Edit tour

Linux Analysis Report
RpcSecurity.arm7.elf

Overview

General Information

Sample name:	RpcSecurity.arm7.elf
Analysis ID:	1581161
MD5:	63559d2751b8fa7972e8bb3c0f583075
SHA1:	c65d17a31fd5520780d0341e2304c273c88bac4f
SHA256:	1c3cbb053407cdddd7e476757271fd7069fd020934cd75e623581ff18060113f
Tags:	elfGafgytuser-lontze7
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581161
Start date and time:	2024-12-27 06:40:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	RpcSecurity.arm7.elf
Detection:	MAL
Classification:	mal76.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/RpcSecurity.arm7.elf
PID:	5430
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

RpcSecurity.arm7.elf (PID: 5430, Parent: 5354, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/RpcSecurity.arm7.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RpcSecurity.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
RpcSecurity.arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5430.1.00007f64e0017000.00007f64e002b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: RpcSecurity.arm7.elf PID: 5430	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x37cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3809:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x381d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3831:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3845:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3859:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x386d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3881:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3895:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x390d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3921:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3935:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3949:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x395d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RpcSecurity.arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: RpcSecurity.arm7.elf	Virustotal: Detection: 65%			Perma Link
Source: RpcSecurity.arm7.elf	ReversingLabs: Detection: 65%

Source: /tmp/RpcSecurity.arm7.elf (PID: 5430)

Socket: 192.168.2.13:9473

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: RpcSecurity.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5430.1.00007f64e0017000.00007f64e002b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: RpcSecurity.arm7.elf PID: 5430, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_ovhudp
Source: ELF static info symbol of initial sample	Name: attack_method_std
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex

Source: RpcSecurity.arm7.elf	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: RpcSecurity.arm7.elf	ELF static info symbol of initial sample: hexPayload

Source: RpcSecurity.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5430.1.00007f64e0017000.00007f64e002b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: RpcSecurity.arm7.elf PID: 5430, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.linELF@0/0@2/0

Source: /tmp/RpcSecurity.arm7.elf (PID: 5430)

Queries kernel information via 'uname':

Jump to behavior

Source: RpcSecurity.arm7.elf, 5430.1.00007ffdd8294000.00007ffdd82b5000.rw-.sdmp	Binary or memory string: \|x86_64/usr/bin/qemu-arm/tmp/RpcSecurity.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/RpcSecurity.arm7.elf
Source: RpcSecurity.arm7.elf, 5430.1.000056479421f000.000056479434d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: RpcSecurity.arm7.elf, 5430.1.00007ffdd8294000.00007ffdd82b5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: RpcSecurity.arm7.elf, 5430.1.000056479421f000.000056479434d000.rw-.sdmp	Binary or memory string: GV!/etc/qemu-binfmt/arm
Source: RpcSecurity.arm7.elf, 5430.1.00007ffdd8294000.00007ffdd82b5000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: RpcSecurity.arm7.elf, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: RpcSecurity.arm7.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RpcSecurity.arm7.elf	66%	Virustotal		Browse
RpcSecurity.arm7.elf	66%	ReversingLabs	Linux.Exploit.Mirai
RpcSecurity.arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.D

