Edit tour

Linux Analysis Report
arm7.fkunigr.elf

Overview

General Information

Sample name:	arm7.fkunigr.elf
Analysis ID:	1646739
MD5:	89b54b9bf4d41a5ce9b78b369f100204
SHA1:	010ce3888832c8a5c35ee4af88d08a9c6d92603e
SHA256:	dfffbb602dd204b59d3e325b11348fe2a9c96383b3a8f47f86ec564c54df27cf
Tags:	Miraiuser-elfdigest
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646739
Start date and time:	2025-03-24 09:00:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm7.fkunigr.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@2/0

Runtime Messages

Command:	/tmp/arm7.fkunigr.elf
PID:	5530
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

arm7.fkunigr.elf (PID: 5530, Parent: 5447, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.fkunigr.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm7.fkunigr.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
arm7.fkunigr.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
arm7.fkunigr.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a6d4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5530.1.00007f607c017000.00007f607c034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5530.1.00007f607c017000.00007f607c034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a92c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5530.1.00007f607c017000.00007f607c034000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a6d4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: arm7.fkunigr.elf PID: 5530	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: arm7.fkunigr.elf PID: 5530	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x33ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x344c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x349c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x353c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.fkunigr.elf PID: 5530	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x3292:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm7.fkunigr.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: arm7.fkunigr.elf	Virustotal: Detection: 64%			Perma Link
Source: arm7.fkunigr.elf	ReversingLabs: Detection: 66%

Source: /tmp/arm7.fkunigr.elf (PID: 5530)

Socket: 127.0.0.1:57886

Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: arm7.fkunigr.elf	String found in binary or memory: http://213.209.129.92/lickmynutsnigah.sh;
Source: arm7.fkunigr.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: arm7.fkunigr.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: arm7.fkunigr.elf	String found in binary or memory: https://i.imgur.com/0r0MYas.gif

System Summary

Malicious sample detected (through community Yara rule)

Source: arm7.fkunigr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: arm7.fkunigr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5530.1.00007f607c017000.00007f607c034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5530.1.00007f607c017000.00007f607c034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: arm7.fkunigr.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.fkunigr.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: arm7.fkunigr.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: arm7.fkunigr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: arm7.fkunigr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5530.1.00007f607c017000.00007f607c034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5530.1.00007f607c017000.00007f607c034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: arm7.fkunigr.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.fkunigr.elf PID: 5530, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@2/0

Source: /tmp/arm7.fkunigr.elf (PID: 5530)

Queries kernel information via 'uname':

Jump to behavior

Source: arm7.fkunigr.elf, 5530.1.0000563eaa201000.0000563eaa32f000.rw-.sdmp	Binary or memory string: >V!/etc/qemu-binfmt/arm
Source: arm7.fkunigr.elf, 5530.1.0000563eaa201000.0000563eaa32f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.fkunigr.elf, 5530.1.00007ffe48cd4000.00007ffe48cf5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm7.fkunigr.elf, 5530.1.00007ffe48cd4000.00007ffe48cf5000.rw-.sdmp	Binary or memory string: Nx86_64/usr/bin/qemu-arm/tmp/arm7.fkunigr.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.fkunigr.elf
Source: arm7.fkunigr.elf, 5530.1.00007ffe48cd4000.00007ffe48cf5000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: arm7.fkunigr.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.00007f607c017000.00007f607c034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.fkunigr.elf PID: 5530, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: arm7.fkunigr.elf, type: SAMPLE
Source: Yara match	File source: 5530.1.00007f607c017000.00007f607c034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.fkunigr.elf PID: 5530, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
arm7.fkunigr.elf	64%	Virustotal		Browse
arm7.fkunigr.elf	67%	ReversingLabs	Linux.Backdoor.Mirai
arm7.fkunigr.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://213.209.129.92/lickmynutsnigah.sh;	arm7.fkunigr.elf	false	unknown
http://schemas.xmlsoap.org/soap/encoding/	arm7.fkunigr.elf	false	high
https://i.imgur.com/0r0MYas.gif	arm7.fkunigr.elf	false	high
http://schemas.xmlsoap.org/soap/envelope/	arm7.fkunigr.elf	false	high

