Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:	arm7.elf
Analysis ID:	1554850
MD5:	f59d09396d046502ee2347214882b344
SHA1:	d0367be9ec8f7f6cd1e177357a51e53ae93500d7
SHA256:	5dd1c4290df953a105e4ba6dc84da14249f3f03121e139db6be79a8324f8b774
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554850
Start date and time:	2024-11-13 01:23:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm7.elf
Detection:	MAL
Classification:	mal60.troj.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/arm7.elf
PID:	6215
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Onboard the boat
Standard Error:

Process Tree

system is lnxubuntu20

arm7.elf (PID: 6215, Parent: 6130, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf

arm7.elf New Fork (PID: 6217, Parent: 6215)

arm7.elf New Fork (PID: 6220, Parent: 6217)

arm7.elf New Fork (PID: 6221, Parent: 6217)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: arm7.elf	ReversingLabs: Detection: 26%
Source: arm7.elf	Virustotal: Detection: 24%			Perma Link

Source: arm7.elf

String: (deleted)/proc//exe/proc/self/exewgettftpcurlftpget/proc/proc/%s/cmdline/.

Source: global traffic

TCP traffic: 192.168.2.23:53462 -> 154.213.187.125:51321

Source: /tmp/arm7.elf (PID: 6215)

Socket: 127.0.0.1:51101

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 154.213.187.125

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: classification engine

Classification label: mal60.troj.linELF@0/1@0/0

Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6239/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6221)	File opened: /proc/256/cmdline	Jump to behavior

Source: /tmp/arm7.elf (PID: 6215)

Queries kernel information via 'uname':

Jump to behavior

Source: arm7.elf, 6215.1.00007ffee557a000.00007ffee559b000.rw-.sdmp	Binary or memory string: 2x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf
Source: arm7.elf, 6215.1.0000563eba0d7000.0000563eba226000.rw-.sdmp	Binary or memory string: >V!/etc/qemu-binfmt/arm
Source: arm7.elf, 6215.1.0000563eba0d7000.0000563eba226000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 6215.1.00007ffee557a000.00007ffee559b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: arm7.elf, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: arm7.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm7.elf	26%	ReversingLabs	Linux.Backdoor.Gafgyt
arm7.elf	25%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
154.213.187.125	unknown	Seychelles	22769	DDOSING-BGP-NETWORKUS	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
154.213.187.125	garm.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	gmips.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	gx86.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	x86.elf	Get hash	malicious	Unknown	Browse
	c0r0n4x.arm.elf	Get hash	malicious	Unknown	Browse
	c0r0n4x.mpsl.elf	Get hash	malicious	Unknown	Browse
	c0r0n4x.mips.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	main_mpsl.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	yakuza.mips.elf	Get hash	malicious	Unknown	Browse
	yakuza.arm6.elf	Get hash	malicious	Unknown	Browse
	yakuza.arm7.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	x86.elf	Get hash	malicious	Unknown	Browse
	c0r0n4x.arm.elf	Get hash	malicious	Unknown	Browse
	c0r0n4x.mpsl.elf	Get hash	malicious	Unknown	Browse
	c0r0n4x.mips.elf	Get hash	malicious	Unknown	Browse
	main_arm.elf	Get hash	malicious	Mirai	Browse
	main_mpsl.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	yakuza.mips.elf	Get hash	malicious	Unknown	Browse
	yakuza.arm6.elf	Get hash	malicious	Unknown	Browse
	yakuza.arm7.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gmips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	c0r0n4x.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	c0r0n4x.ppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	c0r0n4x.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	c0r0n4x.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	gmips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	c0r0n4x.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	c0r0n4x.ppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	c0r0n4x.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	c0r0n4x.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_m68k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	c0r0n4x.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	c0r0n4x.mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	c0r0n4x.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	yakuza.arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	yakuza.arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
DDOSING-BGP-NETWORKUS	garm.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	x86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gmips.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	arm.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	gx86.elf	Get hash	malicious	Unknown	Browse	154.213.187.125
	mpsl.b.elf	Get hash	malicious	Mirai	Browse	154.213.187.68
	arm.b.elf	Get hash	malicious	Unknown	Browse	154.213.187.68
	mirai.m68k.elf	Get hash	malicious	Unknown	Browse	154.213.189.2
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	154.213.189.2
	mirai.sh4.elf	Get hash	malicious	Unknown	Browse	154.213.189.2

