Edit tour

Linux Analysis Report
main.arm7.elf

Overview

General Information

Sample name:	main.arm7.elf
Analysis ID:	1584448
MD5:	3fe6752fc8c83cf0be925d7bbe3475ee
SHA1:	028f760ccbe466d9d64cc35763ecb44ef23a1ce3
SHA256:	67f9ed676b118cd6e00cd2fa5967e1229960355a48cd0ce0b019c34f45fc78ff
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample deletes itself

Uses dynamic DNS services

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584448
Start date and time:	2025-01-05 15:02:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	main.arm7.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/0@1/0

Runtime Messages

Command:	/tmp/main.arm7.elf
PID:	5516
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

main.arm7.elf (PID: 5516, Parent: 5439, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/main.arm7.elf

main.arm7.elf New Fork (PID: 5518, Parent: 5516)

main.arm7.elf New Fork (PID: 5524, Parent: 5518)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
main.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
main.arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17c38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17da0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17db4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
main.arm7.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17af8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17c38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17da0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17db4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17dc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17af8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: main.arm7.elf PID: 5516	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: main.arm7.elf PID: 5516	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3e87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ec3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ed7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3eff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4003:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4017:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: main.arm7.elf PID: 5516	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3d6d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: main.arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: main.arm7.elf	ReversingLabs: Detection: 55%
Source: main.arm7.elf	Virustotal: Detection: 57%			Perma Link

Networking

Uses dynamic DNS services

Source: unknown

DNS query: name: unixbot.ddns.net

Source: global traffic

TCP traffic: 192.168.2.14:57694 -> 123.253.61.116:3778

Source: global traffic

DNS traffic detected: DNS query: unixbot.ddns.net

System Summary

Malicious sample detected (through community Yara rule)

Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: main.arm7.elf PID: 5516, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: main.arm7.elf PID: 5516, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: main.arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/telnetsshwatchdogsshd/usr/compress/bin//compress/bin/compress/usr/bashmain_x86main_x86_64main_mipsmain_mipselmain_armmain_arm5main_arm6main_arm7main_ppcmain_m68kmain_sh4main_spchttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//tmp/var/mnt/boot/home/dev/..//root(deleted)/proc/self/exe

Source: /tmp/main.arm7.elf (PID: 5524)

SIGKILL sent: pid: 2, result: successful

Jump to behavior

Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: main.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: main.arm7.elf PID: 5516, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: main.arm7.elf PID: 5516, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.troj.evad.linELF@0/0@1/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/main.arm7.elf (PID: 5516)

File: /tmp/main.arm7.elf

Jump to behavior

Source: /tmp/main.arm7.elf (PID: 5516)

Queries kernel information via 'uname':

Jump to behavior

Source: main.arm7.elf, 5516.1.000055bb6b6b5000.000055bb6b804000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: main.arm7.elf, 5516.1.000055bb6b6b5000.000055bb6b804000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: main.arm7.elf, 5516.1.00007ffe949fb000.00007ffe94a1c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: main.arm7.elf, 5516.1.00007ffe949fb000.00007ffe94a1c000.rw-.sdmp	Binary or memory string: 3x86_64/usr/bin/qemu-arm/tmp/main.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/main.arm7.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: main.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main.arm7.elf PID: 5516, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: main.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5516.1.00007fdf6c017000.00007fdf6c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main.arm7.elf PID: 5516, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
main.arm7.elf	55%	ReversingLabs	Linux.Backdoor.Mirai
main.arm7.elf	57%	Virustotal		Browse
main.arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
unixbot.ddns.net	123.253.61.116	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
123.253.61.116	unixbot.ddns.net	Thailand		136523	COLODEE-AS-APCOLODEEDIGITALNETWORKCOLTDTH	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
123.253.61.116	main.sh4.elf	Get hash	malicious	Mirai	Browse
	fuckunix.arm7.elf	Get hash	malicious	Mirai	Browse
	main.mpsl.elf	Get hash	malicious	Mirai	Browse
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse
	main.x86.elf	Get hash	malicious	Mirai	Browse
	main.arm.elf	Get hash	malicious	Mirai	Browse
	main.mips.elf	Get hash	malicious	Mirai	Browse
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse
	main.ppc.elf	Get hash	malicious	Mirai	Browse
	main.m68k.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
unixbot.ddns.net	main.sh4.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.mpsl.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.x86.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.arm.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.mips.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.ppc.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.m68k.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.arm5.elf	Get hash	malicious	Mirai	Browse	123.253.61.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COLODEE-AS-APCOLODEEDIGITALNETWORKCOLTDTH	main.sh4.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	fuckunix.arm7.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.mpsl.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.x86.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.arm.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.mips.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	fuckunix.arm.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.ppc.elf	Get hash	malicious	Mirai	Browse	123.253.61.116
	main.m68k.elf	Get hash	malicious	Mirai	Browse	123.253.61.116