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	mips.fkunigr.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	m68k.fkunigr.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ppc.fkunigr.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	aarch64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.053182220770348
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.fkunigr.elf
File size:	192'677 bytes
MD5:	89b54b9bf4d41a5ce9b78b369f100204
SHA1:	010ce3888832c8a5c35ee4af88d08a9c6d92603e
SHA256:	dfffbb602dd204b59d3e325b11348fe2a9c96383b3a8f47f86ec564c54df27cf
SHA512:	519cbda4c90237ada627a542108169937f2a08bf6634928778d985b1e775a9f23f3fbab3c4afb6f7d6368e4cea112c6eb6ab62366728bac8ba8c1dd5fb74ed00
SSDEEP:	3072:b2UkTCzQ5mohoOJOUTQtjpogI16o2xfawPfFZ1heAzeoBM/RFJT1SV:bwTCzQ5NXJOUklpogI16oEfaKZ1hewHB
TLSH:	6D143A46EA414F13C0D627B5F69F424533339B9493EB73069928AFB43F8679E4E22A05
File Content Preview:	.ELF..............(.........4....O......4. ...(........p.....F...F..p...p................................................................V..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	151528
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x19b84	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x21c74	0x19c74	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x21c88	0x19c88	0x2a00	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x24688	0x1c688	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x246a0	0x1c6a0	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2c810	0x1c810	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2c814	0x1c814	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2c818	0x1c818	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2c818	0x1c818	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2c81c	0x1c81c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c820	0x1c820	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2c824	0x1c824	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2c8e4	0x1c8e4	0x22c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2cb10	0x1cb10	0x538c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1cb10	0xe6e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1d980	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1dae0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1dd1e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x206fd	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x21083	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x22160	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2249c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x22f58	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x24782	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x24eb2	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x24ec8	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x25498	0x63c0	0x10	0x0		29	927	4
.strtab	STRTAB	0x0	0x2b858	0x384d	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1c6a0	0x246a0	0x246a0	0x170	0x170	4.6743	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1c810	0x1c810	6.2089	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1c810	0x2c810	0x2c810	0x300	0x568c	4.0753	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1c814	0x2c814	0x2c814	0x4	0xc	1.5000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x21c74	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x21c88	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x24688	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x246a0	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2c810	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2c814	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2c818	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2c818	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2c81c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2c820	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2c824	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2c8e4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x2cb10	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x21c74	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x21c80	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x909c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x910c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa84c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb60c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc2c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcfd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd93c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdac0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe27c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xffe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x100a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x109ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10c80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10da4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1102c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1104c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x110a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1190c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12efc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13aa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1479c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1518c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1547c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1578c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x157d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ce0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1638c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1639c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x163a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16df0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17128	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17168	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17348	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17794	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18024	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x185b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1861c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18fcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1910c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x194cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1996c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a308	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a92c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ada0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b224	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b27c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b284	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b3c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b584	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b81c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b934	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b9d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c46c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c59c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c69c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c914	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d574	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e16c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e93c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f19c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f9fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fbbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fcf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fe94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fee8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ffc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20310	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x203b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2050c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20df0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20f64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21124	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x211ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c81c	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c818	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9418	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9b3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa158	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbe6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22030	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x22054	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xc2c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc550	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcf30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd1c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd78c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd92c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdabc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe244	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c8e4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2c8e8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2c8ec	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2c8f0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xe2c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe330	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22ebf	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x22ec8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10004	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x100a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c8f4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x10fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x110f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11404	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11604	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11908	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11c0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x122d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12d0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c8f8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x23440	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2c8fc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x132a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1423c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14578	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14924	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c910	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x15098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x159d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1637c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x16ca8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16de8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16ed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16fd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17164	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17280	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17304	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1737c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17430	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1778c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1784c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x235dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x179dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c91c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2c918	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x17e44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1801c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18060	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1812c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1826c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1836c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1843c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18480	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x184d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x185a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18fa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2ca00	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x190f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x194ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19950	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ac0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2ca18	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19cec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2ca30	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2cac8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19e38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ffc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23618	