Edit tour

Linux Analysis Report
main.arm7.elf

Overview

General Information

Sample name:	main.arm7.elf
Analysis ID:	1584170
MD5:	d9431471c0459d22f4925ccfc6fe4df0
SHA1:	18e598f06f4ff72ad97a43a13e12ce45c6f26be7
SHA256:	ae1c8e595dd3e599c37b0424bd7a8b3f141bc95d4fde208e1e977803c0f9dc71
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584170
Start date and time:	2025-01-04 14:45:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	main.arm7.elf
Detection:	MAL
Classification:	mal76.troj.evad.linELF@0/0@1/0

Runtime Messages

Command:	/tmp/main.arm7.elf
PID:	5564
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

main.arm7.elf (PID: 5564, Parent: 5487, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/main.arm7.elf

main.arm7.elf New Fork (PID: 5566, Parent: 5564)

main.arm7.elf New Fork (PID: 5568, Parent: 5566)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
main.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
main.arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17da4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17db8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
main.arm7.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17ae8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5564.1.00007efc98017000.00007efc98031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5564.1.00007efc98017000.00007efc98031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17da4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17db8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5564.1.00007efc98017000.00007efc98031000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17ae8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: main.arm7.elf PID: 5564	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: main.arm7.elf PID: 5564	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x113a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x114e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1162:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1176:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1202:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1216:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1252:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1266:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: main.arm7.elf PID: 5564	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1020:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: main.arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: main.arm7.elf	Virustotal: Detection: 55%			Perma Link
Source: main.arm7.elf	ReversingLabs: Detection: 55%

Source: global traffic

TCP traffic: 192.168.2.15:42838 -> 102.211.232.40:3778

Source: global traffic

DNS traffic detected: DNS query: lemonsmp.work.gd

System Summary

Malicious sample detected (through community Yara rule)

Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5564.1.00007efc98017000.00007efc98031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5564.1.00007efc98017000.00007efc98031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: main.arm7.elf PID: 5564, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: main.arm7.elf PID: 5564, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: main.arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/telnetsshwatchdogsshd/usr/compress/bin//compress/bin/compress/usr/bashmain_x86main_x86_64main_mipsmain_mipselmain_armmain_arm5main_arm6main_arm7main_ppcmain_m68kmain_sh4main_spchttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//tmp/var/mnt/boot/home/dev/..//root(deleted)/proc/self/exe

Source: /tmp/main.arm7.elf (PID: 5568)

SIGKILL sent: pid: 2, result: successful

Jump to behavior

Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5564.1.00007efc98017000.00007efc98031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5564.1.00007efc98017000.00007efc98031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: main.arm7.elf PID: 5564, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: main.arm7.elf PID: 5564, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/main.arm7.elf (PID: 5564)

File: /tmp/main.arm7.elf

Jump to behavior

Source: /tmp/main.arm7.elf (PID: 5564)

Queries kernel information via 'uname':