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.LnwBPC (deleted)

Download File

Process:	/tmp/arm7.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:TgiLG:TgiC
MD5:	451AC90F7FA61D0393D6A5A02158D369
SHA1:	5A7D458802462B80F94A9CDA24E2C877437A8E34
SHA-256:	E2D543300D643CEF7698E750F74E8499993E346EF765FA2061EB5DFAF8D77E48
SHA-512:	EF1D000F5B8BB5AFD4F6CB347FBE0FA0E97608B8C3839B6B44CB9828E5522396B334AE37148FCD2064A423B3DDD0C8874EF7019023A84B36E3893E50353F06FE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm7.elf.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.934564604130946
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.elf
File size:	138'927 bytes
MD5:	f59d09396d046502ee2347214882b344
SHA1:	d0367be9ec8f7f6cd1e177357a51e53ae93500d7
SHA256:	5dd1c4290df953a105e4ba6dc84da14249f3f03121e139db6be79a8324f8b774
SHA512:	91151d5164019eb6a4762bb709721b6a5ee3154e976cf609fe1fec9f32b84c48afdb4fb7cc1233c422efeda1ac3e34539384ad1ead45b2de7d6f0821278d8fc9
SSDEEP:	3072:rdmX612TajonKQ6Lde9by/PjesElM/9d45:r0KwTajonKQQdPnjesGM/9u5
TLSH:	EAD32A46EB418B13C0D62775BBDF424633239B6493EB33069928AFF43F8679A4E27505
File Content Preview:	.ELF..............(.........4...p.......4. ...(........p./...........................................0...0...............0...0...0.......s...............0...0...0..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	105584
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x11c48	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19d38	0x11d38	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19d48	0x11d48	0x1278	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1afc0	0x12fc0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1afd8	0x12fd8	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x230f0	0x130f0	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x230f4	0x130f4	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x230f4	0x130f4	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x230f8	0x130f8	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x230fc	0x130fc	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x23100	0x13100	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x231a8	0x131a8	0x20c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x233b8	0x133b4	0x70d0	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x133b4	0xc2e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x13fe8	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x14128	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1433b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1637e	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x16a60	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x178d8	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x17b90	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1845a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x195e9	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x19b41	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x19b57	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a0f8	0x53b0	0x10	0x0		28	765	4
.strtab	STRTAB	0x0	0x1f4a8	0x2a07	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x12fd8	0x1afd8	0x1afd8	0x118	0x118	4.4662	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x130f0	0x130f0	6.0910	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x130f0	0x230f0	0x230f0	0x2c4	0x7398	3.9531	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x130f4	0x230f4	0x230f4	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19d38	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19d48	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1afc0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1afd8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x230f0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x230f4	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x230f4	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x230f8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x230fc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x23100	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x231a8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x233b8	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19d38	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19d44	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x822c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x878c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb3b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbbc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbd68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc6e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd20c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd27c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd45c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd4f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd67c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd97c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdafc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdbb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdbf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdde8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1088c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1092c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1108c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11174	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1122c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1180c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1302c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1370c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1414c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1422c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1431c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1453c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1465c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1505c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1509c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15178	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1531c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1535c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1543c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17458	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1778c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17880	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1788c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1888c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x230f8	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x230f4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8330	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x908c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9fa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xab6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d64	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19d88	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19db4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19dc0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19dcc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xb850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbb04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbbac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbd08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x231a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x231ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x231b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19eb0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc6d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc758	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc7bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc90c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x231b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x231b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xc9e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xccd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x231bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xd1f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xd974	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdaac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdb30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdb74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdbb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdbec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdcb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdcf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdde4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe228	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a264	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe3b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe490	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x231cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x231c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xf76c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2d4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xfa20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xffb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x232b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1a2dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x104c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a360	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1116c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1145c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11510	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1155c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1162c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x232b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x122e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1269c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x232cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x232e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2337c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aecc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x134ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x135a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23390	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x136e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14310	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1443c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14570	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14954	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x233a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x158c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15d14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af78	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16a4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17764	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x18ad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x231c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19f64	0	NOTYPE	<unknown>	DEFAULT	4