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.991138695698592
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	main.arm7.elf
File size:	180'754 bytes
MD5:	3fe6752fc8c83cf0be925d7bbe3475ee
SHA1:	028f760ccbe466d9d64cc35763ecb44ef23a1ce3
SHA256:	67f9ed676b118cd6e00cd2fa5967e1229960355a48cd0ce0b019c34f45fc78ff
SHA512:	37b3f87b9b6fe9508cd1f3bb7a228c13eacf6571ceb91879e966474fa72a9457f28b37d3f4ffc38d1f9aa23d7e252d84e453f13418fa42b267dbc2dbded134ce
SSDEEP:	3072:4dBDjTrBng+7DaIQDuhZHgdnqYLMA25QBsofM/RoBxR0imOz:oBLrBguDaIQDuhZA7LMA25GxfM/RoBxj
TLSH:	B6042A45EA404B13C0D627B9F6DF424633339B9497EB73069528AFB43F86B9E4F22905
File Content Preview:	.ELF..............(.........4...X ......4. ...(........p............p...p...........................X...X...............X...X...X.......df..............\...\...\...................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	139352
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17300	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f3f0	0x173f0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f400	0x17400	0x21d0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x215d0	0x195d0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x215e8	0x195e8	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29758	0x19758	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2975c	0x1975c	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x29760	0x19760	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29760	0x19760	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x29764	0x19764	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29768	0x19768	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2976c	0x1976c	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2982c	0x1982c	0x30c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29b38	0x19b38	0x6284	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19b38	0xeb6	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a9f0	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1ab50	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ad8e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d76d	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e0f3	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1f1d0	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f50c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1ffc8	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x217f2	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21f22	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21f38	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22508	0x64e0	0x10	0x0		29	931	4
.strtab	STRTAB	0x0	0x289e8	0x382a	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x195e8	0x215e8	0x215e8	0x170	0x170	4.7371	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19758	0x19758	6.1495	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19758	0x29758	0x29758	0x3e0	0x6664	4.1300	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1975c	0x2975c	0x2975c	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f3f0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f400	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x215d0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x215e8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x29758	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2975c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x29760	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x29760	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x29764	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x29768	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2976c	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2982c	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x29b38	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f3f0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f3fc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8674	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x89fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbbd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc18c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc89c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcb38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcdac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd5e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd7ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdcd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe03c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe054	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe7b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xea64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeaac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xebe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1009c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x102c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1044c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11254	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1186c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1193c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1232c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1261c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12888	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12928	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1292c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1352c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13534	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1353c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ef8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1452c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1573c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1576c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1607c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1611c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x169f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1704c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1796c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17af4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x193f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1981c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aaf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1accc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1affc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1baac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bed8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c1f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c29c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c428	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c9ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cce4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dde0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e34c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f25c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f39c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29764	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29760	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8350	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x89c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x970c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb420	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb79c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f41c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1f440	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xbbd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc9a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcb1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xccc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2982c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x298e8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xcd34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcda8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd5ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29910	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29914	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29918	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd774	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdcd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xded8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2991c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xe160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe7a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xea4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeaa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xebe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xedac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfeac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1008c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x102a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29920	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20374	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x29924	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x10444	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x109fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1129c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11718	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11da4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29938	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x12238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x12b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1351c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x13e48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13ecc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1411c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1416c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1425c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1429c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1431c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14378	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1456c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14630	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1472c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20510	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14b58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15720	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29944	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29940	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x16058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2058c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1630c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a28	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20594	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16c84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17034	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20618	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1778c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17964	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17af0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x188b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a2c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x189f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x192ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x193c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a44	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1947c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x195f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29a5c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29af4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21184	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19c04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b08	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19e00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a41c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a494	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a968	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1afe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b290	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b628	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b8dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b20	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1b9ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1baa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1be4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29b24	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1bec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bfac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c04c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c19c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c22c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c500	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c9e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21588	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1d93c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1def8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dfd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e29c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e8f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29934	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x29b30	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x21270	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x211f4	12	OBJECT	<unknown>	DEFAULT	4
