139fc76FUNC<unknown>DEFAULT2
        __syscall_error.symtab0x172a844FUNC<unknown>HIDDEN2
        __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __syscall_nanosleep.symtab0x176dc64FUNC<unknown>DEFAULT2
        __syscall_rt_sigaction.symtab0x1739064FUNC<unknown>DEFAULT2
        __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __syscall_select.symtab0x1185c68FUNC<unknown>DEFAULT2
        __tls_get_addr.symtab0x1ab4436FUNC<unknown>DEFAULT2
        __uClibc_fini.symtab0x16d18124FUNC<unknown>DEFAULT2
        __uClibc_init.symtab0x16de888FUNC<unknown>DEFAULT2
        __uClibc_main.symtab0x16e401004FUNC<unknown>DEFAULT2
        __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __uclibc_progname.symtab0x271c44OBJECT<unknown>HIDDEN13
        __udivsi3.symtab0x112b4252FUNC<unknown>HIDDEN2
        __write.symtab0x16a70100FUNC<unknown>DEFAULT2
        __write_nocancel.symtab0x16a5424FUNC<unknown>DEFAULT2
        __xpg_strerror_r.symtab0x13410268FUNC<unknown>DEFAULT2
        __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        __xstat32_conv.symtab0x178c8172FUNC<unknown>HIDDEN2
        __xstat64_conv.symtab0x177fc204FUNC<unknown>HIDDEN2
        _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _bss_custom_printf_spec.symtab0x272f810OBJECT<unknown>DEFAULT14
        _bss_end__.symtab0x2a3b80NOTYPE<unknown>DEFAULTSHN_ABS
        _charpad.symtab0x11ff484FUNC<unknown>DEFAULT2
        _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _custom_printf_arginfo.symtab0x29fb440OBJECT<unknown>HIDDEN14
        _custom_printf_handler.symtab0x29fdc40OBJECT<unknown>HIDDEN14
        _custom_printf_spec.symtab0x270cc4OBJECT<unknown>HIDDEN13
        _dl_aux_init.symtab0x1ada456FUNC<unknown>DEFAULT2
        _dl_nothread_init_static_tls.symtab0x1addc88FUNC<unknown>HIDDEN2
        _dl_phdr.symtab0x2a3b04OBJECT<unknown>DEFAULT14
        _dl_phnum.symtab0x2a3b44OBJECT<unknown>DEFAULT14
        _dl_tls_dtv_gaps.symtab0x2a3a41OBJECT<unknown>DEFAULT14
        _dl_tls_dtv_slotinfo_list.symtab0x2a3a04OBJECT<unknown>DEFAULT14
        _dl_tls_generation.symtab0x2a3a84OBJECT<unknown>DEFAULT14
        _dl_tls_max_dtv_idx.symtab0x2a3984OBJECT<unknown>DEFAULT14
        _dl_tls_setup.symtab0x1aadc104FUNC<unknown>DEFAULT2
        _dl_tls_static_align.symtab0x2a3944OBJECT<unknown>DEFAULT14
        _dl_tls_static_nelem.symtab0x2a3ac4OBJECT<unknown>DEFAULT14
        _dl_tls_static_size.symtab0x2a39c4OBJECT<unknown>DEFAULT14
        _dl_tls_static_used.symtab0x2a3904OBJECT<unknown>DEFAULT14
        _edata.symtab0x272c00NOTYPE<unknown>DEFAULTSHN_ABS
        _end.symtab0x2a3b80NOTYPE<unknown>DEFAULTSHN_ABS
        _exit.symtab0x173d0104FUNC<unknown>DEFAULT2
        _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _fini.symtab0x1d53c0FUNC<unknown>DEFAULT3
        _fixed_buffers.symtab0x278888192OBJECT<unknown>DEFAULT14
        _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _fp_out_narrow.symtab0x12048132FUNC<unknown>DEFAULT2
        _fpmaxtostr.symtab0x18d142036FUNC<unknown>HIDDEN2
        _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _init.symtab0x80d40FUNC<unknown>DEFAULT1
        _load_inttype.symtab0x18b18116FUNC<unknown>HIDDEN2
        _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _memcpy.symtab0x19f900FUNC<unknown>HIDDEN2
        _ppfs_init.symtab0x127c0160FUNC<unknown>HIDDEN2
        _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _ppfs_parsespec.symtab0x12aa81392FUNC<unknown>HIDDEN2
        _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _ppfs_prepargs.symtab0x1286068FUNC<unknown>HIDDEN2