C.11.4264	.symtab	0x19dcc	44	OBJECT	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x1af3c	12	OBJECT	<unknown>	DEFAULT	4
C.23.4521	.symtab	0x19dc0	12	OBJECT	<unknown>	DEFAULT	4
C.24.4522	.symtab	0x19db4	12	OBJECT	<unknown>	DEFAULT	4
C.40.4873	.symtab	0x19d88	44	OBJECT	<unknown>	DEFAULT	4
C.41.4874	.symtab	0x19d64	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1a264	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x1af48	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1a27c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1a2ac	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1a288	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1a2a0	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1a294	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x29ef4	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x10c98	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10cb4	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x2341c	16384	OBJECT	<unknown>	DEFAULT	14
_Exit	.symtab	0x14ef0	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x23100	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1888c	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x18890	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x19540	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x18884	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x188c8	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x19564	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x19d04	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x188bc	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x194d4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x194f8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1951c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x187ec	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x18e04	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x18838	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x231c0	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x19f64	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x230f0	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x230f0	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x231c0	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x14470	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x14454	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x231c4	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0xe474	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xd8e4	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x16928	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x10f10	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x14470	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xd97c	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x14500	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x14620	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x14590	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x14500	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x144e4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x14620	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x14604	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x117c4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x117e8	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x117a0	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14838	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14908	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x14590	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x14574	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x10f28	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14ef0	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x12b9c	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x11174	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x132e8	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x111e8	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17828	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xdab0	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x14470	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xdf90	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x15850	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x15884	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x15528	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x11270	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x134fc	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0xe500	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xd97c	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x104e0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x167e4	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x16928	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0xffe8	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1088c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0xe830	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x13d80	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1092c	56	FUNC	<unknown>	HIDDEN	2
__GI_fread	.symtab	0x10104	300	FUNC	<unknown>	HIDDEN	2
__GI_fread_unlocked	.symtab	0x10964	384	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x179d4	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x179f8	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x14f58	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10ae4	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x16928	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1505c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15088	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1509c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x150b0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x150c4	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x141e4	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x150ec	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x112e4	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x15124	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x15164	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x11108	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x17360	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x13104	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x15178	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x11068	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xdafc	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x11370	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x15258	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x17d2c	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x16f00	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10ba0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x16ef0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x16ff0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x17014	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10bb0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x14d4c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x15298	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x152dc	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1535c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x14500	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xe170	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1422c	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x12cdc	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x12f9c	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x14620	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0xe2e4	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1543c	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0xdb78	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x113f4	112	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x153bc	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xdc34	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x114a8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x11564	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xdcb8	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x115ec	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x131fc	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x14df4	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x11678	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x116c8	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x116dc	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0xdcf8	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1431c	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0xe850	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x11634	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1302c	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0xdd84	100	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x10cd0	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x170f4	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x171e4	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x10c50	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x10c50	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x172d0	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x11034	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10c70	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x10cf8	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x10dc4	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x17314	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x10e14	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x13308	