Edit tour

Linux Analysis Report
main_arm7.elf

Overview

General Information

Sample name:	main_arm7.elf
Analysis ID:	1648595
MD5:	c1f3bd5cb4c3e7bbd2f07fbc749420d3
SHA1:	af0bfc4861a6b48e517429cf6066b0c7434c2d1f
SHA256:	2404e00e814e67b5878e09d1ab26b32c98badbb2e37ddf34937aa29218a87cf0
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648595
Start date and time:	2025-03-26 00:47:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	main_arm7.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/main_arm7.elf
PID:	6228
Exit Code:	1
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

main_arm7.elf (PID: 6228, Parent: 6149, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/main_arm7.elf

dash New Fork (PID: 6288, Parent: 4331)

rm (PID: 6288, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.v1Ure3NQx6 /tmp/tmp.Q3KwjaY4bn /tmp/tmp.SSikGxBN6K

dash New Fork (PID: 6289, Parent: 4331)

rm (PID: 6289, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.v1Ure3NQx6 /tmp/tmp.Q3KwjaY4bn /tmp/tmp.SSikGxBN6K

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
main_arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
main_arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
main_arm7.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17cb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17eac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ec0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ee8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17efc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17cb8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: main_arm7.elf PID: 6228	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: main_arm7.elf PID: 6228	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfba7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbe3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfce7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: main_arm7.elf PID: 6228	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xfa8d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: main_arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: main_arm7.elf	Virustotal: Detection: 57%			Perma Link
Source: main_arm7.elf	ReversingLabs: Detection: 58%

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39248
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: main_arm7.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: main_arm7.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: main_arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/telnetsshwatchdogsshd/usr/compress/bin//compress/bin/compress/usr/bashmain_x86main_x86_64main_mipsmain_mipselmain_armmain_arm5main_arm6main_arm7main_ppcmain_m68kmain_sh4main_spchttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//tmp/var/mnt/boot/home/dev/..//root(deleted)/proc/self/exe

Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: main_arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: main_arm7.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: main_arm7.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /usr/bin/dash (PID: 6288)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.v1Ure3NQx6 /tmp/tmp.Q3KwjaY4bn /tmp/tmp.SSikGxBN6K			Jump to behavior
Source: /usr/bin/dash (PID: 6289)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.v1Ure3NQx6 /tmp/tmp.Q3KwjaY4bn /tmp/tmp.SSikGxBN6K			Jump to behavior

Source: /tmp/main_arm7.elf (PID: 6228)

Queries kernel information via 'uname':