Jump to behavior

Source: main.arm7.elf, 5564.1.00005620215c3000.0000562021712000.rw-.sdmp	Binary or memory string: ]! V!/etc/qemu-binfmt/arm
Source: main.arm7.elf, 5564.1.00007ffc08671000.00007ffc08692000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/main.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/main.arm7.elf
Source: main.arm7.elf, 5564.1.00005620215c3000.0000562021712000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: main.arm7.elf, 5564.1.00007ffc08671000.00007ffc08692000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: main.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5564.1.00007efc98017000.00007efc98031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main.arm7.elf PID: 5564, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: main.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5564.1.00007efc98017000.00007efc98031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main.arm7.elf PID: 5564, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
main.arm7.elf	56%	Virustotal		Browse
main.arm7.elf	55%	ReversingLabs	Linux.Backdoor.Mirai
main.arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
lemonsmp.work.gd	102.211.232.40	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
102.211.232.40	lemonsmp.work.gd	unknown		36926	CKL1-ASNKE	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
102.211.232.40	main.sh4.elf	Get hash	malicious	Mirai	Browse
	main.x86.elf	Get hash	malicious	Mirai	Browse
	main.ppc.elf	Get hash	malicious	Mirai	Browse
	main.m68k.elf	Get hash	malicious	Mirai	Browse
	main.mpsl.elf	Get hash	malicious	Mirai	Browse
	main.mips.elf	Get hash	malicious	Mirai	Browse
	main.x86_64.elf	Get hash	malicious	Mirai	Browse
	fuckunix.x86_64.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lemonsmp.work.gd	main.sh4.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.x86.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.ppc.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.m68k.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.mpsl.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.mips.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.x86_64.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	fuckunix.spc.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	fuckunix.x86_64.elf	Get hash	malicious	Mirai	Browse	102.211.232.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CKL1-ASNKE	main.arm5.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.sh4.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.x86.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.ppc.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.m68k.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.mpsl.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.mips.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	main.x86_64.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	fuckunix.x86_64.elf	Get hash	malicious	Mirai	Browse	102.211.232.40
	fuckunix.mpsl.elf	Get hash	malicious	Mirai	Browse	102.242.130.110