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1370c	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1108c	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xdde8	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x15428	20	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xe880	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x158cc	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15944	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15920	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x14590	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x230fc	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x230fc	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x19540	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x194d4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x194f8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1951c	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x17eec	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0xd840	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0xd840	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0xd824	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x18798	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x17eec	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0xd858	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0xd8a0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0xd8b8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0xd888	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0xd870	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1858c	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x182fc	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x17ee0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x17ee8	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x18248	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x18220	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x17d9c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x17ec8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1829c	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x14ea0	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x181fc	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xd67c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xd778	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x18288	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x194a0	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x19498	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x19490	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x299a4	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x23390	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2a488	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x233b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x233b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x148b4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x14470	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x14454	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0xd7a0	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x231c4	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x29ee8	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x231a8	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x14e94	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x14e88	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xd8d0	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1858c	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x17d9c	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x230f8	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2a488	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2999c	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0xd7a0	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe474	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1b0f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1afd8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2944c	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x18248	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xd8e4	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x16928	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x230fc	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x230f8	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x18798	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1829c	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x18220	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x18288	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x181fc	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x13d80	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2a454	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2a458	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x29450	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x230f4	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0xd790	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x14fbc	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1788c	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x150c4	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x141e4	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x10f10	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x18c44	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x18d2c	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x194c4	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x18cc0	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x18de4	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x194cc	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x195a8	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x19cbc	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x18f48	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0xd790	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x230f8	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x230f4	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0xd798	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x11174	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x14470	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x11270	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x14690	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x14718	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0xd97c	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x13d80	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2a45c	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1535c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x14500	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x14620	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x113f4	112	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xdc34	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x114a8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x11564	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1755c	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x14df4	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x29998	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x14590	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x1414c	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0xd798	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1276c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1180c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x232b4	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2a0dc	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x126bc	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x182fc	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0xd7a0	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x14500	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x144e4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x299a0	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x230f4	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x230f4	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x233ac	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x233b0	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1778c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x147fc	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x147f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x147f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x147f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x147f4	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x14620	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x14604	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x194a8	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x299a8	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x117c4	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x117e8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x117a0	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x17cec	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x17880	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x231d8	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x15a00	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x15a58	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x17bb8	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x15b34	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x17c80	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x17cb0	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x15c74	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x15d18	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xef94	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x231dc	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x17ee8	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x11130	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x1122c	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x113b0	68	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x11464	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x11518	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x14dc8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1531c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x14eb0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0xdbf0	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x17538	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x14838	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14908	