Edit tour

Linux Analysis Report
uV4x1JLrrF.elf

Overview

General Information

Sample name:	uV4x1JLrrF.elf renamed because original name is a hash value
Original sample name:	11940231956afdf6ab2c24fafcb0a7d2.elf
Analysis ID:	1427842
MD5:	11940231956afdf6ab2c24fafcb0a7d2
SHA1:	5a3f0b5e85964083be389505ee75a1a4e9f38c10
SHA256:	23b9b98ccaa61728e45450b30b8211ca8516dcb6963056a4710bf36566f74f00
Tags:	32armelfmirai
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Executes the "iptables" command to insert, remove and/or manipulate rules

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes the "iptables" command used for managing IP filtering and manipulation

Executes the "rm" command used to delete files or directories

Reads system information from the proc file system

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427842
Start date and time:	2024-04-18 09:28:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	uV4x1JLrrF.elf renamed because original name is a hash value
Original Sample Name:	11940231956afdf6ab2c24fafcb0a7d2.elf
Detection:	MAL
Classification:	mal52.linELF@0/0@6/0

Runtime Messages

Command:	/tmp/uV4x1JLrrF.elf
PID:	5451
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	listening dn0
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5419, Parent: 3578)

rm (PID: 5419, Parent: 3578, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.5lIQ4oDzkg /tmp/tmp.PVNnRhmawi /tmp/tmp.SqxOz7GmTU

dash New Fork (PID: 5420, Parent: 3578)

cat (PID: 5420, Parent: 3578, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.5lIQ4oDzkg

dash New Fork (PID: 5421, Parent: 3578)

head (PID: 5421, Parent: 3578, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5422, Parent: 3578)

tr (PID: 5422, Parent: 3578, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5423, Parent: 3578)

cut (PID: 5423, Parent: 3578, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5424, Parent: 3578)

cat (PID: 5424, Parent: 3578, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.5lIQ4oDzkg

dash New Fork (PID: 5425, Parent: 3578)

head (PID: 5425, Parent: 3578, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5426, Parent: 3578)

tr (PID: 5426, Parent: 3578, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5427, Parent: 3578)

cut (PID: 5427, Parent: 3578, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5428, Parent: 3578)

rm (PID: 5428, Parent: 3578, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.5lIQ4oDzkg /tmp/tmp.PVNnRhmawi /tmp/tmp.SqxOz7GmTU

uV4x1JLrrF.elf (PID: 5451, Parent: 5347, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/uV4x1JLrrF.elf

uV4x1JLrrF.elf New Fork (PID: 5453, Parent: 5451)

uV4x1JLrrF.elf New Fork (PID: 5455, Parent: 5453)

uV4x1JLrrF.elf New Fork (PID: 5457, Parent: 5455)

uV4x1JLrrF.elf New Fork (PID: 5459, Parent: 5453)

uV4x1JLrrF.elf New Fork (PID: 5461, Parent: 5459)

sh (PID: 5461, Parent: 5459, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 5463, Parent: 5461)

iptables (PID: 5463, Parent: 5461, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

uV4x1JLrrF.elf New Fork (PID: 5471, Parent: 5459)

sh (PID: 5471, Parent: 5459, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 5473, Parent: 5471)

busybox (PID: 5473, Parent: 5471, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

uV4x1JLrrF.elf New Fork (PID: 5474, Parent: 5459)

sh (PID: 5474, Parent: 5459, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 5476, Parent: 5474)

uV4x1JLrrF.elf New Fork (PID: 5477, Parent: 5459)

sh (PID: 5477, Parent: 5459, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 5479, Parent: 5477)

uV4x1JLrrF.elf New Fork (PID: 5480, Parent: 5459)

sh (PID: 5480, Parent: 5459, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"

sh New Fork (PID: 5482, Parent: 5480)

busybox (PID: 5482, Parent: 5480, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: uV4x1JLrrF.elf	ReversingLabs: Detection: 26%
Source: uV4x1JLrrF.elf	Virustotal: Detection: 29%			Perma Link