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a19c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2cadc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1a2e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b190	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b220	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b2b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b49c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b504	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b574	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b9d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2caf4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1bf0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bfc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c36c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2caf8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1c3e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c56c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c62c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ccb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cfd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d110	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23a2c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1e114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2cb0c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x23a34	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1ebd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f0bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f254	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f7f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f9f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fbac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23ab8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1fcac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fd40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fe8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ffc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2030c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ce0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24640	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x20de8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20f3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x211e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c90c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x2cb04	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x23702	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x23688	12	OBJECT	<unknown>	DEFAULT	4
C.25.4466	.symtab	0x22054	44	OBJECT	<unknown>	DEFAULT	4
C.26.4467	.symtab	0x22030	36	OBJECT	<unknown>	DEFAULT	4
C.42.5012	.symtab	0x22ec8	3	OBJECT	<unknown>	DEFAULT	4
C.43.5013	.symtab	0x22ebf	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x235dc	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x23694	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x2360c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x23a04	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x23600	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x235f4	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x31894	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x17d28	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x17d44	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1c404	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2c824	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x15788	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1578c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1643c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x15780	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x157c4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x16460	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x16c00	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x157b8	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x163d0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x163f4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x16418	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x156e8	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x15d00	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x15734	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2cb04	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x23702	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2c810	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2c810	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2cb04	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1b120	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1b104	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2cb08	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x16d58	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1ef98	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1fa98	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1b120	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x16df0	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1b1b0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1b2d0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1b240	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1c3e4	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x14f38	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x14f3c	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1b1b0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1b194	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x2cbe4	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x140b4	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x14108	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1b2d0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1b2b4	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1ae04	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x185d4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x185f8	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x185b0	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x2cbc4	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1bea4	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1bf74	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1b240	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1b224	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1fab0	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1c404	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x199ac	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x17eb4	116	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17f28	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1fcf4	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1b120	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x175b4	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1cc3c	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1cc70	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1c914	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x17fb0	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1a0f8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1ccb8	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x16df0	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1ebec	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1e6dc	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1ef98	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1e820	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1f0c4	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1cfe8	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a990	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1d008	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1f164	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x20f40	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x20f64	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1c46c	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1f19c	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1ef98	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1c570	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1c59c	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1c5b0	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1c5c4	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x16f24	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1af8c	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x16f60	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x18024	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x16f98	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1c5d8	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x17e48	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1fbbc	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x19f14	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x16fd8	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x17da8	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x170b8	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x180b0	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x20ed0	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x20d00	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x17c40	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x17c50	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x17d60	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x20df0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x17c60	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x16c34	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c5ec	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x171a8	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x17228	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1b1b0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x17794	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1afd4	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x19aec	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x19dac	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1b2d0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x17908	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1c828	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x17288	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x18134	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x181ec	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1c630	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x17434	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x182b8	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x18374	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x174b8	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x183fc	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1a00c	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x16cb0	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x18488	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x184d8	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x184ec	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x174f8	140	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x18444	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19e3c	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1f710	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1f800	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1f6f0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1f6f0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x17d84	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1f8ec	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17d00	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1f930	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1f9fc	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1fa4c	76	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1a308	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17dcc	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x17584	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1c69c	20	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1d574	324	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1fe94	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1ff0c	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1fee8	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1b240	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2c820	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x2c820	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x1643c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x163d0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x163f4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x16418	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x21234	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x21b90	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x21b90	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x21b74	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x21c20	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x21234	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x21ba8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x21bf0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x21c08	