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	RpcSecurity.ppc.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	kitsune.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	kitsune.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	byte.arm5.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	RpcSecurity.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	RpcSecurity.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	RpcSecurity.spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	RpcSecurity.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	RpcSecurity.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	RpcSecurity.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	db0fa4b8db0333367e9bda3ab68b8042.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	RpcSecurity.ppc.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	RpcSecurity.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	RpcSecurity.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.sh.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mipsel.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.964290225841751
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	RpcSecurity.arm7.elf
File size:	135'877 bytes
MD5:	63559d2751b8fa7972e8bb3c0f583075
SHA1:	c65d17a31fd5520780d0341e2304c273c88bac4f
SHA256:	1c3cbb053407cdddd7e476757271fd7069fd020934cd75e623581ff18060113f
SHA512:	11a15a7a11c0029d20f86108fc65379f1725997fe6bdc2e3832d281bb51eace128cac98cf6ea942841d999eebc2bc4992e00ca37e97230a66c1c402669ad7a8e
SSDEEP:	3072:BxioDMQI5nrwaO4nt3qZg2IWu6b4JX7LkDM/98PmPw/t93:DioDtI5rnnt3qZgPWjWX74DM/9smPw/f
TLSH:	BDD34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06
File Content Preview:	.ELF..............(.........4...........4. ...(........p.:...........................................;...;...............@...@...@......Tx...............@...@...@..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	107784
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1197c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19a6c	0x11a6c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19a7c	0x11a7c	0x2034	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x1bab0	0x13ab0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1bac8	0x13ac8	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x24000	0x14000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x24004	0x14004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x24004	0x14004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x24008	0x14008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2400c	0x1400c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x24010	0x14010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x240b8	0x140b8	0x71c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x247d4	0x147d4	0x7080	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x147d4	0x94c	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x15120	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x151e0	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x153f3	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x17116	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x177a8	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x18170	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x18428	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x18cf2	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x19e81	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1a3d9	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a3ef	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a990	0x4650	0x10	0x0		28	648	4
.strtab	STRTAB	0x0	0x1efe0	0x22e5	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x13ac8	0x1bac8	0x1bac8	0x118	0x118	4.4591	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x13be0	0x13be0	6.1623	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x14000	0x24000	0x24000	0x7d4	0x7854	4.6042	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x14004	0x24004	0x24004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x19a6c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x19a7c	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1bab0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1bac8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x24000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x24004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x24004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x24008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2400c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x24010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x240b8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x247d4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19a6c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x19a78	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x85c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x997c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xad38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc31c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf92c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10408	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x105a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x107c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10be4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10db8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10de8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1108c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1113c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11224	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1156c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11668	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11cac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1328c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13acc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13c18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1423c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1428c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1525c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1538c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1556c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1570c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1574c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1582c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x167f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1693c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1790c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17efc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1832c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1836c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1856c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18608	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x191dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x935c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb44c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbb7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc0bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc7b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xddbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x240b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x240bc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x240c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xebc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x240c4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xed88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x245c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x245cc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x245d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x245d4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xf91c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf984	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfa54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfb30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfb60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfbfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x245d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x10978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10be0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10ce4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10d28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3d4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x11210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11274	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1153c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1161c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1175c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x117e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11828	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11968	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11af0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11bd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x245dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x127ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ba8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1304c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x130a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x245f4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13270	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x133e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1348c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2460c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x246a4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13604	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x137e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x139f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13aac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1481c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14948	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14db0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246d0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x152d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15300	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15568	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15748	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x157a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15e2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16154	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x167ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x246f0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x246ec	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x16cec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1709c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1880c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x191b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x246dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b47e	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x246e4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1b77e	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x1b45c	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1b3d4	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x1b468	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1baa4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1ba80	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1ba98	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1ba8c	12	OBJECT	<unknown>	DEFAULT	4
KillStructure	.symtab	0x240c4	1284	OBJECT	<unknown>	DEFAULT	13
LOCAL_ADDR	.symtab	0x2b2d4	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x11368	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x11384	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x247f8	16384	OBJECT	<unknown>	DEFAULT	14
