Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:	arm7.elf
Analysis ID:	1579338
MD5:	361ad5318a419b87901ee5e007df7f01
SHA1:	26b5b5c4b12084b0809b079c04380b5e20889ae1
SHA256:	20fd8a6487fa9be0ccc353b5cbd9a2852081ee0f221a617a6d40030981b40153
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Moobot

Contains symbols with names commonly found in malware

Enumerates processes within the "proc" file system

Sample and/or dropped files contains symbols with suspicious names

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579338
Start date and time:	2024-12-21 19:36:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm7.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/0@0/0

Warnings

Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:	/tmp/arm7.elf
PID:	6243
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	OWARI09123id9i123xd912
Standard Error:

Process Tree

system is lnxubuntu20

arm7.elf (PID: 6243, Parent: 6164, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf

arm7.elf New Fork (PID: 6245, Parent: 6243)

arm7.elf New Fork (PID: 6247, Parent: 6243)

arm7.elf New Fork (PID: 6248, Parent: 6243)

arm7.elf New Fork (PID: 6251, Parent: 6248)

arm7.elf New Fork (PID: 6252, Parent: 6248)

arm7.elf New Fork (PID: 6259, Parent: 6248)

arm7.elf New Fork (PID: 6382, Parent: 6248)

arm7.elf New Fork (PID: 6384, Parent: 6382)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm7.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
arm7.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
arm7.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a190:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
arm7.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x19a80:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a190:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x19a80:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a190:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x19a80:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a190:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x19a80:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: arm7.elf PID: 6243	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: arm7.elf PID: 6243	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: arm7.elf PID: 6243	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3e2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ea5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ecd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ee1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ef5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.elf PID: 6243	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3d17:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: arm7.elf PID: 6247	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: arm7.elf PID: 6247	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x14182:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14196:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1420e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14222:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14236:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1424a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1425e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14272:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14286:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1429a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14312:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.elf PID: 6247	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1406c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: arm7.elf PID: 6252	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: arm7.elf PID: 6252	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: arm7.elf PID: 6252	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x141c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.elf PID: 6252	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1306:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 24 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm7.elf	Virustotal: Detection: 57%			Perma Link
Source: arm7.elf	ReversingLabs: Detection: 63%

System Summary

Malicious sample detected (through community Yara rule)

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: arm7.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: arm7.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_ovh

Source: arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: arm7.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.troj.linELF@0/0@0/0

Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6073/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4444/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4445/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4446/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4447/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1860/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6384/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6264/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4486/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6382/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4477/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/4510/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 6251)	File opened: /proc/2074/cmdline	Jump to behavior

Source: /tmp/arm7.elf (PID: 6243)

Queries kernel information via 'uname':