C.31.4582	.symtab	0x1f440	44	OBJECT	<unknown>	DEFAULT	4
C.32.4583	.symtab	0x1f41c	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x20510	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x21200	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x20534	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x20564	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x20540	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20558	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x2054c	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x2f7f0	1	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR	.symtab	0x2f7e8	4	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR2	.symtab	0x2f830	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x172b8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x172d4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1bee4	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2976c	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x12928	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1292c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x135dc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x12920	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x12964	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x13600	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x13da0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x12958	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x13570	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x13594	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x135b8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x12888	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x12ea0	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x128d4	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x29b30	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x21270	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x29758	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x29758	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x29b30	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1ac90	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1ac74	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x29b34	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x13ef8	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d818	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x175cc	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1ac90	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x13f90	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1ad20	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1adb0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1e310	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1bec4	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x120d8	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x120dc	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1ad20	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1ad04	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x2ab3c	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x11254	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x112a8	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1adb0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1ad94	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1a970	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x17edc	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x17f00	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x17eb8	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x2ab1c	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1b984	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1ba54	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1e310	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1e2f4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x175e4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1bee4	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x192b4	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x177fc	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x19a00	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17870	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1e380	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x140c4	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1ac90	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x14730	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1c83c	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1c870	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1c514	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x178f8	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x19c14	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x14ba0	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x13f90	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16ca0	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1d6d4	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d818	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x168d4	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1704c	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x14ed0	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a4fc	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x14fc8	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x170ec	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1e520	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1e544	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1bf4c	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x17124	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d818	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1c050	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1c07c	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1c090	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1c0a4	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x140fc	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1aaf8	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14138	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1796c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x14170	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1c0b8	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x17790	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e1ac	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1981c	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1c0cc	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x176f0	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x141b0	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1e934	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1de10	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x171e0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1dde0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x172f0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1df00	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x171f0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x13dd4	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c1ac	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x142a0	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14320	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1ad20	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x14910	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x14ef0	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1ab40	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x193f4	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x196b4	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1adb0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x14a84	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1c428	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x143c4	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17a3c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17af4	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x14f64	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1c1f0	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1c230	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14570	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17bc0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x17c7c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x145f4	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17d04	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x19914	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13e50	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x17d90	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x17de0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x17df4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x14634	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x14ff8	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x17d4c	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19744	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17314	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1dfe0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1ddf0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1ddf0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1e0cc	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17290	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x17404	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1e110	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1e160	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x174d0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x19a20	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x19e24	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17714	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x146c0	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1c29c	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x146f0	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1576c	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x15028	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1c8b8	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1c930	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1c90c	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1e310	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x29768	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x29768	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x135dc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x13570	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x13594	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x135b8	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1e9b0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f30c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f30c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f2f0	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f39c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1e9b0	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f324	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f36c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f384	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f354	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f33c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f050	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1edc0	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1e9a4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1e9ac	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1ed0c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1ece4	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x12730	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1285c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1ed60	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0xe170	