Networking

Executes the "iptables" command to insert, remove and/or manipulate rules

Source: /bin/sh (PID: 5463)

Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.13:40720 -> 212.118.43.167:2222
Source: global traffic	TCP traffic: 192.168.2.13:40532 -> 84.54.47.93:35342
Source: global traffic	TCP traffic: 192.168.2.13:54706 -> 185.196.11.64:35342

Source: /bin/sh (PID: 5463)

Iptables executable: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: /tmp/uV4x1JLrrF.elf (PID: 5451)	Socket: 127.0.0.1::8345			Jump to behavior
Source: /tmp/uV4x1JLrrF.elf (PID: 5459)	Socket: 0.0.0.0::26721			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	TCP traffic detected without corresponding DNS query: 84.54.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	TCP traffic detected without corresponding DNS query: 84.54.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	TCP traffic detected without corresponding DNS query: 84.54.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 84.54.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	TCP traffic detected without corresponding DNS query: 212.118.43.167
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87

Source: unknown

DNS traffic detected: queries for: dead-cheap-doma.in

Source: uV4x1JLrrF.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
Source: Initial sample	String containing 'busybox' found: busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
Source: Initial sample	String containing 'busybox' found: %x/proc//exe%s/%shey skido/tmp/opt/home/dev/var/sbin/proc/self/exesocketsetsockoptbindlisten1.1.1.1hi im here, i think/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPTbusybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPTbindtoipconnectpoll/proc/net/tcp/fd0

Source: classification engine

Classification label: mal52.linELF@0/0@6/0

Persistence and Installation Behavior

Executes the "iptables" command to insert, remove and/or manipulate rules

Source: /bin/sh (PID: 5463)

Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: /tmp/uV4x1JLrrF.elf (PID: 5461)	Shell command executed: /bin/sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/uV4x1JLrrF.elf (PID: 5471)	Shell command executed: /bin/sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/uV4x1JLrrF.elf (PID: 5474)	Shell command executed: /bin/sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/uV4x1JLrrF.elf (PID: 5477)	Shell command executed: /bin/sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior
Source: /tmp/uV4x1JLrrF.elf (PID: 5480)	Shell command executed: /bin/sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"	Jump to behavior

Source: /bin/sh (PID: 5463)

Iptables executable: /usr/sbin/iptables -> iptables -A INPUT -p tcp --dport 26721 -j ACCEPT

Jump to behavior

Source: /usr/bin/dash (PID: 5419)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.5lIQ4oDzkg /tmp/tmp.PVNnRhmawi /tmp/tmp.SqxOz7GmTU			Jump to behavior
Source: /usr/bin/dash (PID: 5428)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.5lIQ4oDzkg /tmp/tmp.PVNnRhmawi /tmp/tmp.SqxOz7GmTU			Jump to behavior

Source: /tmp/uV4x1JLrrF.elf (PID: 5453)

Reads from proc file: /proc/stat

Jump to behavior

Source: /tmp/uV4x1JLrrF.elf (PID: 5451)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/busybox (PID: 5473)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5482)	Queries kernel information via 'uname':	Jump to behavior