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.991503117717285
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	main.arm7.elf
File size:	180'738 bytes
MD5:	d9431471c0459d22f4925ccfc6fe4df0
SHA1:	18e598f06f4ff72ad97a43a13e12ce45c6f26be7
SHA256:	ae1c8e595dd3e599c37b0424bd7a8b3f141bc95d4fde208e1e977803c0f9dc71
SHA512:	6d483002071f7783033a2c05937824848eb03ba64df2f198702e82d0a48d1fc03f07673979a6b0932b2d37672afa86c0cd78083fb1c5b44be78a2ca5c9a39221
SSDEEP:	3072:FOd9jTrBng+7DaIQDuhZ3wdnqYL8h2QQhuoFM/RG9Ps1Oz:YdBrBguDaIQDuhZA7L8h2QGXFM/RF1Oz
TLSH:	A3042A45EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05
File Content Preview:	.ELF..............(.........4...H ......4. ...(........p............p...p...........................H...H...............H...H...H.......df..............L...L...L...................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	139336
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x172f0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f3e0	0x173e0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f3f0	0x173f0	0x21d0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x215c0	0x195c0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x215d8	0x195d8	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29748	0x19748	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2974c	0x1974c	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x29750	0x19750	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29750	0x19750	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x29754	0x19754	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29758	0x19758	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2975c	0x1975c	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2981c	0x1981c	0x30c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29b28	0x19b28	0x6284	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19b28	0xeb6	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a9e0	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1ab40	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ad7e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d75d	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e0e3	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1f1c0	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f4fc	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1ffb8	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x217e2	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21f12	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21f28	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x224f8	0x64e0	0x10	0x0		29	931	4
.strtab	STRTAB	0x0	0x289d8	0x382a	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x195d8	0x215d8	0x215d8	0x170	0x170	4.7371	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19748	0x19748	6.1497	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19748	0x29748	0x29748	0x3e0	0x6664	4.1062	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1974c	0x2974c	0x2974c	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f3e0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f3f0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x215c0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x215d8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x29748	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2974c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x29750	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x29750	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x29754	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x29758	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2975c	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2981c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x29b28	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f3e0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f3ec	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbbd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc89c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcdac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd63c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdeec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf27c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf46c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1008c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1043c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1185c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1192c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11efc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1231c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1260c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12918	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1291c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12948	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12db8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1351c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1352c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1451c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1572c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1575c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1606c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1610c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1703c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1795c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1980c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1addc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ade4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b624	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1beb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c19c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ced0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dde0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1def0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e19c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e33c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e370	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e74c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f38c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29754	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29750	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x970c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb79c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f40c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1f430	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xbbd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xccc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2981c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x298d8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xcd34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcda8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29900	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29904	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29908	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd62c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdcd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xded4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2990c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xe15c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe228	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe288	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe594	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf460	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1007c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29910	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20364	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x29914	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x10434	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1128c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11d94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29928	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x12228	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x12b64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1350c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x13e38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1410c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1415c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1419c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1424c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1428c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1430c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1455c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1471c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20500	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14eb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15514	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29934	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29930	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x16048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2057c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x162fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a18	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20584	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16c74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20608	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1777c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17858	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1789c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17954	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17998	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ba8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17dcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x188a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a1c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x189e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18da4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1929c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a34	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1946c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x195e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a4c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29ae4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19800	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x198f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21174	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29af8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a40c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a8f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aad8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b044	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b884	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b10	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1b9dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b14	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1beb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c03c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c18c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c21c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c284	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ccd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21578	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d92c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dee8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dfc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e28c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e990	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29924	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x29b20	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x21260	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x211e4	12	OBJECT	<unknown>	DEFAULT	4
C.31.4582	.symtab	0x1f430	44	OBJECT	<unknown>	DEFAULT	4
C.32.4583	.symtab	0x1f40c	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x20500	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x211f0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x20524	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x20554	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x20530	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20548	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x2053c	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x2f7e0	1	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR	.symtab	0x2f7d8	4	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR2	.symtab	0x2f820	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x172a8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x172c4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1bed4	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2975c	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x12918	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1291c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x135cc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x12910	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x12954	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x135f0	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x13d90	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x12948	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x13560	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x13584	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x135a8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x12878	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x12e90	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x128c4	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x29b20	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x21260	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x29748	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x29748	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x29b20	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1ac80	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1ac64	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x29b24	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x13ee8	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d808	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x175bc	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1ac80	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x13f80	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1ad10	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1ada0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1e300	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1beb4	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x120c8	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x120cc	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1ad10	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1acf4	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x2ab2c	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x11244	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x11298	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1ada0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1ad84	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1a960	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x17ecc	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x17ef0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x17ea8	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x2ab0c	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1b974	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1ba44	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1e300	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1e2e4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x175d4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1bed4	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x192a4	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x177ec	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x199f0	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17860	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1e370	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x140b4	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1ac80	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x14720	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1c82c	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1c860	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1c504	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x178e8	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x19c04	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x14b90	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x13f80	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16c90	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1d6c4	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d808	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x168c4	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1703c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x14ec0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a4ec	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x14fb8	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x170dc	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1e510	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1e534	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1bf3c	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x17114	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d808	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1c040	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1c06c	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1c080	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1c094	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x140ec	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1aae8	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14128	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1795c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x14160	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1c0a8	