        _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _ppfs_setargs.symtab0x128a4432FUNC<unknown>HIDDEN2
        _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _promoted_size.symtab0x12a5484FUNC<unknown>DEFAULT2
        _pthread_cleanup_pop_restore.symtab0x16cec44FUNC<unknown>DEFAULT2
        _pthread_cleanup_push_defer.symtab0x16ce48FUNC<unknown>DEFAULT2
        _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _setjmp.symtab0x1735c8FUNC<unknown>DEFAULT2
        _sigintr.symtab0x2a0048OBJECT<unknown>HIDDEN14
        _start.symtab0x81940FUNC<unknown>DEFAULT2
        _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _stdio_fopen.symtab0x182881120FUNC<unknown>HIDDEN2
        _stdio_init.symtab0x18828128FUNC<unknown>HIDDEN2
        _stdio_openlist.symtab0x271f04OBJECT<unknown>DEFAULT13
        _stdio_openlist_add_lock.symtab0x2786812OBJECT<unknown>DEFAULT14
        _stdio_openlist_dec_use.symtab0x19768688FUNC<unknown>HIDDEN2
        _stdio_openlist_del_count.symtab0x278844OBJECT<unknown>DEFAULT14
        _stdio_openlist_del_lock.symtab0x2787412OBJECT<unknown>DEFAULT14
        _stdio_openlist_use_count.symtab0x278804OBJECT<unknown>DEFAULT14
        _stdio_streams.symtab0x271f4204OBJECT<unknown>DEFAULT13
        _stdio_term.symtab0x188a8356FUNC<unknown>HIDDEN2
        _stdio_user_locking.symtab0x271d84OBJECT<unknown>DEFAULT13
        _stdlib_strto_l.symtab0x15808472FUNC<unknown>HIDDEN2
        _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _store_inttype.symtab0x18b8c44FUNC<unknown>HIDDEN2
        _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _string_syserrmsgs.symtab0x1ddb82906OBJECT<unknown>HIDDEN4
        _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _uintmaxtostr.symtab0x18bb8348FUNC<unknown>HIDDEN2
        _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _vfprintf_internal.symtab0x120cc1780FUNC<unknown>HIDDEN2
        _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        abort.symtab0x15080296FUNC<unknown>DEFAULT2
        abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        accept.symtab0x13588116FUNC<unknown>DEFAULT2
        accept.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        anti_gdb_entry.symtab0xf0bc24FUNC<unknown>DEFAULT2
        atoi.symtab0x157cc32FUNC<unknown>DEFAULT2
        atol.symtab0x157cc32FUNC<unknown>DEFAULT2
        atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        attack.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        attack_app_http.symtab0x8a047576FUNC<unknown>DEFAULT2
        attack_get_opt_int.symtab0x85b0112FUNC<unknown>DEFAULT2
        attack_get_opt_ip.symtab0x8544108FUNC<unknown>DEFAULT2
        attack_get_opt_str.symtab0x81d092FUNC<unknown>DEFAULT2
        attack_gre_eth.symtab0xb3a41704FUNC<unknown>DEFAULT2
        attack_gre_ip.symtab0xba4c1588FUNC<unknown>DEFAULT2
        attack_icmpecho.symtab0xc758608FUNC<unknown>DEFAULT2
        attack_init.symtab0x8620996FUNC<unknown>DEFAULT2
        attack_method_ovh.symtab0xdfd01712FUNC<unknown>DEFAULT2
        attack_parse.symtab0x8328540FUNC<unknown>DEFAULT2
        attack_start.symtab0x822c252FUNC<unknown>DEFAULT2
        attack_tcp_ack.symtab0xd1741788FUNC<unknown>DEFAULT2
        attack_tcp_stomp.symtab0xc9b81980FUNC<unknown>DEFAULT2
        attack_tcp_syn.symtab0xd8701888FUNC<unknown>DEFAULT2
        attack_udp_dns.symtab0xc0801752FUNC<unknown>DEFAULT2
        attack_udp_generic.symtab0xaea41280FUNC<unknown>DEFAULT2
        attack_udp_plain.symtab0xa79c700FUNC<unknown>DEFAULT2
        attack_udp_vse.symtab0xaa581100FUNC<unknown>DEFAULT2