Jump to behavior

Source: arm7.elf, 6243.1.000055ea306b3000.000055ea30802000.rw-.sdmp, arm7.elf, 6247.1.000055ea306b3000.000055ea30802000.rw-.sdmp, arm7.elf, 6252.1.000055ea306b3000.000055ea30802000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.elf, 6243.1.000055ea306b3000.000055ea30802000.rw-.sdmp, arm7.elf, 6247.1.000055ea306b3000.000055ea30802000.rw-.sdmp, arm7.elf, 6252.1.000055ea306b3000.000055ea30802000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 6243.1.00007ffc1f52c000.00007ffc1f54d000.rw-.sdmp, arm7.elf, 6247.1.00007ffc1f52c000.00007ffc1f54d000.rw-.sdmp, arm7.elf, 6252.1.00007ffc1f52c000.00007ffc1f54d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 6243.1.00007ffc1f52c000.00007ffc1f54d000.rw-.sdmp, arm7.elf, 6247.1.00007ffc1f52c000.00007ffc1f54d000.rw-.sdmp, arm7.elf, 6252.1.00007ffc1f52c000.00007ffc1f54d000.rw-.sdmp	Binary or memory string: jgx86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6252.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007fa02c017000.00007fa02c033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6243, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 6252, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm7.elf	57%	Virustotal		Browse
arm7.elf	63%	ReversingLabs	Linux.Backdoor.Mirai
arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.0491285621643796
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.elf
File size:	173'688 bytes
MD5:	361ad5318a419b87901ee5e007df7f01
SHA1:	26b5b5c4b12084b0809b079c04380b5e20889ae1
SHA256:	20fd8a6487fa9be0ccc353b5cbd9a2852081ee0f221a617a6d40030981b40153
SHA512:	2472650c58123537d8eea7e7567db06d8d6638dc0d5c79c9cda1f81d67167ac10023c2190a2c838d016be42730b0d193515b457441e09bc080a60156d357afde
SSDEEP:	3072:SsdHf6qiW4Cd6JwsmVhLXphfGiaUfsKB3rYmWVaEWKF85+LYRM/9TvgE:SsdHf6qqCd6RiXrOiaUfsKBcmAN25+Lh
TLSH:	14042B46EA414B23C0D7177AFA9F414A3322D794D3D7730699286FB43FC669E0E63A06
File Content Preview:	.ELF..............(.........4...X*......4. ...(........p.....;...;.......................................................................5..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	141912
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1997c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x21a6c	0x19a6c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x21a80	0x19a80	0x20f0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x23b70	0x1bb70	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x23b88	0x1bb88	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2c000	0x1c000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2c004	0x1c004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2c004	0x1c004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2c008	0x1c008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c00c	0x1c00c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2c010	0x1c010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2c0b8	0x1c0b8	0x204	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2c2bc	0x1c2bc	0x333c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1c2bc	0xb0e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1cdd0	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1cf10	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1d123	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1f166	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1f848	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x206c0	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x20978	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x21242	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x223d1	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x22929	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2293f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22ee0	0x4f40	0x10	0x0		28	729	4
.strtab	STRTAB	0x0	0x27e20	0x2858	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1bb88	0x23b88	0x23b88	0x118	0x118	4.4916	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1bca0	0x1bca0	6.1717	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1c000	0x2c000	0x2c000	0x2bc	0x35f8	3.9523	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1c004	0x2c004	0x2c004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x21a6c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x21a80	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x23b70	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x23b88	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2c000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2c004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2c004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2c008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2c00c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2c010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2c0b8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2c2bc	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x21a6c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x21a78	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa19c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe84c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xede4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf4bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14eb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1615c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1619c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1816c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ce8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1976c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a71c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1abc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aedc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1affc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b81c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b95c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c7d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e43c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f2d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f74c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f9c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2038c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x204cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2056c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x205b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x205c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x205c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x205f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x205fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20608	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x209f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x212dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x219f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xab48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb18c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbea0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc54c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd9b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf4b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf8f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfbf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1109c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x110f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x111e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c0bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c0c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x11948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x228eb	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x228f4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ea8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x15ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x160d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x161dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1625c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x162a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x163c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1656c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22b14	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x166fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1672c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1685c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1700c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22b54	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x172c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1730c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22b5c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22be0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17d14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17dcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18ccc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1952c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1969c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19808	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x198c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1996c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c0fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c194	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19a14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19bd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2374c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19ed8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c1a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1a0d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1add8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b18c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c1c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b88c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c7a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cc00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cde4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c1d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2c1d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1d030	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23b28	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1df48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eb38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ec28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f2a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f3b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f8ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f9c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2080c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x211b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x2c1cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x237da	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x237b8	12	OBJECT	<unknown>	DEFAULT	4
C.43.5774	.symtab	0x228f4	3	OBJECT	<unknown>	DEFAULT	4
C.44.5775	.symtab	0x228eb	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x22b14	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x237c4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x22b2c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x23b00	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x23adc	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x23af4	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x23ae8	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x2ee04	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x17a88	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x17aa4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1b890	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2c010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x205c0	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x205c4	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x21274	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x205b8	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x205fc	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x21298	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x21a38	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x205f0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x21208	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x2122c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x21250	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x20520	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x20b38	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x2056c	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2c1cc	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x237da	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2c000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2c000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2c1cc	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x1ae10	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1adf4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2c1d0	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x16710	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x15e60	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1e310	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x17b8c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1ae10	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x15ef8	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1aea0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1afc0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1af30	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1aea0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1ae84	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1afc0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1afa4	24	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x1b1d8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1b2a8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1af30	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1af14	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x17ba4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1b890	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x19588	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x19cd4	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17cd8	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1f364	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1ae10	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x162d4	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1c2d4	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1c308	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1bfac	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x17d60	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x19ee8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1c484	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x15ef8	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1df64	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1da54	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1e310	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1db98	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1e43c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1c7b4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a71c	972	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x17888	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1f510	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1f534	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1b8f8	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x178c0	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1e310	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1b9fc	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1ba28	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1ba3c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1ba50	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1ba64	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1ab80	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1ba8c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x17dd4	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x1bac4	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1bb04	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x17cb0	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1ee9c	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x19af0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x16000	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1edfc	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x160e0	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1fa64	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1e970	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x17980	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17990	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1fa00	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1ea60	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x179a0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1b6ec	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1bb18	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1bb5c	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1bbdc	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1aea0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x164b4	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1abc8	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x196c8	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x19988	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1afc0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x16628	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1bec0	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x1615c	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17ea4	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17f5c	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1bc3c	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x161e0	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x18028	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x180e4	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x16264	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1816c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x19be8	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1b794	136	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1bca8	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1acb8	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x16764	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x181b4	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19a18	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1eb40	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1ec30	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x17a40	