_Exit	.symtab	0x15400	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x24010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x185c0	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x185c4	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x19274	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x185b8	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x185fc	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x19298	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x19a38	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x185f0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x19208	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1922c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x19250	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x18520	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x18b38	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1856c	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x246dc	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1b47e	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x246e4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1b77e	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x24000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x24000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x246dc	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x246e4	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x14980	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x14964	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x246e0	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x246e8	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x11224	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x108e8	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x170b4	300	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x14980	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x10980	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x14a10	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x14b30	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x14aa0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x14a10	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x149f4	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x14b30	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x14b14	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x11cd0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x11cf4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x11cac	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14d48	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14e18	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x14aa0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x14a84	24	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x15400	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x130a8	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x115b0	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x137f4	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x11624	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x17f54	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x14980	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x10de8	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x15db8	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x15dec	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x15a90	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x116ac	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x13a08	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x15e34	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x10980	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16d08	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x167f8	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x170b4	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1693c	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x171e0	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x16164	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1428c	972	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x15468	100	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x170b4	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1556c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x15598	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x155ac	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x155c0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x155d4	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x146f0	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x155fc	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x11720	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x15634	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x15674	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x11544	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x17a8c	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x13610	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x10a88	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x179ec	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x10b68	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x117ac	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1836c	112	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x11280	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x11290	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x18308	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x112a0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1525c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x15688	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x156cc	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1574c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x14a10	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x10fc8	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x14738	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x131e8	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x134a8	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x14b30	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x1113c	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x159a4	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x10be4	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x11830	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x118e8	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x157ac	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x10c68	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x119b4	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x11a70	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x10cec	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x11af8	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x13708	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x15304	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x11b84	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x11bd4	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x11be8	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x10d2c	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14828	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x11b40	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x13538	216	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x114c0	132	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17730	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x17820	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x17710	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x17710	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x113a0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1790c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x11340	96	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x17950	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x179a0	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x113c4	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x13814	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x13c18	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17a10	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x10db8	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x15818	20	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x14aa0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2400c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x2400c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x19274	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x19208	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1922c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x19250	36	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x183dc	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x18508	24	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x153b0	8	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x107c0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x108bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x191d4	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x191cc	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x191c4	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x28d6c	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x246b8	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2b854	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x247d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x247d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14dc4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x14980	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x14964	24	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x246e0	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x246e8	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x2b2d0	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x240b8	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x153a4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x15398	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x108d4	20	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x183dc	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x24008	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2b854	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x28d64	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x11224	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1bbe0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1bac8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x28814	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x108e8	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x170b4	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2400c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x24008	0	NOTYPE	<unknown>	HIDDEN	10
__fork	.symtab	0x1428c	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x2b820	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2b824	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x28818	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x24004	0	OBJECT	<unknown>	DEFAULT	9
__getdents	.symtab	0x154cc	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x17fb8	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x155d4	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x146f0	72	FUNC	<unknown>	DEFAULT	2
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x18978	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x18a60	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x191f8	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x189f4	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x18b18	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x19200	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x192dc	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x199f0	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x18c7c	1352	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x24008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x24004	0	NOTYPE	<unknown>	HIDDEN	9
__libc_accept	.symtab	0x115b0	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x14980	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x116ac	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x14ba0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x14c28	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x10980	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1428c	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x2b828	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1574c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x14a10	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x14b30	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x11830	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x118e8	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x10c68	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x119b4	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x11a70	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x17c88	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x15304	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x28d60	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x14aa0	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x14658	152	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x12c78	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x11d18	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x245dc	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x2b4a8	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x12bc8	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x14a10	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x149f4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x28d68	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x24004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x24004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x246d4	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x246d8	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x17eb8	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x14d0c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14d04	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14d04	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14d04	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14d04	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x14b30	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x14b14	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x191dc	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x28d70	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x11cd0	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x11cf4	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x11cac	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1832c	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x17fac	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x246fc	