Edit tour

Linux Analysis Report
main_arm7.elf

Overview

General Information

Sample name:	main_arm7.elf
Analysis ID:	1543922
MD5:	92aa32a510ec09656a12b83cf865e781
SHA1:	2ece9b43e28f00e14b0bb919b73d74d3fed74f2c
SHA256:	dca351722ab706346b1fb062a5a4938fec99eaa0051e9115705167b7d0a75da5
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543922
Start date and time:	2024-10-28 16:23:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	main_arm7.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: main_arm7.elf

Runtime Messages

Command:	/tmp/main_arm7.elf
PID:	6269
Exit Code:	1
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

main_arm7.elf (PID: 6269, Parent: 6192, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/main_arm7.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
main_arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
main_arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17d88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17db0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
main_arm7.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17c48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6269.1.00007f951c017000.00007f951c031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6269.1.00007f951c017000.00007f951c031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17d88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17db0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6269.1.00007f951c017000.00007f951c031000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17c48:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: main_arm7.elf PID: 6269	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: main_arm7.elf PID: 6269	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x140ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14103:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14117:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1412b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1413f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1417b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1418f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1421b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1422f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1426b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1427f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: main_arm7.elf PID: 6269	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13fd5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: main_arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: main_arm7.elf

ReversingLabs: Detection: 55%

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown

Network traffic detected: HTTP traffic on port 43928 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6269.1.00007f951c017000.00007f951c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6269.1.00007f951c017000.00007f951c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: main_arm7.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: main_arm7.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: main_arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/telnetsshwatchdogsshd/usr/compress/bin//compress/bin/compress/usr/bashmain_x86main_x86_64main_mipsmain_mipselmain_armmain_arm5main_arm6main_arm7main_ppcmain_m68kmain_sh4main_spchttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//tmp/var/mnt/boot/home/dev/..//root(deleted)/proc/self/exe

Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6269.1.00007f951c017000.00007f951c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6269.1.00007f951c017000.00007f951c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: main_arm7.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: main_arm7.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/main_arm7.elf (PID: 6269)

Queries kernel information via 'uname':