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x21bd8	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x21bc0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x218d4	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x21644	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x21228	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x21230	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x21590	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x21568	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x15590	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x156bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x215e4	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x10fd0	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x21544	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1547c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x15578	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x215d0	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1639c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x16394	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1638c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x31878	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x2cadc	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x31e9c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2cb10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2cb10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1bf20	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1a92c	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1b120	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1b104	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x21af0	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2cb08	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x3188c	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2c8e4	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0x11aec	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x16d50	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x16d44	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x2c90c	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x156d4	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x218d4	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x15590	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2c81c	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x31e9c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x31870	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x21af0	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x1102c	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1a98c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x24810	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x246a0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x30de4	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x21590	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x16d58	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1ef98	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x112e0	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x2c820	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x2c81c	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x21c20	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x215e4	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x21568	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x215d0	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x21544	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x10ea0	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x31a84	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x31e18	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x31e1c	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x30de8	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x2c818	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0x11a48	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x11c1c	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x21ae0	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1c4d0	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1fd4c	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x16f24	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1af8c	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1fa98	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x15b40	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x15c28	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x163c0	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x15bbc	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x15ce0	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x163c8	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x164a4	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x16bb8	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x15e44	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x21ae0	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2c81c	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x2c818	0	NOTYPE	<unknown>	HIDDEN	10
__init_sched_fifo_prio	.symtab	0x148e4	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x31a7c	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x21ae8	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x17eb4	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1b120	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x17fb0	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1b340	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1b3c8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x16df0	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a990	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x170f0	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x31e20	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x31a78	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x17228	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1b1b0	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1ad5c	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1b2d0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x18134	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x181ec	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x17434	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x182b8	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x18374	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b5a8	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x16cb0	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x170f0	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x3186c	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1b240	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1ada0	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x142dc	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x14244	152	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x146cc	208	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x14580	332	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x14450	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x14378	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x1c3e4	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x21ae8	140	FUNC	<unknown>	HIDDEN	2
__make_stacks_executable	.symtab	0x1190c	8	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x1957c	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1861c	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2ca00	24	OBJECT	<unknown>	DEFAULT	14
__malloc_state	.symtab	0x31aa0	888	OBJECT	<unknown>	DEFAULT	15
__malloc_trim	.symtab	0x194cc	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x21644	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x21af0	132	FUNC	<unknown>	HIDDEN	2
__nptl_create_event	.symtab	0x14f38	4	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x11914	308	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x14f3c	4	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x2ebe8	1	OBJECT	<unknown>	DEFAULT	15
__nptl_last_event	.symtab	0x2cbd8	4	OBJECT	<unknown>	DEFAULT	15
__nptl_nthreads	.symtab	0x2c8f8	4	OBJECT	<unknown>	DEFAULT	14
__nptl_setxid	.symtab	0x11614	688	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x2cbd0	8	OBJECT	<unknown>	DEFAULT	15
__open	.symtab	0x1b1b0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1b194	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x31874	4	OBJECT	<unknown>	DEFAULT	15
__preinit_array_end	.symtab	0x2c818	0	NOTYPE	<unknown>	HIDDEN	9
__preinit_array_start	.symtab	0x2c818	0	NOTYPE	<unknown>	HIDDEN	9
__progname	.symtab	0x2cafc	4	OBJECT	<unknown>	DEFAULT	14
__progname_full	.symtab	0x2cb00	4	OBJECT	<unknown>	DEFAULT	14
__pthread_cleanup_pop	.symtab	0x14d6c	56	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x14e48	240	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x14da4	40	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x14dcc	124	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0x122dc	2692	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x147a4	320	FUNC	<unknown>	HIDDEN	2
__pthread_debug	.symtab	0x31a74	4	OBJECT	<unknown>	HIDDEN	15
__pthread_disable_asynccancel	.symtab	0x14c1c	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x14ca4	200	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0x12d60	412	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x1518c	752	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x1518c	752	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x2cbe4	8192	OBJECT	<unknown>	DEFAULT	15
__pthread_multiple_threads	.symtab	0x31a80	4	OBJECT	<unknown>	HIDDEN	15
__pthread_mutex_lock	.symtab	0x13860	576	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x132ac	1460	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x13860	576	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x140ac	8	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x13aa0	1264	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x140ac	8	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x13f90	284	FUNC	<unknown>	HIDDEN	2
__pthread_return_0	.symtab	0x1be60	8	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x14930	748	FUNC	<unknown>	HIDDEN	2
__pthread_unwind	.symtab	0x140b4	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x14108	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x1b2d0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1b2b4	24	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x12efc	548	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x1ae04	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
__restore_core_regs	.symtab	0x163a4	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x3187c	4	OBJECT	<unknown>	HIDDEN	15
__sched_fifo_max_prio	.symtab	0x2c914	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_min_prio	.symtab	0x2c910	4	OBJECT	<unknown>	HIDDEN	14
__set_robust_list_avail	.symtab	0x31a90	4	OBJECT	<unknown>	HIDDEN	15
__sigaction	.symtab	0x10fe0	76	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x185d4	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x185f8	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x185b0	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1fcb4	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c3f8	12	FUNC	<unknown>	DEFAULT	2
__stack_user	.symtab	0x2cbc4	8	OBJECT	<unknown>	DEFAULT	15
__static_tls_align_m1	.symtab	0x31a88	4	OBJECT	<unknown>	HIDDEN	15
__static_tls_size	.symtab	0x31a8c	4	OBJECT	<unknown>	HIDDEN	15
__stdin	.symtab	0x2c928	4	OBJECT	<unknown>	DEFAULT	14
__stdio_READ	.symtab	0x1ffc8	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1d038	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x21124	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x20020	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x20160	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x211ec	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x20190	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x20234	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x17c08	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2c92c	4	OBJECT	<unknown>	DEFAULT	14
__subdf3	.symtab	0x21230	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x17e70	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x17f6c	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x180f0	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x181a4	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x18274	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x18328	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x1c3b8	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x171e8	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x16ee4	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x173f0	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1b584	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x1bea4	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x1bf74	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x1bfcc	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2caf8	4	OBJECT	<unknown>	HIDDEN	14
__udivsi3	.symtab	0x1547c	252	FUNC	<unknown>	HIDDEN	2
__wait_lookup_done	.symtab	0x11414	512	FUNC	<unknown>	HIDDEN	2