Source: uV4x1JLrrF.elf, 5451.1.00007fff46f5c000.00007fff46f7d000.rw-.sdmp	Binary or memory string: X&x86_64/usr/bin/qemu-arm/tmp/uV4x1JLrrF.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/uV4x1JLrrF.elf
Source: uV4x1JLrrF.elf, 5451.1.000055a803be6000.000055a803d5d000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: uV4x1JLrrF.elf, 5451.1.000055a803be6000.000055a803d5d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: uV4x1JLrrF.elf, 5451.1.00007fff46f5c000.00007fff46f7d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
uV4x1JLrrF.elf	26%	ReversingLabs	Linux.Trojan.Gafgyt
uV4x1JLrrF.elf	29%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dead-cheap-doma.in	185.196.11.64	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.118.43.167	unknown	Russian Federation	25308	CITYLAN-ASRU	false
185.196.11.64	dead-cheap-doma.in	Switzerland	42624	SIMPLECARRIERCH	false
84.54.47.93	unknown	Russian Federation	58024	DZINET-ASRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
212.118.43.167	9jjtFFX0Tb.elf	Get hash	malicious	Unknown	Browse
	ceKWlceqnf.elf	Get hash	malicious	Unknown	Browse
	ULDAb4NYKK.elf	Get hash	malicious	Unknown	Browse
	PAqN0mrUbb.elf	Get hash	malicious	Unknown	Browse
	TsjmK7qSlf.elf	Get hash	malicious	Unknown	Browse
	ZXYyjKa6bs.elf	Get hash	malicious	Unknown	Browse
	ZE3opQX8Ch.elf	Get hash	malicious	Unknown	Browse
	1Mk36tjCOK.elf	Get hash	malicious	Unknown	Browse
	Cv4eBOp75T.elf	Get hash	malicious	Unknown	Browse
	3qckgf2caC.elf	Get hash	malicious	Unknown	Browse
185.196.11.64	9jjtFFX0Tb.elf	Get hash	malicious	Unknown	Browse
84.54.47.93	x86.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dead-cheap-doma.in	9jjtFFX0Tb.elf	Get hash	malicious	Unknown	Browse	185.196.11.64

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	9jjtFFX0Tb.elf	Get hash	malicious	Unknown	Browse	185.196.11.64
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	WC8X6qXwRB.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.196.10.233
	8p1dq7mGv1.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.196.10.233
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.196.11.12
	C6CM5vjm9f.elf	Get hash	malicious	Unknown	Browse	185.196.9.5
	tGUvOmucT1.elf	Get hash	malicious	Mirai	Browse	185.196.9.5
	HuQOCdLGIt.elf	Get hash	malicious	Mirai	Browse	185.196.9.5
	5KlVl7Ufq8.elf	Get hash	malicious	Mirai	Browse	185.196.9.5
	AK8vX17uEL.elf	Get hash	malicious	Mirai	Browse	185.196.9.5
CITYLAN-ASRU	9jjtFFX0Tb.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
	ceKWlceqnf.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
	h2LK6AsZ1I.exe	Get hash	malicious	RisePro Stealer	Browse	88.210.9.117
	SecuriteInfo.com.Win32.SpywareX-gen.4316.21522.exe	Get hash	malicious	DanaBot	Browse	88.210.13.105
	SecuriteInfo.com.Win32.SpywareX-gen.4316.21522.exe	Get hash	malicious	DanaBot	Browse	88.210.13.105
	bladfin.exe	Get hash	malicious	RedLine, SectopRAT	Browse	212.118.39.73
	uetfu6ZLWZ.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	212.118.39.73
	16GAuqLUFK.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Stealc	Browse	212.118.39.73
	AB03728734CCE8444BE6ECE06A9F93F503149CDE8BC57.exe	Get hash	malicious	RedLine, SectopRAT, zgRAT	Browse	212.118.39.73
	ULDAb4NYKK.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
DZINET-ASRU	Clear-cache.webp	Get hash	malicious	Unknown	Browse	84.54.44.238
	arm7.elf	Get hash	malicious	Unknown	Browse	84.54.44.78
	x86.elf	Get hash	malicious	Unknown	Browse	84.54.47.93
	Zsvwy1uC0d.elf	Get hash	malicious	Mirai	Browse	84.54.44.112
	arm	Get hash	malicious	Unknown	Browse	84.54.44.148