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1ecc0	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1261c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12718	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1ed4c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1353c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x13534	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1352c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x2f7dc	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x29b08	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x2fdbc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29b38	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29b38	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1ba00	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1a498	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1ac90	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1ac74	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f26c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x29b34	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x2f7e4	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2982c	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0xec8c	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13ef0	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13ee4	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x29934	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x12874	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f050	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x12730	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x29764	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x2fdbc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x2f7d4	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x1f26c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe1cc	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1a4f8	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x21758	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x215e8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2ed48	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x1ed0c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x13ef8	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d818	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0xe480	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x29768	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x29764	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x1f39c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1ed60	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1ece4	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1ed4c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1ecc0	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0xe03c	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x2f9a4	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x2fd88	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x2fd8c	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x2ed4c	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x29760	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0xebe8	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0xedbc	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x1f25c	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1bfb0	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1e3d8	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x140fc	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1aaf8	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x175cc	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x12ce0	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x12dc8	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x13560	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x12d5c	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x12e80	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x13568	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x13644	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x13d58	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x12fe4	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1f25c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x29764	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x29760	0	NOTYPE	<unknown>	HIDDEN	10
__init_sched_fifo_prio	.symtab	0x11a84	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x2f99c	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x1f264	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x177fc	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1ac90	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x178f8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1ae20	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1aea8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x13f90	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a4fc	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x141e8	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x2fd90	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x2f998	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x14320	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1ad20	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1a8c8	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1adb0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17a3c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17af4	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x14570	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17bc0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x17c7c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b088	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13e50	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x141e8	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x2f7d0	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1e310	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1a90c	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x1147c	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x113e4	152	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x1186c	208	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x11720	332	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x115f0	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x11518	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x1bec4	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x1f264	140	FUNC	<unknown>	HIDDEN	2
__make_stacks_executable	.symtab	0xeaac	8	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x18e84	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x17f24	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x29a2c	24	OBJECT	<unknown>	DEFAULT	14
__malloc_state	.symtab	0x2fa10	888	OBJECT	<unknown>	DEFAULT	15
__malloc_trim	.symtab	0x18dd4	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1edc0	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1f26c	132	FUNC	<unknown>	HIDDEN	2
__nptl_create_event	.symtab	0x120d8	4	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0xeab4	308	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x120dc	4	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x2cb40	1	OBJECT	<unknown>	DEFAULT	15
__nptl_last_event	.symtab	0x2ab30	4	OBJECT	<unknown>	DEFAULT	15
__nptl_nthreads	.symtab	0x29920	4	OBJECT	<unknown>	DEFAULT	14
__nptl_setxid	.symtab	0xe7b4	688	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x2ab28	8	OBJECT	<unknown>	DEFAULT	15
__open	.symtab	0x1ad20	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1ad04	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2f7d8	4	OBJECT	<unknown>	DEFAULT	15
__preinit_array_end	.symtab	0x29760	0	NOTYPE	<unknown>	HIDDEN	9
__preinit_array_start	.symtab	0x29760	0	NOTYPE	<unknown>	HIDDEN	9
__progname	.symtab	0x29b28	4	OBJECT	<unknown>	DEFAULT	14
__progname_full	.symtab	0x29b2c	4	OBJECT	<unknown>	DEFAULT	14
__pthread_cleanup_pop	.symtab	0x11f0c	56	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x11fe8	240	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x11f44	40	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x11f6c	124	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0xf47c	2692	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x11944	320	FUNC	<unknown>	HIDDEN	2
__pthread_debug	.symtab	0x2f994	4	OBJECT	<unknown>	HIDDEN	15
__pthread_disable_asynccancel	.symtab	0x11dbc	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x11e44	200	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0xff00	412	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x1232c	752	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x1232c	752	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x2ab3c	8192	OBJECT	<unknown>	DEFAULT	15
__pthread_multiple_threads	.symtab	0x2f9a0	4	OBJECT	<unknown>	HIDDEN	15
__pthread_mutex_lock	.symtab	0x10a00	576	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x1044c	1460	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x10a00	576	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x1124c	8	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x10c40	1264	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x1124c	8	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x11130	284	FUNC	<unknown>	HIDDEN	2
__pthread_return_0	.symtab	0x1b940	8	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x11ad0	748	FUNC	<unknown>	HIDDEN	2
__pthread_unwind	.symtab	0x11254	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x112a8	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x1adb0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1ad94	24	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x1009c	548	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x1a970	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
__restore_core_regs	.symtab	0x13544	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x2f7e0	4	OBJECT	<unknown>	HIDDEN	15
__sched_fifo_max_prio	.symtab	0x2993c	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_min_prio	.symtab	0x29938	4	OBJECT	<unknown>	HIDDEN	14
__set_robust_list_avail	.symtab	0x2f9b0	4	OBJECT	<unknown>	HIDDEN	15
__sigaction	.symtab	0xe180	76	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x17edc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x17f00	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x17eb8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1e2a4	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1bed8	12	FUNC	<unknown>	DEFAULT	2
__stack_user	.symtab	0x2ab1c	8	OBJECT	<unknown>	DEFAULT	15
__static_tls_align_m1	.symtab	0x2f9a8	4	OBJECT	<unknown>	HIDDEN	15
__static_tls_size	.symtab	0x2f9ac	4	OBJECT	<unknown>	HIDDEN	15
__stdin	.symtab	0x29950	4	OBJECT	<unknown>	DEFAULT	14
__stdio_READ	.symtab	0x1e704	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1c9ec	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1e75c	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1cac8	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1e824	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1e8f8	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1e854	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1cc08	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1573c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29954	4	OBJECT	<unknown>	DEFAULT	14
__subdf3	.symtab	0x1e9ac	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x177b8	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x178b4	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x179f8	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x17aac	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x17b7c	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x17c30	76	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 15:02:53.485866070 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:02:53.490705013 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:02:53.490758896 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:02:53.492476940 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:02:53.497195005 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:02:53.497234106 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:02:53.501996994 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:03:03.501106977 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:03:03.505933046 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:03:03.853163004 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:03:03.853240967 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:04:03.899584055 CET	57694	3778	192.168.2.14	123.253.61.116
Jan 5, 2025 15:04:03.904424906 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:04:04.252269030 CET	3778	57694	123.253.61.116	192.168.2.14
Jan 5, 2025 15:04:04.252356052 CET	57694	3778	192.168.2.14	123.253.61.116