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x17a40	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1ed1c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17a60	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x17ac0	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1ed60	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1edb0	76	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x19cf4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1a0f8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1ee20	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x162a4	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1bd34	20	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x16794	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1c350	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1c3c8	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1c3a4	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1af30	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2c00c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2c00c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x21274	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x21208	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x2122c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x21250	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1fae0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x2043c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x2043c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x20420	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x204cc	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1fae0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x20454	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x2049c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x204b4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x20484	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x2046c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x20180	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1fef0	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1fad4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1fadc	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1fe3c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1fe14	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x15d08	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x15e34	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1fe90	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x1b840	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1fdf0	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x15bf4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x15cf0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1fe7c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x211d4	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x211cc	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x211c4	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2c898	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2c1a8	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2f5f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2c2bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2c2bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1b254	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1ae10	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1adf4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x2039c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2c1d0	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2edfc	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2c0b8	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x1b834	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1b828	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x15e4c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x20180	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x15d08	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2c008	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2f5f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2c890	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x2039c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x16710	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x23ca0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x23b88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2c340	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1fe3c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x15e60	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1e310	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2c00c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x2c008	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x204cc	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1fe90	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1fe14	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1fe7c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1fdf0	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x1a71c	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2f5c4	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2f5c8	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2c344	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x2c004	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x2038c	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1b95c	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1f3c8	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1ba64	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1ab80	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x17b8c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x20978	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x20a60	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x211f8	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x209f4	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x20b18	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x21200	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x212dc	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x219f0	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x20c7c	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x2038c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2c008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2c004	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x20394	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x1ae10	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x17d60	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1b030	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1b0b8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x15ef8	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a71c	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2f5cc	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1bbdc	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1aea0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1afc0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17ea4	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17f5c	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x161e0	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x18028	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x180e4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1f098	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1b794	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2c88c	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x1af30	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x1aae8	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x20394	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x19158	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x181f8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2c0cc	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2f24c	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x190a8	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1fef0	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x2039c	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x1aea0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1ae84	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2c894	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2c004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2c004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x2c1c4	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2c1c8	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1f2c8	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1b19c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x1b194	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x1b194	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x1b194	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x1b194	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x1afc0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1afa4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x211dc	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2c89c	4	OBJECT	<unknown>	HIDDEN	14
__sigjmp_save	.symtab	0x1fa24	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1f3bc	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2c1e4	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1f6f4	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1f74c	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1f828	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1cc34	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1f8f0	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1f9c4	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1f920	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1cf58	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1d034	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2c1e8	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1fadc	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x17d1c	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x17e60	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x17f14	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x17fe4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x18098	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1b768	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1bb9c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x1b850	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1619c	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1f074	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x1b1d8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1b2a8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1b300	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2c1c0	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x15bf4	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x1af30	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x1af14	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x17ba4	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1be14	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1bd48	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2c330	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2f5f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x16864	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x2f1fc	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x2f224	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2c0c8	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1f2d4	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1f30c	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2f5f0	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2f5f4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2f5e4	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2f5e0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2f5e8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2f5d8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1f00c	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2f5d4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2f5ec	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2f5dc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2f5d0	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2c2bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2f5f8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x1b890	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x21a6c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2c8c0	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x168b8	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1d260	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1d064	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1e4e0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x17030	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x17318	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x170d0	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x17114	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x172c4	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1b1ac	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x1b1a4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1b81c	8	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1c7d4	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1cd74	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2c1ec	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2c8a0	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1dcb4	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2c8bc	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2c8ac	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2c8b8	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x2c1f0	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x1cdf4	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2c1d4	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x19d10	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1d0d8	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x22bf0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1d104	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1693c	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x19588	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
adb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_auth_entry	.symtab	0x11d6c	352	FUNC	<unknown>	DEFAULT	2
antidebug.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x19cd4	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x19cd4	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app_http	.symtab	0x81d0	8048	FUNC	<unknown>	DEFAULT	2
attack_get_opt_int	.symtab	0xa520	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0xa4b4	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0xa140	92	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0xb888	1564	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0xa590	1548	FUNC	<unknown>	DEFAULT	2
attack_method_nudp	.symtab	0x10564	1668	FUNC	<unknown>	DEFAULT	2
attack_method_ovh	.symtab	0xbea4	1708	FUNC	<unknown>	DEFAULT	2
attack_method_std	.symtab	0xe84c	760	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstomp	.symtab	0xe098	1972	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstorm	.symtab	0xd9b4	1764	FUNC	<unknown>	DEFAULT	2
attack_method_udpgame	.symtab	0xf4bc	1080	FUNC	<unknown>	DEFAULT	2
attack_method_udpgeneric	.symtab	0xfc18	1280	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0xa298	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0xa19c	252	FUNC	<unknown>	DEFAULT	2
attack_tcp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_tcp_ack	.symtab	0xb190	1784	FUNC	<unknown>	DEFAULT	2
attack_tcp_bypass	.symtab	0xd308	1708	FUNC	<unknown>	DEFAULT	2
attack_tcp_legit	.symtab	0xab9c	1524	FUNC	<unknown>	DEFAULT	2
attack_tcp_sack2	.symtab	0xcc18	1776	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0xc550	1736	FUNC	<unknown>	DEFAULT	2
attack_udp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_udp_custom	.symtab	0x10118	1100	FUNC	<unknown>	DEFAULT	2
attack_udp_plain	.symtab	0xede4	672	FUNC	<unknown>	DEFAULT	2
attack_udp_rand	.symtab	0xeb44	672	FUNC	<unknown>	DEFAULT	2
attack_udp_stdhex	.symtab	0xf8f4	804	FUNC	<unknown>	DEFAULT	2
attack_udp_vse	.symtab	0xf084	1080	FUNC	<unknown>	DEFAULT	2
auth_table	.symtab	0x2c324	4	OBJECT	<unknown>	DEFAULT	14
auth_table_len	.symtab	0x2c2f8	4	OBJECT	<unknown>	DEFAULT	14
auth_table_max_weight	.symtab	0x2c328	2	OBJECT	<unknown>	DEFAULT	14
been_there_done_that	.symtab	0x2c33c	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x17cd8	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1f364	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x18ba8	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x10be8	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x10c38	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x16730	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1ae10	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x162d4	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x2c2bc	1	OBJECT	<unknown>	DEFAULT	14
conn_table	.symtab	0x2ee00	4	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x17d60	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x2c890	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x19ee8	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x23b28	72	OBJECT	<unknown>	DEFAULT	4
fake_time	.symtab	0x2c32c	4	OBJECT	<unknown>	DEFAULT	14
fclose	.symtab	0x1c484	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x15ef8	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x2c0b8	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x2c0bc	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x163e4	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x16578	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x1df64	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x1da54	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1e310	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1db98	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1e43c	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x23b10	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1c7b4	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1a71c	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x2c348	1348	OBJECT	<unknown>	DEFAULT	14
fputs_unlocked	.symtab	0x17888	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1930c	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x1f510	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x1f510	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x1f534	448	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x1b8f8	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x178c0	188	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_eit_entry	.symtab	0x20608	544	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x1da54	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x1e310	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1b9fc	44	FUNC	<unknown>	DEFAULT	2