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14960	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x233a8	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0xd67c	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x14590	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x14574	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x10f28	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0xdee4	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0xde18	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2943c	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2a488	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xefc4	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2a084	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x2a0ac	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x232b0	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x17798	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x177d0	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2a480	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2a484	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2a474	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2a470	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2a478	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2a468	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x174d0	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2a464	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2a47c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2a46c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2a460	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x233b4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2a488	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x14ef0	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19d38	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2743c	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xf018	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x15ff0	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x15df4	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x16a60	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0xf790	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0xfa78	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0xf830	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0xf874	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0xfa24	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1480c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14804	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x14e7c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x2a0d4	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0xe950	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xedb0	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x231e0	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2741c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x10230	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x27438	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x27428	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x27434	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x231e4	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0xee30	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x231c8	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x13324	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x15e68	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1a370	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x15e94	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xf09c	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x12b9c	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x11174	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0xda70	64	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x132e8	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x132e8	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8720	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x86b4	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x81d0	92	FUNC	<unknown>	DEFAULT	2
attack_gre.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_gre_ip	.symtab	0x8a74	1564	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x878c	744	FUNC	<unknown>	DEFAULT	2
attack_kill_all	.symtab	0x8340	344	FUNC	<unknown>	DEFAULT	2
attack_ongoing	.symtab	0x233dc	32	OBJECT	<unknown>	DEFAULT	14
attack_parse	.symtab	0x8498	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x822c	276	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0x9fb0	2148	FUNC	<unknown>	DEFAULT	2
attack_tcp_bypass	.symtab	0xa814	860	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0x9838	1912	FUNC	<unknown>	DEFAULT	2
attack_tcp_wra	.symtab	0x9090	1960	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_bypass	.symtab	0xab70	664	FUNC	<unknown>	DEFAULT	2
attack_udp_custom	.symtab	0xb3b4	1184	FUNC	<unknown>	DEFAULT	2
attack_udp_plain	.symtab	0xae08	776	FUNC	<unknown>	DEFAULT	2
attack_udp_rhex	.symtab	0xb110	676	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x29448	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x111e8	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17828	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x116dc	196	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x231b4	4	OBJECT	<unknown>	DEFAULT	13
calloc	.symtab	0x121bc	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chdir	.symtab	0xdab0	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xb854	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xb8a4	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0xe494	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x14470	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0xdf90	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x233b8	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x11270	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
current_time	.symtab	0x29f0c	4	OBJECT	<unknown>	DEFAULT	14
difftime	.symtab	0xe4c8	56	FUNC	<unknown>	DEFAULT	2
difftime.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dir	.symtab	0x29f68	4	OBJECT	<unknown>	DEFAULT	14
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ensure_single_instance	.symtab	0xbd68	356	FUNC	<unknown>	DEFAULT	2
entry	.symtab	0x29f08	4	OBJECT	<unknown>	DEFAULT	14
environ	.symtab	0x2999c	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exe_path	.symtab	0x29f54	20	OBJECT	<unknown>	DEFAULT	14
exit	.symtab	0x134fc	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1af78	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0xe500	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xd97c	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x231a8	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x231ac	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0xe0a0	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0xe234	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x104e0	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 01:24:05.872517109 CET	53462	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:05.877330065 CET	51321	53462	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:05.877394915 CET	53462	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:05.890922070 CET	53462	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:05.895822048 CET	51321	53462	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:05.895868063 CET	53462	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:05.900624037 CET	51321	53462	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:06.883738041 CET	51321	53462	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:06.884006023 CET	53462	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:06.888868093 CET	51321	53462	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:07.886003971 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:07.890918970 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:07.890981913 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:07.900798082 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:07.905677080 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:07.905740023 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:07.910557032 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:08.433141947 CET	43928	443	192.168.2.23	91.189.91.42
Nov 13, 2024 01:24:14.064394951 CET	42836	443	192.168.2.23	91.189.91.43
Nov 13, 2024 01:24:15.600219965 CET	42516	80	192.168.2.23	109.202.202.202
Nov 13, 2024 01:24:17.909843922 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:17.914737940 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:18.173173904 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:24:18.173310995 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:24:28.910367012 CET	43928	443	192.168.2.23	91.189.91.42
Nov 13, 2024 01:24:41.196707964 CET	42836	443	192.168.2.23	91.189.91.43
Nov 13, 2024 01:24:45.292187929 CET	42516	80	192.168.2.23	109.202.202.202
Nov 13, 2024 01:25:09.864813089 CET	43928	443	192.168.2.23	91.189.91.42
Nov 13, 2024 01:25:18.199791908 CET	53464	51321	192.168.2.23	154.213.187.125
Nov 13, 2024 01:25:18.204706907 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:25:18.462841034 CET	51321	53464	154.213.187.125	192.168.2.23
Nov 13, 2024 01:25:18.462901115 CET	53464	51321	192.168.2.23	154.213.187.125

System Behavior

Analysis Process: arm7.elf PID: 6215, Parent PID: 6130

General

Start time (UTC):	00:24:04
Start date (UTC):	13/11/2024
Path:	/tmp/arm7.elf
Arguments:	/tmp/arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6217, Parent PID: 6215

General

Start time (UTC):	00:24:04
Start date (UTC):	13/11/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6220, Parent PID: 6217

General

Start time (UTC):	00:24:05
Start date (UTC):	13/11/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6221, Parent PID: 6217

General

Start time (UTC):	00:24:05
Start date (UTC):	13/11/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.LnwBPC (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: arm7.elf PID: 6215, Parent PID: 6130

General

Chronological Activities

Analysis Process: arm7.elf PID: 6217, Parent PID: 6215

General

Chronological Activities

Analysis Process: arm7.elf PID: 6220, Parent PID: 6217

General

Chronological Activities

Analysis Process: arm7.elf PID: 6221, Parent PID: 6217

General

Chronological Activities

Linux Analysis Report
arm7.elf