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.001747323309846
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	uV4x1JLrrF.elf
File size:	216'775 bytes
MD5:	11940231956afdf6ab2c24fafcb0a7d2
SHA1:	5a3f0b5e85964083be389505ee75a1a4e9f38c10
SHA256:	23b9b98ccaa61728e45450b30b8211ca8516dcb6963056a4710bf36566f74f00
SHA512:	febb1cdd17583c21729e1b662ead571f9fa9c27812d956b90ef53b275e6d2ccd917d97ee92e79e762b8ef266733ee65b787e4dbe2df476a3cddbaa038ae98ddc
SSDEEP:	6144:dQLFkgj4oB0ast5up8X+OQ3Q5U3rCYfM/RhkJE9:dw54oB0au5up8XwAmOYk/UJE9
TLSH:	36242A46AA408F13C4D727B9FA9F424633339B64D7E763069528AFB43F8779A4F22501
File Content Preview:	.ELF..............(.........4...L.......4. ...(........p............................................t...t...............t...t...t...P...@Z..............x...x...x...................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	168268
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1e2b8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x263a8	0x1e3a8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x263b8	0x1e3b8	0x1e0c	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x281c4	0x201c4	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x281dc	0x201dc	0x198	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x30374	0x20374	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x30378	0x20378	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x3037c	0x2037c	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x3037c	0x2037c	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x30380	0x20380	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x30384	0x20384	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x30388	0x20388	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x30448	0x20448	0x27c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x306c8	0x206c4	0x56ec	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x206c4	0x1270	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x21938	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x21ab8	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x21cf6	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x2479d	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x25137	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x262c4	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x26600	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x270bc	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x288e6	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x29016	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2902c	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x295fc	0x7780	0x10	0x0		29	1134	4
.strtab	STRTAB	0x0	0x30d7c	0x414b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x201dc	0x281dc	0x281dc	0x198	0x198	4.7878	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x20374	0x20374	6.1085	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x20374	0x30374	0x30374	0x350	0x5a40	4.3417	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x20378	0x30378	0x30378	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x263a8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x263b8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x281c4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x281dc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x30374	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x30378	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x3037c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x3037c	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x30380	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x30384	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x30388	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x30448	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x306c8	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x263a8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x263b4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x918c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x96bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa1c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa7ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaaa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb70c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb7c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xba78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbaf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1261c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1304c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x138b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x139f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1510c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1580c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1652c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1704c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1753c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1786c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1854c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1916c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1921c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1952c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1956c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1971c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1980c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1984c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1987c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1add0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c63c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cafc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1deb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1def8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f78c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f7c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f81c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fdbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ffd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x200f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2018c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2028c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x203a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x204c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2056c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x209a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20c88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20dc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x216b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x216d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x217e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2205c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x230ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x231e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x234a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23b58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x242d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x243fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2449c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2458c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2466c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2475c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2488c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x248dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x250bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x252b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x253bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2559c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2575c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x257b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2587c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x258ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2598c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x259fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x262b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26308	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30380	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3037c	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x830c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30448	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x3044c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30450	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30454	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30474	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x8f4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8fb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x917c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb364	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb4e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb604	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb7b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xba30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbaf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc744	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x30480	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x304a0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd8fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2665c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x26680	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26a6c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26e6c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26ea2	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x129b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13044	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x133b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x138b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x139ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13bb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1427c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x304ac	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x26ecc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x304b0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x15250	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x160a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x163f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16bb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x304c4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x17044	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x17ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18468	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x18d94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18ed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1900c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19070	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1912c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19218	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19310	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x195a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x195d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19610	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x198f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27368	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a08c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x304d8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x304d4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1acc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x273d8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1af7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x305bc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x273e0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1b614	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b70c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27470	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1bcac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c46c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c5ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c5f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c638	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c7b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c7fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c86c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c940	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c988	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1caf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d4f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x305c0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1d63c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d9f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1def0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e00c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x305d8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e0c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e178	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x305f0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x30688	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e548	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e638	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x27ff0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1e6e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3069c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eec4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f2d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f330	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f398	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f7c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fa3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1faa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fb14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fd50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fdb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ff70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ffc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x200e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2017c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20354	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2039c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x306b4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x204ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2050c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2090c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x306b8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20c84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20d2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20d84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x216a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x217e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21c10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28100	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x22924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28164	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x23a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x28190	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x23f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x242b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x243f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24584	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24664	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24a18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24ca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2504c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x250b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x251fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x252a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2538c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25758	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25878	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2594c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x259f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x304c0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x304cc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x27068	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
C.11.5548	.symtab	0x2805c	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x27368	24	OBJECT	<unknown>	DEFAULT	4
C.7.4231	.symtab	0x26e6c	54	OBJECT	<unknown>	DEFAULT	4
C.7.4251	.symtab	0x26680	44	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x28068	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x2738c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x273b0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x280d8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6365	.symtab	0x27464	12	OBJECT	<unknown>	DEFAULT	4
C.8.4252	.symtab	0x2665c	36	OBJECT	<unknown>	DEFAULT	4
C.8.4290	.symtab	0x26ea2	21	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x273a4	12	OBJECT	<unknown>	DEFAULT	4
C.9.4207	.symtab	0x26a6c	1024	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x27398	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x35470	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x1b848	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x1b864	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x19010	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x30388	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x17874	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x17878	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x18528	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1786c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x178b0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1854c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x18cec	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x178a4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x184bc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x184e0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x18504	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x177d4	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x17dec	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x17820	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x304cc	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x27068	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x30374	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x30374	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x304cc	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1f6c0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1f6a4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x304d0	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x18e44	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x242d0	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1bab8	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1f6c0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x18edc	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1f750	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1f870	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1f7e0	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x20984	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x16ee4	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x16ee8	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1f750	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1f734	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x307b4	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x16060	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x160b4	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1f870	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1f854	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1f3a0	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1cb20	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1cb44	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1cafc	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x30794	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x20444	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x20514	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1f7e0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1f7c4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1bad0	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x19010	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1def8	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1c400	116	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1c474	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x25064	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x190b8	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1f6c0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x19a70	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x211d4	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x21208	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x20eac	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1c4fc	116	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x190f0	64	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1e644	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x21384	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x18edc	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x23f24	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x23a14	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x242d0	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x23b58	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x243fc	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x216b4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1ef2c	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1a098	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1b61c	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x25398	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x2559c	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x209a4	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1b654	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x242d0	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x20aa8	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x20ad4	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x20ae8	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x20afc	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x19130	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1f528	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1916c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1c570	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x191a4	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x20b10	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1c394	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x24928	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1c0f8	668	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1bd80	552	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1e460	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x20b24	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1bc10	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x191e4	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x1c5fc	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x20c04	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x2598c	112	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x25204	172	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x252b0	232	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x2449c	240	FUNC	<unknown>	HIDDEN	2
__GI_memcmp	.symtab	0x1b710	44	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1b740	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1b750	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1b880	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x2458c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1b760	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x18d20	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x20c44	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x192d4	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x19354	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1f750	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x19c50	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x19fc0	116	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x193f4	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1f570	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1e038	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1e2f8	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1f870	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x19dc4	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x20dc0	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x194ac	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1c680	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1c738	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x1a034	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x20c88	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x20cc8	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x19658	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1c804	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1c8c0	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x196dc	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1c948	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1e558	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x18d9c	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1c9d4	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1ca24	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1ca38	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1971c	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x1a0c8	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1c990	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x216d4	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1e388	216	FUNC	<unknown>	HIDDEN	2
__GI_sscanf	.symtab	0x1b544	48	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x197a8	100	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x1b8a4	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x2466c	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x2475c	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1b800	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1b800	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1b8cc	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x24848	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1bbdc	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1b820	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1b8f0	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x2488c	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x248dc	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1b9bc	252	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1e854	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1bc34	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1984c	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x20d34	20	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x253bc	480	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x20d48	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1a3dc	324	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x22928	1896	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1a0f8	208	FUNC	<unknown>	HIDDEN	2
__GI_vsscanf	.symtab	0x1b574	168	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x20d88	56	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1987c	124	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x21250	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x212c8	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x212a4	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1f7e0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x30384	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x30384	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x18528	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x184bc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x184e0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x18504	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x25a08	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x17730	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x17730	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x17714	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2f	.symtab	0x26308	160	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x262b4	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x25a08	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x17748	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x17790	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x177a8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x17778	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x17760	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x260a8	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x25e18	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x259fc	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x25a04	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x25d64	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x25d3c	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1753c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x17668	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x25db8	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x12210	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x25d18	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x17428	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x17524	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x25da4	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x18488	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x18480	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x18478	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x35454	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x3069c	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x35db4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x306c4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x306c4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x204c0	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1eec8	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1f6c0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1f6a4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x17690	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x304d0	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x3545c	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x30448	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0x13a98	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x18e3c	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x18e30	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x304c0	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x177c0	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x260a8	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1753c	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x30380	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x35db4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x3544c	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x17690	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x12854	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1ef28	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x28374	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x281dc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x349c0	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x25d64	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x18e44	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x242d0	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x1328c	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x30384	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x30380	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x262b4	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x25db8	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x25d3c	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x25da4	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x25d18	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x120e4	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x3599c	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x35d80	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x35d84	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x349c4	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x3037c	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0x139f4	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x13bc8	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x17680	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x20a08	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x250bc	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x19130	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1f528	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1bab8	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x17c2c	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x17d14	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x184ac	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x17ca8	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x17dcc	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x184b4	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x18590	1812	FUNC	<unknown>	HIDDEN	2