Jump to behavior

Source: main_arm7.elf, 6269.1.0000563be86f8000.0000563be8826000.rw-.sdmp	Binary or memory string: ;V!/etc/qemu-binfmt/arm
Source: main_arm7.elf, 6269.1.00007ffd0d778000.00007ffd0d799000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/main_arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/main_arm7.elf
Source: main_arm7.elf, 6269.1.0000563be86f8000.0000563be8826000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: main_arm7.elf, 6269.1.00007ffd0d778000.00007ffd0d799000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: main_arm7.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f951c017000.00007f951c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main_arm7.elf PID: 6269, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: main_arm7.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f951c017000.00007f951c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main_arm7.elf PID: 6269, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
main_arm7.elf	55%	ReversingLabs	Linux.Backdoor.Mirai
main_arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland		13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
INIT7CH	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.990819399667268
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	main_arm7.elf
File size:	181'466 bytes
MD5:	92aa32a510ec09656a12b83cf865e781
SHA1:	2ece9b43e28f00e14b0bb919b73d74d3fed74f2c
SHA256:	dca351722ab706346b1fb062a5a4938fec99eaa0051e9115705167b7d0a75da5
SHA512:	2126877cc454fc4b4daf132740020fe36851d86a5a000edf55011baa5df8cb496e89c05b6ad5ed8f270dac365a80589133f6566a88ceac333beb78248f68972e
SSDEEP:	3072:OzeSvtfm84oALv2eEQakGzORuGMzw99LEd38YhTfYo+M/RM+FDhdLn:2eSvJkoA7TEQakGzORuBGLEd38+x+M/z
TLSH:	51042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05
File Content Preview:	.ELF..............(.........4....!......4. ...(........p(...(...(...p...p...............................................................df..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	139728
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17450	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f540	0x17540	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f550	0x17550	0x21c0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21710	0x19710	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x21728	0x19728	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29898	0x19898	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2989c	0x1989c	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x298a0	0x198a0	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x298a0	0x198a0	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x298a4	0x198a4	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x298a8	0x198a8	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x298ac	0x198ac	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2996c	0x1996c	0x30c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29c78	0x19c78	0x6284	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19c78	0xeec	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1ab68	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1acc8	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1af06	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d8e5	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e26b	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1f348	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f684	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x20140	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x2196a	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2209a	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x220b0	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22680	0x65d0	0x10	0x0		29	942	4
.strtab	STRTAB	0x0	0x28c50	0x388a	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x19728	0x21728	0x21728	0x170	0x170	4.7208	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19898	0x19898	6.1489	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19898	0x29898	0x29898	0x3e0	0x6664	4.1816	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1989c	0x2989c	0x2989c	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f540	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f550	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x21710	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21728	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x29898	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2989c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x298a0	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x298a0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x298a4	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x298a8	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x298ac	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2996c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x29c78	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f540	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f54c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x976c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb7fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc1e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcdac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd80c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeabc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf29c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf48c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1045c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1187c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1194c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1233c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1262c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1293c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1353c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1354c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13efc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1410c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1508c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1561c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1569c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16224	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1769c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18078	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19530	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aeac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aeb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b44c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b608	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b81c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c09c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c21c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ced4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1daa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e21c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e49c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f4ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298a4	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x298a0	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x914c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa550	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb47c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb7f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f56c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1f590	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xbc30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc1c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2996c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29a28	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xcd90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcda4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a50	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29a54	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29a58	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd7d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xddd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdefc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a5c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xe17c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe7b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeab8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1009c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a60	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x204b4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x29a64	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x10454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11728	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a78	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x12248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x12b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1352c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x13e58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14108	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1412c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1417c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1426c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1432c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14388	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1457c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20650	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14c1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x151b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1568c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x157e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a84	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29a80	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1611c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x206cc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x163d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1641c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16968	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b68	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x206d4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16d48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20758	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1785c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1797c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17dcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b6c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x18b4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1951c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b84	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x195d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19748	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b9c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29c34	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19964	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x212c4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19d58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29c48	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a570	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a9f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aabc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aee0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b550	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b80c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29c60	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1bb3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29c64	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1c010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c19c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c33c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c37c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cc14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d804	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x216c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1da8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e51c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eaf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a74	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x29c70	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x213b0	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x21334	12	OBJECT	<unknown>	DEFAULT	4