Jump to behavior

Source: main_arm7.elf, 6228.1.00007ffc5edb8000.00007ffc5edd9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/main_arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/main_arm7.elf
Source: main_arm7.elf, 6228.1.0000557ad1ef6000.0000557ad2024000.rw-.sdmp	Binary or memory string: zU!/etc/qemu-binfmt/arm
Source: main_arm7.elf, 6228.1.0000557ad1ef6000.0000557ad2024000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: main_arm7.elf, 6228.1.00007ffc5edb8000.00007ffc5edd9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: main_arm7.elf, type: SAMPLE
Source: Yara match	File source: 6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main_arm7.elf PID: 6228, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: main_arm7.elf, type: SAMPLE
Source: Yara match	File source: 6228.1.00007f30d0017000.00007f30d0031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: main_arm7.elf PID: 6228, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
main_arm7.elf	58%	Virustotal		Browse
main_arm7.elf	58%	ReversingLabs	Linux.Backdoor.Mirai
main_arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	na.elf	Get hash	malicious	Prometei	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rRrITDylw8.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sh4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	na.elf	Get hash	malicious	Prometei	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rRrITDylw8.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sh4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rRrITDylw8.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rRrITDylw8.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	rRrITDylw8.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
AMAZON-02US	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	https://click.pstmrk.it/3s/zar.free.hr%2F/tLrs/ZS28AQ/AQ/8c8f694f-9d41-49a1-b53b-85a5681b1594/1/KXKbs2QcC9	Get hash	malicious	Unknown	Browse	3.18.59.150
	https://teddyslimo.com	Get hash	malicious	HTMLPhisher	Browse	13.33.252.88
	rfq 25202503.bat.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	na.elf	Get hash	malicious	Prometei	Browse	34.249.145.219
	https://gamma.app/docs/San-Francisco-Design-Center-yiak8m1tzv7kh6w?mode=present#card-zkdj2dw1roq630u	Get hash	malicious	Unknown	Browse	52.85.61.87
	https://www.canva.com/design/DAGip6DbGGY/U0pN74ofNkqBSFMzXXCnAw/view?utm_content=DAGip6DbGGY&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h777bcb50d3	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	3.168.73.27
	na.elf	Get hash	malicious	Prometei	Browse	54.170.242.139
	file.exe	Get hash	malicious	Vidar	Browse	108.139.47.50
	sh4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.99467085027722
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	main_arm7.elf
File size:	181'578 bytes
MD5:	c1f3bd5cb4c3e7bbd2f07fbc749420d3
SHA1:	af0bfc4861a6b48e517429cf6066b0c7434c2d1f
SHA256:	2404e00e814e67b5878e09d1ab26b32c98badbb2e37ddf34937aa29218a87cf0
SHA512:	433cc896669666eb7cfac642b25c184d1e448f79999e361b339f37352b9a1c233feca853cf52c810d4b768aecacc8b03a82f4fe40c8f1f7a48b0d36ea31bd468
SSDEEP:	3072:LWeO3st4J9PaaTefaVv6Hg7bMzw99LW23fzBvo0M/RcR8I1Ln:yeO3zJ9PNCfaVv6Hg74eLW23fFQ0M/RK
TLSH:	82042A45EA408B13C0D627B9F6DF424533339BA497E773069528AFB43F8679E4F22A05
File Content Preview:	.ELF..............(.........4...@"......4. ...(........p............p...p...............................................................Dq..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	139840
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x174c0	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f5b0	0x175b0	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f5c0	0x175c0	0x21c0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21780	0x19780	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x21798	0x19798	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29908	0x19908	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2990c	0x1990c	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x29910	0x19910	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29910	0x19910	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x29914	0x19914	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29918	0x19918	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2991c	0x1991c	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x299dc	0x199dc	0x30c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29ce8	0x19ce8	0x66d64	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19ce8	0xeec	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1abd8	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1ad38	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1af76	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d955	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e2db	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1f3b8	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f6f4	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x201b0	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x219da	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2210a	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x22120	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x226f0	0x65d0	0x10	0x0		29	942	4
.strtab	STRTAB	0x0	0x28cc0	0x388a	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x19798	0x21798	0x21798	0x170	0x170	4.7208	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19908	0x19908	6.1534	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19908	0x29908	0x29908	0x3e0	0x67144	4.3416	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1990c	0x2990c	0x2990c	0x4	0xc	1.5000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f5b0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f5c0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x21780	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21798	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x29908	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2990c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x29910	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x29910	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x29914	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x29918	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2991c	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x299dc	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x29ce8	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f5b0	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f5bc	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x977c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb848	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc95c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc9ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xca64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcbf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcda0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcde4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcdf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xced8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd6ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd84c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdd7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdda0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xde40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdf9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdfe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe02c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe0d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe24c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe26c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeb2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf30c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf4fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1011c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x104cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10a80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10cc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11338	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x117a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x118ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12158	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12160	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1269c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x135c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x136c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1417c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x141f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14268	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14768	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15024	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1512c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1515c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1522c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1568c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1570c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x161b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16444	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17180	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17610	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1770c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1793c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x180e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18f98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x195b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1965c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19908	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19be4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19dd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a60c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a65c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a6c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ab34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b224	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b484	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b5d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b6d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b7f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b88c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b98c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1baa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c10c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c278	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c36c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c45c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cacc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1caf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d9d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e320	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e36c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e50c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e598	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f55c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29914	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29910	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x915c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa560	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb48c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb844	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f5dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1f600	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xbc7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc228	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xca60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcbdc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcd84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x299dc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29a98	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xcdf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xced4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ac0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29ac4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29ac8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd6f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd760	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd83c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdd9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xde38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xded8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdf64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29acc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xe1e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe248	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe268	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe2b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe318	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe624	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeb28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf2e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf4f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1010c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10320	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ad0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20524	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x29ad4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x104c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10a7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10cb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1131c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1145c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11798	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x118e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11b44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ae8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x122b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12650	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x12bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1359c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x13ec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13f4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14008	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14140	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14178	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1419c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x141ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1422c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14264	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1431c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1435c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1439c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14574	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14624	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1465c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14720	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14764	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14958	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14afc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14bb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x206c0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14c8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ff4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15224	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15854	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29af4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29af0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1618c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2073c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16440	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1648c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x169d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29bd8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20744	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17310	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1753c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x207c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x178cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17934	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17aa4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ae8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17db4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ec8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29bdc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x18bbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1941c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1958c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29bf4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1985c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29c0c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x29ca4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19904	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19ac8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19bb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21334	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19dc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29cb8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19fc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a5e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aa64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ab2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1acac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ade8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ae30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1aec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b13c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b1a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b5c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b6c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b7e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b87c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29cd0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1bbac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c00c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29cd4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1c080	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c104	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c16c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c20c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c35c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cba8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cc84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cea0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21738	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1dafc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e284	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e45c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e4b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e58c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e6d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e8c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e9e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eb60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ae4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x29ce0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x21420	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x213a4	12	OBJECT	<unknown>	DEFAULT	4