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x17780	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e19c	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1980c	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1c0bc	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x176e0	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x141a0	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1e924	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1de00	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x171d0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1ddd0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x172e0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1def0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x171e0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x13dc4	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c19c	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x14290	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14310	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1ad10	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x14900	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x14ee0	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1ab30	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x193e4	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x196a4	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1ada0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x14a74	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1c418	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x143b4	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17a2c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17ae4	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x14f54	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1c1e0	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1c220	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14560	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17bb0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x17c6c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x145e4	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17cf4	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x19904	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13e40	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x17d80	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x17dd0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x17de4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x14624	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x14fe8	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x17d3c	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19734	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17304	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1dfd0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1dde0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1dde0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1e0bc	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17280	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x173f4	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1e100	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1e150	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x174c0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x19a10	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x19e14	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17704	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x146b0	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1c28c	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x146e0	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1575c	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x15018	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1c8a8	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1c920	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1c8fc	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1e300	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x29758	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x29758	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x135cc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x13560	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x13584	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x135a8	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1e9a0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f2fc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f2fc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f2e0	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f38c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1e9a0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f314	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f35c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f374	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f344	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f32c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f040	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1edb0	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1e994	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1e99c	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1ecfc	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1ecd4	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x12720	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1284c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1ed50	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0xe160	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1ecb0	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1260c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12708	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1ed3c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1352c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x13524	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1351c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2f7cc	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x29af8	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x2fdac	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29b28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29b28	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1b9f0	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1a488	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1ac80	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1ac64	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f25c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x29b24	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x2f7d4	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2981c	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0xec7c	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13ee0	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13ed4	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x29924	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x12864	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f040	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x12720	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x29754	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x2fdac	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2f7c4	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x1f25c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe1bc	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1a4e8	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x21748	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x215d8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2ed38	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x1ecfc	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x13ee8	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d808	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0xe470	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x29758	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x29754	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x1f38c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1ed50	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1ecd4	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1ed3c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1ecb0	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0xe038	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x2f994	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x2fd78	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x2fd7c	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x2ed3c	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x29750	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0xebd8	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0xedac	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x1f24c	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1bfa0	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1e3c8	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x140ec	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1aae8	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x175bc	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x12cd0	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x12db8	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x13550	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x12d4c	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x12e70	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x13558	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x13634	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x13d48	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x12fd4	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1f24c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x29754	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x29750	0	NOTYPE	<unknown>	HIDDEN	10
__init_sched_fifo_prio	.symtab	0x11a74	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x2f98c	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x1f254	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x177ec	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1ac80	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x178e8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1ae10	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1ae98	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x13f80	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a4ec	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x141d8	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x2fd80	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x2f988	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x14310	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1ad10	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1a8b8	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1ada0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17a2c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17ae4	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x14560	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17bb0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x17c6c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b078	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13e40	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x141d8	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2f7c0	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1e300	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1a8fc	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x1146c	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x113d4	152	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x1185c	208	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x11710	332	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x115e0	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x11508	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x1beb4	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x1f254	140	FUNC	<unknown>	HIDDEN	2
__make_stacks_executable	.symtab	0xea9c	8	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x18e74	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x17f14	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x29a1c	24	OBJECT	<unknown>	DEFAULT	14
__malloc_state	.symtab	0x2fa00	888	OBJECT	<unknown>	DEFAULT	15
__malloc_trim	.symtab	0x18dc4	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1edb0	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1f25c	132	FUNC	<unknown>	HIDDEN	2
__nptl_create_event	.symtab	0x120c8	4	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0xeaa4	308	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x120cc	4	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x2cb30	1	OBJECT	<unknown>	DEFAULT	15
__nptl_last_event	.symtab	0x2ab20	4	OBJECT	<unknown>	DEFAULT	15
__nptl_nthreads	.symtab	0x29910	4	OBJECT	<unknown>	DEFAULT	14
__nptl_setxid	.symtab	0xe7a4	688	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x2ab18	8	OBJECT	<unknown>	DEFAULT	15
__open	.symtab	0x1ad10	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1acf4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2f7c8	4	OBJECT	<unknown>	DEFAULT	15
__preinit_array_end	.symtab	0x29750	0	NOTYPE	<unknown>	HIDDEN	9
__preinit_array_start	.symtab	0x29750	0	NOTYPE	<unknown>	HIDDEN	9
__progname	.symtab	0x29b18	4	OBJECT	<unknown>	DEFAULT	14
__progname_full	.symtab	0x29b1c	4	OBJECT	<unknown>	DEFAULT	14
__pthread_cleanup_pop	.symtab	0x11efc	56	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x11fd8	240	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x11f34	40	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x11f5c	124	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0xf46c	2692	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x11934	320	FUNC	<unknown>	HIDDEN	2
__pthread_debug	.symtab	0x2f984	4	OBJECT	<unknown>	HIDDEN	15
__pthread_disable_asynccancel	.symtab	0x11dac	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x11e34	200	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0xfef0	412	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x1231c	752	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x1231c	752	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x2ab2c	8192	OBJECT	<unknown>	DEFAULT	15
__pthread_multiple_threads	.symtab	0x2f990	4	OBJECT	<unknown>	HIDDEN	15
__pthread_mutex_lock	.symtab	0x109f0	576	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x1043c	1460	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x109f0	576	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x1123c	8	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x10c30	1264	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x1123c	8	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x11120	284	FUNC	<unknown>	HIDDEN	2
__pthread_return_0	.symtab	0x1b930	8	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x11ac0	748	FUNC	<unknown>	HIDDEN	2
__pthread_unwind	.symtab	0x11244	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x11298	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x1ada0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1ad84	24	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x1008c	548	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x1a960	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
__restore_core_regs	.symtab	0x13534	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2f7d0	4	OBJECT	<unknown>	HIDDEN	15
__sched_fifo_max_prio	.symtab	0x2992c	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_min_prio	.symtab	0x29928	4	OBJECT	<unknown>	HIDDEN	14
__set_robust_list_avail	.symtab	0x2f9a0	4	OBJECT	<unknown>	HIDDEN	15
__sigaction	.symtab	0xe170	76	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x17ecc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x17ef0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x17ea8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1e294	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1bec8	12	FUNC	<unknown>	DEFAULT	2
__stack_user	.symtab	0x2ab0c	8	OBJECT	<unknown>	DEFAULT	15
__static_tls_align_m1	.symtab	0x2f998	4	OBJECT	<unknown>	HIDDEN	15
__static_tls_size	.symtab	0x2f99c	4	OBJECT	<unknown>	HIDDEN	15
__stdin	.symtab	0x29940	4	OBJECT	<unknown>	DEFAULT	14
__stdio_READ	.symtab	0x1e6f4	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1c9dc	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1e74c	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1cab8	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1e814	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1e8e8	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1e844	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1cbf8	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1572c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29944	4	OBJECT	<unknown>	DEFAULT	14
__subdf3	.symtab	0x1e99c	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x177a8	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x178a4	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x179e8	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x17a9c	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x17b6c	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x17c20	76	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 14:46:34.582226038 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:46:34.586987019 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:46:34.587069035 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:46:34.601739883 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:46:34.606633902 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:46:34.606676102 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:46:34.611397982 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:46:44.611608028 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:46:44.616517067 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:46:44.958549976 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:46:44.958621025 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:47:45.012049913 CET	42838	3778	192.168.2.15	102.211.232.40
Jan 4, 2025 14:47:45.016916037 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:47:45.358850956 CET	3778	42838	102.211.232.40	192.168.2.15
Jan 4, 2025 14:47:45.358953953 CET	42838	3778	192.168.2.15	102.211.232.40