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 09:29:24.558089018 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:29:24.621201992 CEST	40532	35342	192.168.2.13	84.54.47.93
Apr 18, 2024 09:29:25.572922945 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:29:25.637350082 CEST	40532	35342	192.168.2.13	84.54.47.93
Apr 18, 2024 09:29:27.588882923 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:29:27.652955055 CEST	40532	35342	192.168.2.13	84.54.47.93
Apr 18, 2024 09:29:31.748832941 CEST	40532	35342	192.168.2.13	84.54.47.93
Apr 18, 2024 09:29:31.748871088 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:29:39.940851927 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:29:40.854427099 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:29:41.069735050 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:29:41.069899082 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:29:41.074043036 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:29:41.291117907 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:29:41.291363955 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:29:41.508837938 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:29:56.068708897 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:29:56.511071920 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:29:56.511223078 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:30:11.726995945 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:30:11.727163076 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:30:26.946796894 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:30:26.947173119 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:30:29.604381084 CEST	40720	2222	192.168.2.13	212.118.43.167
Apr 18, 2024 09:30:42.166805983 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:30:42.167143106 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:30:57.386665106 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:30:57.386912107 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:31:11.136158943 CEST	54706	35342	192.168.2.13	185.196.11.64
Apr 18, 2024 09:31:11.352068901 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:31:11.352149010 CEST	35342	54706	185.196.11.64	192.168.2.13
Apr 18, 2024 09:31:11.352303028 CEST	54706	35342	192.168.2.13	185.196.11.64