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 15:02:53.441843987 CET	33641	53	192.168.2.14	8.8.8.8
Jan 5, 2025 15:02:53.477416992 CET	53	33641	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 15:02:53.441843987 CET	192.168.2.14	8.8.8.8	0x0	Standard query (0)	unixbot.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 15:02:53.477416992 CET	8.8.8.8	192.168.2.14	0x0	No error (0)	unixbot.ddns.net		123.253.61.116	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: main.arm7.elf PID: 5516, Parent PID: 5439

General

Start time (UTC):	14:02:52
Start date (UTC):	05/01/2025
Path:	/tmp/main.arm7.elf
Arguments:	/tmp/main.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: main.arm7.elf PID: 5518, Parent PID: 5516

General

Start time (UTC):	14:02:52
Start date (UTC):	05/01/2025
Path:	/tmp/main.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: main.arm7.elf PID: 5524, Parent PID: 5518

General

Start time (UTC):	14:02:52
Start date (UTC):	05/01/2025
Path:	/tmp/main.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report main.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: main.arm7.elf PID: 5516, Parent PID: 5439

General

Chronological Activities

Analysis Process: main.arm7.elf PID: 5518, Parent PID: 5516

General

Chronological Activities

Analysis Process: main.arm7.elf PID: 5524, Parent PID: 5518

General

Chronological Activities

Linux Analysis Report
main.arm7.elf