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 14:46:34.565594912 CET	36598	53	192.168.2.15	8.8.8.8
Jan 4, 2025 14:46:34.573158979 CET	53	36598	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 14:46:34.565594912 CET	192.168.2.15	8.8.8.8	0x0	Standard query (0)	lemonsmp.work.gd	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 14:46:34.573158979 CET	8.8.8.8	192.168.2.15	0x0	No error (0)	lemonsmp.work.gd		102.211.232.40	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: main.arm7.elf PID: 5564, Parent PID: 5487

General

Start time (UTC):	13:46:34
Start date (UTC):	04/01/2025
Path:	/tmp/main.arm7.elf
Arguments:	/tmp/main.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: main.arm7.elf PID: 5566, Parent PID: 5564

General

Start time (UTC):	13:46:34
Start date (UTC):	04/01/2025
Path:	/tmp/main.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: main.arm7.elf PID: 5568, Parent PID: 5566

General

Start time (UTC):	13:46:34
Start date (UTC):	04/01/2025
Path:	/tmp/main.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report main.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: main.arm7.elf PID: 5564, Parent PID: 5487

General

Chronological Activities

Analysis Process: main.arm7.elf PID: 5566, Parent PID: 5564

General

Chronological Activities

Analysis Process: main.arm7.elf PID: 5568, Parent PID: 5566

General

Chronological Activities

Linux Analysis Report
main.arm7.elf