        attacks.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        been_there_done_that.symtab0x273044OBJECT<unknown>DEFAULT14
        bind.symtab0x135fc68FUNC<unknown>DEFAULT2
        bind.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        brk.symtab0x1ae3488FUNC<unknown>DEFAULT2
        brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        bsd_signal.symtab0x13bc0196FUNC<unknown>DEFAULT2
        calloc.symtab0x146a0320FUNC<unknown>DEFAULT2
        calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        checksum.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        checksum_generic.symtab0xe68080FUNC<unknown>DEFAULT2
        checksum_tcpudp.symtab0xe73c164FUNC<unknown>DEFAULT2
        clock.symtab0x11ebc52FUNC<unknown>DEFAULT2
        clock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        close.symtab0x16950100FUNC<unknown>DEFAULT2
        closedir.symtab0x11a60272FUNC<unknown>DEFAULT2
        closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        completed.5105.symtab0x272c01OBJECT<unknown>DEFAULT14
        connect.symtab0x13684116FUNC<unknown>DEFAULT2
        connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        ensure_single_instance.symtab0xf0d4356FUNC<unknown>DEFAULT2
        entries.symtab0x29dcc4OBJECT<unknown>DEFAULT14
        environ.symtab0x278584OBJECT<unknown>DEFAULT14
        errno.symtab0x04TLS<unknown>DEFAULT8
        errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        exit.symtab0x159e0196FUNC<unknown>DEFAULT2
        exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        exp10_table.symtab0x1ecf072OBJECT<unknown>DEFAULT4
        fclose.symtab0x17f38816FUNC<unknown>DEFAULT2
        fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fcntl.symtab0x115b8244FUNC<unknown>DEFAULT2
        fd_ctrl.symtab0x270b84OBJECT<unknown>DEFAULT13
        fd_serv.symtab0x270bc4OBJECT<unknown>DEFAULT13
        fd_to_DIR.symtab0x11b70208FUNC<unknown>DEFAULT2
        fdopendir.symtab0x11d04176FUNC<unknown>DEFAULT2
        fflush_unlocked.symtab0x19a18940FUNC<unknown>DEFAULT2
        fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fgetc.symtab0x19508324FUNC<unknown>DEFAULT2
        fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fgetc_unlocked.symtab0x19dc4300FUNC<unknown>DEFAULT2
        fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fgets.symtab0x1964c284FUNC<unknown>DEFAULT2
        fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fgets_unlocked.symtab0x19ef0160FUNC<unknown>DEFAULT2
        fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fmt.symtab0x1ecd820OBJECT<unknown>DEFAULT4
        fopen.symtab0x1826832FUNC<unknown>DEFAULT2
        fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fork.symtab0x16264972FUNC<unknown>DEFAULT2
        fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fork_handler_pool.symtab0x273101348OBJECT<unknown>DEFAULT14
        fputs_unlocked.symtab0x1301856FUNC<unknown>DEFAULT2
        fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        frame_dummy.symtab0x81340FUNC<unknown>DEFAULT2
        free.symtab0x14e04572FUNC<unknown>DEFAULT2
        free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fseek.symtab0x1afe036FUNC<unknown>DEFAULT2
        fseeko.symtab0x1afe036FUNC<unknown>DEFAULT2
        fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fseeko64.symtab0x1b004448FUNC<unknown>DEFAULT2
        fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fstat.symtab0x17438100FUNC<unknown>DEFAULT2
        fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
        fwrite_unlocked.symtab0x13050188FUNC<unknown>DEFAULT2