Network Behavior

⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

System Behavior

Analysis Process: arm7.elf PID: 6243, Parent PID: 6164

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	/tmp/arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6245, Parent PID: 6243

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6247, Parent PID: 6243

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6248, Parent PID: 6243

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6251, Parent PID: 6248

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6252, Parent PID: 6248

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6259, Parent PID: 6248

General

Start time (UTC):	18:36:55
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6382, Parent PID: 6248

General

Start time (UTC):	18:40:18
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: arm7.elf PID: 6384, Parent PID: 6382

General

Start time (UTC):	18:40:18
Start date (UTC):	21/12/2024
Path:	/tmp/arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

System Behavior

Analysis Process: arm7.elf PID: 6243, Parent PID: 6164

General

Chronological Activities

Analysis Process: arm7.elf PID: 6245, Parent PID: 6243

General

Chronological Activities

Analysis Process: arm7.elf PID: 6247, Parent PID: 6243

General

Chronological Activities

Analysis Process: arm7.elf PID: 6248, Parent PID: 6243

General

Chronological Activities

Analysis Process: arm7.elf PID: 6251, Parent PID: 6248

General

Chronological Activities

Analysis Process: arm7.elf PID: 6252, Parent PID: 6248

General

Chronological Activities

Analysis Process: arm7.elf PID: 6259, Parent PID: 6248

General

Chronological Activities

Analysis Process: arm7.elf PID: 6382, Parent PID: 6248

General

Chronological Activities

Linux Analysis Report
arm7.elf