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 09:01:27.517196894 CET	42601	53	192.168.2.15	1.1.1.1
Mar 24, 2025 09:01:27.517196894 CET	37717	53	192.168.2.15	1.1.1.1
Mar 24, 2025 09:01:27.619290113 CET	53	42601	1.1.1.1	192.168.2.15
Mar 24, 2025 09:01:27.619317055 CET	53	37717	1.1.1.1	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2025 09:01:27.517196894 CET	192.168.2.15	1.1.1.1	0x1017	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 09:01:27.517196894 CET	192.168.2.15	1.1.1.1	0xcaf5	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 24, 2025 09:01:27.619290113 CET	1.1.1.1	192.168.2.15	0x1017	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Mar 24, 2025 09:01:27.619290113 CET	1.1.1.1	192.168.2.15	0x1017	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: arm7.fkunigr.elf PID: 5530, Parent PID: 5447

General

Start time (UTC):	08:01:24
Start date (UTC):	24/03/2025
Path:	/tmp/arm7.fkunigr.elf
Arguments:	/tmp/arm7.fkunigr.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.fkunigr.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: arm7.fkunigr.elf PID: 5530, Parent PID: 5447

General

File Activities

File Opened

File Read

Process Activities

Signal Sent

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Linux Analysis Report
arm7.fkunigr.elf