C.31.4582	.symtab	0x1f590	44	OBJECT	<unknown>	DEFAULT	4
C.32.4583	.symtab	0x1f56c	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x20650	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x21340	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x20674	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x206a4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x20680	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20698	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x2068c	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x2f930	1	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR	.symtab	0x2f928	4	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR2	.symtab	0x2f970	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x17388	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x173a4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1c034	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x298ac	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x12938	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1293c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x135ec	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x12930	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x12974	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x13610	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x13db0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x12968	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x13580	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x135a4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x135c8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x12898	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x12eb0	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x128e4	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x29c70	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x213b0	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x29898	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x29898	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x29c70	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1ade0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1adc4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x29c74	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x13f08	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d968	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1769c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1ade0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x13fa0	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1ae70	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1af00	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1e460	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1c014	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x120e8	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x120ec	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1ae70	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1ae54	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x2ac7c	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x11264	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x112b8	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1af00	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1aee4	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1aac4	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x17fac	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x17fd0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x17f88	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x2ac5c	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1bad4	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1bba4	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1e460	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1e444	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x176b4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1c034	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x19408	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x178cc	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x19b54	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17940	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1e4d0	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x140d4	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1ade0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x147f4	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1c98c	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1c9c0	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1c664	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x179c8	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x19d68	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x14c64	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x13fa0	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16d64	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1d824	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d968	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x16998	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17110	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x14f94	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a650	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1508c	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x171b0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1e670	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1e694	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1c09c	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x171e8	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d968	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1c1a0	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1c1cc	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1c1e0	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1c1f4	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1410c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1ac4c	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14148	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x17a3c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x14180	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1c208	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x17860	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e2fc	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x19970	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1c21c	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x177c0	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x141c0	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1ea84	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1df60	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x172b0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1df30	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x173c0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1e050	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x172c0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x13de4	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c2fc	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x142b0	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14330	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1ae70	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x149d4	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x14fb4	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1ac94	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x19548	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x19808	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1af00	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x14b48	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1c578	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x14488	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17b0c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17bc4	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x15028	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1c340	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1c380	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14634	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17c90	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x17d4c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x146b8	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17dd4	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x19a68	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13e60	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x17e60	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x17eb0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x17ec4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x146f8	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x150bc	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x17e1c	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19898	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x173e4	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1e130	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1df40	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1df40	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1e21c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17360	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x174d4	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1e260	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1e2b0	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x175a0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x19b74	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x19f78	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x177e4	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x14784	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1c3ec	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x147b4	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x15830	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x150ec	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1ca08	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1ca80	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1ca5c	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1e460	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x298a8	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x298a8	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x135ec	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x13580	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x135a4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x135c8	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1eb00	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f45c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f45c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f440	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f4ec	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1eb00	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f474	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f4bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f4d4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f4a4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f48c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f1a0	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1ef10	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1eaf4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1eafc	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1ee5c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1ee34	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x12740	