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x18100	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x18158	220	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x18234	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x18264	164	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x167c8	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x24700	4	OBJECT	<unknown>	DEFAULT	13
__sys_accept	.symtab	0x1156c	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x11668	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x117ec	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x118a0	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x11970	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x11a24	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x152d8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1570c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x153c0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x10c24	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x17c64	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x14d48	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14e18	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x14e70	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x246d0	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x107c0	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x14aa0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x14a84	24	FUNC	<unknown>	DEFAULT	2
__xstat32_conv	.symtab	0x158f8	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1582c	204	FUNC	<unknown>	HIDDEN	2
_bss_end__	.symtab	0x2b854	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x17ec4	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x17efc	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x2b84c	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x2b850	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x2b840	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x2b83c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2b844	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2b834	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x17bfc	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x2b830	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x2b848	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x2b838	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x2b82c	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x247d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2b854	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x15400	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x19a6c	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x28d94	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x17280	0	FUNC	<unknown>	HIDDEN	2
_pthread_cleanup_pop_restore	.symtab	0x14d1c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14d14	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x1538c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x2b4a0	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x16184	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x165e4	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x24704	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x28d74	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x16a58	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x28d90	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x28d80	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x28d8c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x24708	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x16664	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x246ec	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x13830	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x130a8	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x115b0	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
anti_gdb_entry	.symtab	0xed78	24	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x137f4	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x137f4	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8554	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x84e8	108	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x9360	1564	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x85c4	1388	FUNC	<unknown>	DEFAULT	2
attack_method.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_method_nudp	.symtab	0xddd0	1908	FUNC	<unknown>	DEFAULT	2
attack_method_ovhudp	.symtab	0xd3e4	2540	FUNC	<unknown>	DEFAULT	2
attack_method_std	.symtab	0xbb80	732	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0x9080	736	FUNC	<unknown>	DEFAULT	2
attack_method_stdplain	.symtab	0xc0c0	604	FUNC	<unknown>	DEFAULT	2
attack_method_synurgplain	.symtab	0xad38	1816	FUNC	<unknown>	DEFAULT	2
attack_method_tcpack	.symtab	0xcc5c	1928	FUNC	<unknown>	DEFAULT	2
attack_method_tcpplain	.symtab	0xb450	1840	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstomp	.symtab	0x9e68	1972	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstrong	.symtab	0xa61c	1820	FUNC	<unknown>	DEFAULT	2
attack_method_udpbypass	.symtab	0xbe5c	612	FUNC	<unknown>	DEFAULT	2
attack_method_udpgeneric	.symtab	0x997c	1260	FUNC	<unknown>	DEFAULT	2
attack_method_udphex	.symtab	0x8b30	688	FUNC	<unknown>	DEFAULT	2
attack_method_udpkick	.symtab	0xc31c	1180	FUNC	<unknown>	DEFAULT	2
attack_method_udpplain	.symtab	0x8de0	672	FUNC	<unknown>	DEFAULT	2
attack_method_udpvse	.symtab	0xc7b8	1188	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0x82cc	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x81d0	252	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x28810	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x11624	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x17f54	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x11be8	196	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x240bc	4	OBJECT	<unknown>	DEFAULT	13
calloc	.symtab	0x126c8	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xe544	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xe594	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x11244	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x14980	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x10de8	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x247d4	1	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x116ac	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ensure_single_instance	.symtab	0xedd4	352	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x28d64	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x13a08	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fclose	.symtab	0x15e34	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x10980	244	FUNC	<unknown>	DEFAULT	2
fd	.symtab	0x2b33c	4	OBJECT	<unknown>	DEFAULT	14
fd_ctrl	.symtab	0x245c8	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x245cc	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x10ef8	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x1108c	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x16d08	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x167f8	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x170b4	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1693c	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x171e0	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x16164	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1428c	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x2881c	1348	OBJECT	<unknown>	DEFAULT	14
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x12e2c	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x15468	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_eit_entry	.symtab	0x18608	544	FUNC	<unknown>	DEFAULT	2
getc	.symtab	0x167f8	324	FUNC	<unknown>	DEFAULT	2
getc_unlocked	.symtab	0x170b4	300	FUNC	<unknown>	DEFAULT	2
getdents.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdents64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1556c	44	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x15598	20	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x155ac	20	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x155c0	20	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpagesize	.symtab	0x155d4	40	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x146f0	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x10a74	20	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x155fc	56	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x11720	68	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x11764	72	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gettimeofday	.symtab	0x15634	64	FUNC	<unknown>	DEFAULT	2
gettimeofday.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x15674	20	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x4	4	TLS	<unknown>	DEFAULT	8
hexPayload	.symtab	0x240b8	4	OBJECT	<unknown>	DEFAULT	13
i	.symtab	0x2b340	4	OBJECT	<unknown>	DEFAULT	14
i.4215	.symtab	0x240c0	4	OBJECT	<unknown>	DEFAULT	13
index	.symtab	0x17730	240	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x11544	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x17a8c	248	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
init_static_tls	.symtab	0x17b84	120	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x13344	192	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x13610	248	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x10a88	224	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ioctl_keepalive	.symtab	0xef34	480	FUNC	<unknown>	DEFAULT	2
ioctl_pid	.symtab	0x287f8	4	OBJECT	<unknown>	DEFAULT	14
isatty	.symtab	0x179ec	36	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x10b68	56	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_kill_by_port	.symtab	0xe638	1420	FUNC	<unknown>	DEFAULT	2
killerinit	.symtab	0xed18	96	FUNC	<unknown>	DEFAULT	2
killerkillbyname	.symtab	0xebc4	340	FUNC	<unknown>	DEFAULT	2
killerpid	.symtab	0x2b344	4	OBJECT	<unknown>	DEFAULT	14
libc-cancellation.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-lowlevellock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc-tls.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc_multiple_threads.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listen	.symtab	0x117ac	64	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
local_bind.4783	.symtab	0x245d4	1	OBJECT	<unknown>	DEFAULT	13
lseek64	.symtab	0x1836c	112	FUNC	<unknown>	DEFAULT	2
main	.symtab	0xf114	1980	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc	.symtab	0x11d90	2360	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x13068	64	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x11280	4	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x11290	4	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x18308	36	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x112a0	156	FUNC	<unknown>	DEFAULT	2
methods	.symtab	0x247f4	4	OBJECT	<unknown>	DEFAULT	14
methods_len	.symtab	0x247f0	1	OBJECT	<unknown>	DEFAULT	14
mmap	.symtab	0x1525c	124	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mremap	.symtab	0x15688	68	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
munmap	.symtab	0x156cc	64	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x245f4	24	OBJECT	<unknown>	DEFAULT	13
mylock	.symtab	0x2460c	24	OBJECT	<unknown>	DEFAULT	13
nanosleep	.symtab	0x1574c	96	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nprocessors_onln	.symtab	0x13acc	332	FUNC	<unknown>	DEFAULT	2
object.5113	.symtab	0x247d8	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x14a10	100	FUNC	<unknown>	DEFAULT	2
opendir	.symtab	0x10fc8	196	FUNC	<unknown>	DEFAULT	2
opendir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
parse_config.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pending_connection	.symtab	0x287fc	1	OBJECT	<unknown>	DEFAULT	14
pidPath	.symtab	0x2b2d8	100	OBJECT	<unknown>	DEFAULT	14
pr-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x10ba0	68	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
program_invocation_name	.symtab	0x246d8	4	OBJECT	<unknown>	DEFAULT	13
program_invocation_short_name	.symtab	0x246d4	4	OBJECT	<unknown>	DEFAULT	13
raise	.symtab	0x14738	240	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x131d0	24	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_alpha_str	.symtab	0xf994	208	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0xf92c	104	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0xf8d0	92	FUNC	<unknown>	DEFAULT	2
rand_str	.symtab	0xfa64	220	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x131e8	164	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1b3ec	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x134a8	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x24624	128	OBJECT	<unknown>	DEFAULT	13
read	.symtab	0x14b30	100	FUNC	<unknown>	DEFAULT	2
readdir	.symtab	0x1113c	232	FUNC	<unknown>	DEFAULT	2
readdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readdir64	.symtab	0x159a4	236	FUNC	<unknown>	DEFAULT	2
readdir64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
readlink	.symtab	0x10be4	64	FUNC	<unknown>	DEFAULT	2
readlink.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x12808	960	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x11830	112	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x118e8	136	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
register-atfork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolve_cnc_addr	.symtab	0xed90	68	FUNC	<unknown>	DEFAULT	2
resolve_func	.symtab	0x245d0	4	OBJECT	<unknown>	DEFAULT	13