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 09:29:23.573837996 CEST	52064	53	192.168.2.13	51.254.162.59
Apr 18, 2024 09:29:23.781018019 CEST	53	52064	51.254.162.59	192.168.2.13
Apr 18, 2024 09:29:23.781786919 CEST	59513	53	192.168.2.13	51.254.162.59
Apr 18, 2024 09:29:23.989161015 CEST	53	59513	51.254.162.59	192.168.2.13
Apr 18, 2024 09:29:23.989453077 CEST	51459	53	192.168.2.13	51.254.162.59
Apr 18, 2024 09:29:24.202810049 CEST	53	51459	51.254.162.59	192.168.2.13
Apr 18, 2024 09:29:24.202954054 CEST	45783	53	192.168.2.13	51.254.162.59
Apr 18, 2024 09:29:24.414396048 CEST	53	45783	51.254.162.59	192.168.2.13
Apr 18, 2024 09:29:24.414577961 CEST	34140	53	192.168.2.13	51.254.162.59
Apr 18, 2024 09:29:24.620912075 CEST	53	34140	51.254.162.59	192.168.2.13
Apr 18, 2024 09:29:40.636559963 CEST	46023	53	192.168.2.13	194.36.144.87
Apr 18, 2024 09:29:40.853935003 CEST	53	46023	194.36.144.87	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 09:29:23.573837996 CEST	192.168.2.13	51.254.162.59	0x3222	Standard query (0)	dead-cheap-doma.in	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:29:23.781786919 CEST	192.168.2.13	51.254.162.59	0x3222	Standard query (0)	dead-cheap-doma.in	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:29:23.989453077 CEST	192.168.2.13	51.254.162.59	0x3222	Standard query (0)	dead-cheap-doma.in	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:29:24.202954054 CEST	192.168.2.13	51.254.162.59	0x3222	Standard query (0)	dead-cheap-doma.in	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:29:24.414577961 CEST	192.168.2.13	51.254.162.59	0x3222	Standard query (0)	dead-cheap-doma.in	A (IP address)	IN (0x0001)	false
Apr 18, 2024 09:29:40.636559963 CEST	192.168.2.13	194.36.144.87	0x4e91	Standard query (0)	dead-cheap-doma.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 09:29:40.853935003 CEST	194.36.144.87	192.168.2.13	0x4e91	No error (0)	dead-cheap-doma.in		185.196.11.64	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: dash PID: 5419, Parent PID: 3578