        Network Behavior

        Snort IDS Alerts

        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
        01/14/22-17:00:56.130211UDP254DNS SPOOF query response with TTL of 1 min. and no authority53507628.8.8.8192.168.2.23
        01/14/22-17:00:56.356944TCP2030490ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)3940455650192.168.2.23209.141.53.247
        01/14/22-17:00:56.600571TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:01:02.160762TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:01:22.129069TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:01:42.129990TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:02:02.133753TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:02:22.157417TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:02:42.150715TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:03:02.161209TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:03:22.169240TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:03:42.173430TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:04:02.178064TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23
        01/14/22-17:04:22.191171TCP2030489ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response5565039404209.141.53.247192.168.2.23

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Jan 14, 2022 17:00:56.131031036 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:00:56.356405973 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:00:56.356489897 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:00:56.356944084 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:00:56.600570917 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:00:56.600593090 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:00:56.600630045 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:00:58.495395899 CET42836443192.168.2.2391.189.91.43
        Jan 14, 2022 17:00:59.263134003 CET4251680192.168.2.23109.202.202.202
        Jan 14, 2022 17:01:02.160762072 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:01:02.160918951 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:01:12.170860052 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:01:12.375534058 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:01:13.598576069 CET43928443192.168.2.2391.189.91.42
        Jan 14, 2022 17:01:22.129069090 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:01:22.129276991 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:01:25.886113882 CET42836443192.168.2.2391.189.91.43
        Jan 14, 2022 17:01:29.981883049 CET4251680192.168.2.23109.202.202.202
        Jan 14, 2022 17:01:42.129990101 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:01:42.130166054 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:01:54.557017088 CET43928443192.168.2.2391.189.91.42
        Jan 14, 2022 17:02:02.133753061 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:02:02.133894920 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:02:22.157417059 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:02:22.157730103 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:02:42.150715113 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:02:42.150907993 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:02:52.160875082 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:02:52.333316088 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:03:02.161209106 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:03:02.161350012 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:03:22.169239998 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:03:22.169456005 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:03:42.173429966 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:03:42.173683882 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:04:02.178064108 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:04:02.178355932 CET3940455650192.168.2.23209.141.53.247
        Jan 14, 2022 17:04:22.191170931 CET5565039404209.141.53.247192.168.2.23
        Jan 14, 2022 17:04:22.191430092 CET3940455650192.168.2.23209.141.53.247

        UDP Packets

        TimestampSource PortDest PortSource IPDest IP
        Jan 14, 2022 17:00:56.109119892 CET5076253192.168.2.238.8.8.8
        Jan 14, 2022 17:00:56.130211115 CET53507628.8.8.8192.168.2.23

        DNS Queries

        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
        Jan 14, 2022 17:00:56.109119892 CET192.168.2.238.8.8.80x45bdStandard query (0)smellyoulater.onthewifi.comA (IP address)IN (0x0001)

        DNS Answers

        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
        Jan 14, 2022 17:00:56.130211115 CET8.8.8.8192.168.2.230x45bdNo error (0)smellyoulater.onthewifi.com209.141.53.247A (IP address)IN (0x0001)

        System Behavior

        Analysis Process: rEwoho1ZZp PID: 5223 Parent PID: 5117

        General

        Start time:17:00:54
        Start date:14/01/2022
        Path:/tmp/rEwoho1ZZp
        Arguments:/tmp/rEwoho1ZZp
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        Analysis Process: rEwoho1ZZp PID: 5225 Parent PID: 5223

        General

        Start time:17:00:55
        Start date:14/01/2022
        Path:/tmp/rEwoho1ZZp
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        Analysis Process: rEwoho1ZZp PID: 5227 Parent PID: 5223

        General

        Start time:17:00:55
        Start date:14/01/2022
        Path:/tmp/rEwoho1ZZp
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1