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 06:41:25.786369085 CET	48202	443	192.168.2.13	185.125.190.26
Dec 27, 2024 06:41:58.042126894 CET	48202	443	192.168.2.13	185.125.190.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 06:41:21.871591091 CET	48804	53	192.168.2.13	1.1.1.1
Dec 27, 2024 06:41:21.871651888 CET	54330	53	192.168.2.13	1.1.1.1
Dec 27, 2024 06:41:22.021167040 CET	53	54330	1.1.1.1	192.168.2.13
Dec 27, 2024 06:41:22.107925892 CET	53	48804	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 06:41:21.871591091 CET	192.168.2.13	1.1.1.1	0x6b98	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 06:41:21.871651888 CET	192.168.2.13	1.1.1.1	0x8767	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 06:41:22.107925892 CET	1.1.1.1	192.168.2.13	0x6b98	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 27, 2024 06:41:22.107925892 CET	1.1.1.1	192.168.2.13	0x6b98	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: RpcSecurity.arm7.elf PID: 5430, Parent PID: 5354

General

Start time (UTC):	05:41:13
Start date (UTC):	27/12/2024
Path:	/tmp/RpcSecurity.arm7.elf
Arguments:	/tmp/RpcSecurity.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report RpcSecurity.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: RpcSecurity.arm7.elf PID: 5430, Parent PID: 5354

General

Chronological Activities

Linux Analysis Report
RpcSecurity.arm7.elf