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1286c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1eeb0	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0xe180	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1ee10	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1262c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12728	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1ee9c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1354c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x13544	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1353c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2f91c	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x29c48	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x2fefc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29c78	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29c78	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1bb50	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1a5ec	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1ade0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1adc4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f3bc	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x29c74	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x2f924	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2996c	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0xec9c	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13f00	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13ef4	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x29a74	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x12884	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f1a0	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x12740	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x298a4	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x2fefc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2f914	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x1f3bc	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe1dc	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1a64c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x21898	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x21728	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2ee88	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x1ee5c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x13f08	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d968	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0xe490	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x298a8	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x298a4	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x1f4ec	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1eeb0	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1ee34	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1ee9c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1ee10	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0xe058	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x2fae4	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x2fec8	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x2fecc	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x2ee8c	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x298a0	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0xebf8	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0xedcc	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x1f3ac	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1c100	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1e528	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1410c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1ac4c	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1769c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x12cf0	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x12dd8	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x13570	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x12d6c	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x12e90	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x13578	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x13654	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x13d68	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x12ff4	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1f3ac	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x298a4	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x298a0	0	NOTYPE	<unknown>	HIDDEN	10
__init_sched_fifo_prio	.symtab	0x11a94	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x2fadc	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x1f3b4	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x178cc	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1ade0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x179c8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1af70	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1aff8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x13fa0	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a650	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x141f8	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x2fed0	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x2fad8	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x14330	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1ae70	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1aa1c	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1af00	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17b0c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17bc4	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x14634	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17c90	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x17d4c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b1d8	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13e60	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x141f8	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2f910	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1e460	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1aa60	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x1148c	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x113f4	152	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x1187c	208	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x11730	332	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x11600	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x11528	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x1c014	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x1f3b4	140	FUNC	<unknown>	HIDDEN	2
__make_stacks_executable	.symtab	0xeabc	8	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x18fd8	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x18078	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x29b6c	24	OBJECT	<unknown>	DEFAULT	14
__malloc_state	.symtab	0x2fb50	888	OBJECT	<unknown>	DEFAULT	15
__malloc_trim	.symtab	0x18f28	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1ef10	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1f3bc	132	FUNC	<unknown>	HIDDEN	2
__nptl_create_event	.symtab	0x120e8	4	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0xeac4	308	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x120ec	4	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x2cc80	1	OBJECT	<unknown>	DEFAULT	15
__nptl_last_event	.symtab	0x2ac70	4	OBJECT	<unknown>	DEFAULT	15
__nptl_nthreads	.symtab	0x29a60	4	OBJECT	<unknown>	DEFAULT	14
__nptl_setxid	.symtab	0xe7c4	688	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x2ac68	8	OBJECT	<unknown>	DEFAULT	15
__open	.symtab	0x1ae70	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1ae54	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2f918	4	OBJECT	<unknown>	DEFAULT	15
__preinit_array_end	.symtab	0x298a0	0	NOTYPE	<unknown>	HIDDEN	9
__preinit_array_start	.symtab	0x298a0	0	NOTYPE	<unknown>	HIDDEN	9
__progname	.symtab	0x29c68	4	OBJECT	<unknown>	DEFAULT	14
__progname_full	.symtab	0x29c6c	4	OBJECT	<unknown>	DEFAULT	14
__pthread_cleanup_pop	.symtab	0x11f1c	56	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x11ff8	240	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x11f54	40	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x11f7c	124	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0xf48c	2692	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x11954	320	FUNC	<unknown>	HIDDEN	2
__pthread_debug	.symtab	0x2fad4	4	OBJECT	<unknown>	HIDDEN	15
__pthread_disable_asynccancel	.symtab	0x11dcc	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x11e54	200	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0xff10	412	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x1233c	752	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x1233c	752	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x2ac7c	8192	OBJECT	<unknown>	DEFAULT	15
__pthread_multiple_threads	.symtab	0x2fae0	4	OBJECT	<unknown>	HIDDEN	15
__pthread_mutex_lock	.symtab	0x10a10	576	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x1045c	1460	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x10a10	576	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x1125c	8	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x10c50	1264	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x1125c	8	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x11140	284	FUNC	<unknown>	HIDDEN	2
__pthread_return_0	.symtab	0x1ba90	8	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x11ae0	748	FUNC	<unknown>	HIDDEN	2
__pthread_unwind	.symtab	0x11264	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x112b8	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x1af00	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1aee4	24	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x100ac	548	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x1aac4	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
__restore_core_regs	.symtab	0x13554	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2f920	4	OBJECT	<unknown>	HIDDEN	15
__sched_fifo_max_prio	.symtab	0x29a7c	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_min_prio	.symtab	0x29a78	4	OBJECT	<unknown>	HIDDEN	14
__set_robust_list_avail	.symtab	0x2faf0	4	OBJECT	<unknown>	HIDDEN	15
__sigaction	.symtab	0xe190	76	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x17fac	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x17fd0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x17f88	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1e3f4	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c028	12	FUNC	<unknown>	DEFAULT	2
__stack_user	.symtab	0x2ac5c	8	OBJECT	<unknown>	DEFAULT	15
__static_tls_align_m1	.symtab	0x2fae8	4	OBJECT	<unknown>	HIDDEN	15
__static_tls_size	.symtab	0x2faec	4	OBJECT	<unknown>	HIDDEN	15
__stdin	.symtab	0x29a90	4	OBJECT	<unknown>	DEFAULT	14
__stdio_READ	.symtab	0x1e854	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1cb3c	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1e8ac	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1cc18	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1e974	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1ea48	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1e9a4	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1cd58	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x15800	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29a94	4	OBJECT	<unknown>	DEFAULT	14

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 16:25:19.192853928 CET	43928	443	192.168.2.23	91.189.91.42
Oct 28, 2024 16:25:39.413866043 CET	42516	80	192.168.2.23	109.202.202.202
Oct 28, 2024 16:25:39.413935900 CET	43928	443	192.168.2.23	91.189.91.42
Oct 28, 2024 16:26:20.368330002 CET	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: main_arm7.elf PID: 6269, Parent PID: 6192

General

Start time (UTC):	15:25:19
Start date (UTC):	28/10/2024
Path:	/tmp/main_arm7.elf
Arguments:	/tmp/main_arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report main_arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: main_arm7.elf PID: 6269, Parent PID: 6192

General

Chronological Activities

Linux Analysis Report
main_arm7.elf