General

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.5lIQ4oDzkg /tmp/tmp.PVNnRhmawi /tmp/tmp.SqxOz7GmTU
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.5lIQ4oDzkg
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/cat
Arguments:	cat /tmp/tmp.5lIQ4oDzkg
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/head
Arguments:	head -n 10
File size:	47480 bytes
MD5 hash:	fd96a67145172477dd57131396fc9608

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/tr
Arguments:	tr -d \\000-\\011\\013\\014\\016-\\037
File size:	51544 bytes
MD5 hash:	fbd1402dd9f72d8ebfff00ce7c3a7bb5

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/cut
Arguments:	cut -c -80
File size:	47480 bytes
MD5 hash:	d8ed0ea8f22c0de0f8692d4d9f1759d3

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:15
Start date (UTC):	18/04/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.5lIQ4oDzkg /tmp/tmp.PVNnRhmawi /tmp/tmp.SqxOz7GmTU
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	07:29:19
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	/tmp/uV4x1JLrrF.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:19
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:19
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:19
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/usr/sbin/iptables
Arguments:	iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
File size:	99296 bytes
MD5 hash:	1ab05fef765b6342cdfadaa5275b33af

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/bin/busybox
Arguments:	/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:22
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/tmp/uV4x1JLrrF.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	/bin/sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:29:23
Start date (UTC):	18/04/2024
Path:	/usr/bin/busybox
Arguments:	busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report uV4x1JLrrF.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 5419, Parent PID: 3578

General

Chronological Activities

Analysis Process: rm PID: 5419, Parent PID: 3578

General

Chronological Activities

Analysis Process: dash PID: 5420, Parent PID: 3578

General

Chronological Activities

Analysis Process: cat PID: 5420, Parent PID: 3578

General

Chronological Activities

Analysis Process: dash PID: 5421, Parent PID: 3578

General

Chronological Activities

Analysis Process: head PID: 5421, Parent PID: 3578

General

Chronological Activities

Analysis Process: dash PID: 5422, Parent PID: 3578

General

Chronological Activities

Analysis Process: tr PID: 5422, Parent PID: 3578

Linux Analysis Report
uV4x1JLrrF.elf