C.31.4582	.symtab	0x1f600	44	OBJECT	<unknown>	DEFAULT	4
C.32.4583	.symtab	0x1f5dc	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x206c0	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x213b0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x206e4	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x20714	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x206f0	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20708	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x206fc	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x90480	1	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR	.symtab	0x90478	4	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR2	.symtab	0x904c0	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x173f8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x17414	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1c0a4	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2991c	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x129a8	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x129ac	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1365c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x129a0	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x129e4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x13680	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x13e20	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x129d8	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x135f0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x13614	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x13638	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x12908	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x12f20	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x12954	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x29ce0	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x21420	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x29908	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x29908	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x29ce0	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1ae50	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1ae34	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x29ce4	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x13f78	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1d9d8	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1770c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1ae50	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x14010	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1aee0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1af70	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1e4d0	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1c084	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x12158	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x1215c	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1aee0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1aec4	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x8b7cc	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x112d4	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x11328	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1af70	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1af54	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1ab34	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1801c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x18040	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x17ff8	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x8b7ac	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1bb44	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1bc14	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1e4d0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1e4b4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x17724	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1c0a4	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x19478	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1793c	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x19bc4	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x179b0	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1e540	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x14144	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1ae50	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x14864	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1c9fc	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1ca30	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1c6d4	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x17a38	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x19dd8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x14cd4	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x14010	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x16dd4	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1d894	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1d9d8	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x16a08	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17180	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x15004	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a6c0	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x150fc	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x17220	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1e6e0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1e704	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1c10c	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x17258	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1d9d8	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1c210	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1c23c	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1c250	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1c264	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1417c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1acbc	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x141b8	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x17aac	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x141f0	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1c278	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x178d0	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e36c	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x199e0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1c28c	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x17830	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x14230	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1eaf4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1dfd0	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x17320	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1dfa0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x17430	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1e0c0	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x17330	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x13e54	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c36c	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x14320	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x143a0	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1aee0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x14a44	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x15024	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1ad04	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x195b8	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x19878	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1af70	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x14bb8	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1c5e8	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x144f8	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17b7c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17c34	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x15098	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1c3b0	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1c3f0	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x146a4	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17d00	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x17dbc	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x14728	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17e44	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x19ad8	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x13ed0	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x17ed0	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x17f20	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x17f34	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x14768	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x1512c	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x17e8c	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19908	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17454	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1e1a0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1dfb0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1dfb0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1e28c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x173d0	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x17544	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1e2d0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1e320	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x17610	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x19be4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x19fe8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17854	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x147f4	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1c45c	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x14824	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x158a0	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1515c	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1ca78	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1caf0	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1cacc	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1e4d0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x29918	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x29918	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x1365c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x135f0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x13614	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x13638	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1eb70	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f4cc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f4cc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f4b0	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f55c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1eb70	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f4e4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f52c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f544	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f514	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f4fc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f210	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1ef80	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1eb64	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1eb6c	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1eecc	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1eea4	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x127b0	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x128dc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1ef20	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0xe1f0	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1ee80	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1269c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12798	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1ef0c	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x135bc	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x135b4	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x135ac	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x9046c	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x29cb8	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x90a4c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29ce8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29ce8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1bbc0	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1a65c	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1ae50	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1ae34	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f42c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x29ce4	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x90474	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x299dc	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0xed0c	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x13f70	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x13f64	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x29ae4	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x128f4	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f210	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x127b0	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x29914	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x90a4c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x90464	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x1f42c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe24c	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1a6bc	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x21908	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x21798	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8f9d8	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x1eecc	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x13f78	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1d9d8	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0xe500	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x29918	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x29914	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x1f55c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1ef20	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1eea4	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1ef0c	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1ee80	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0xe0c0	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x90634	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x90a18	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x90a1c	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x8f9dc	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x29910	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0xec68	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0xee3c	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x1f41c	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1c170	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1e598	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1417c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1acbc	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1770c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x12d60	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x12e48	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x135e0	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x12ddc	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x12f00	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x135e8	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x136c4	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x13dd8	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x13064	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1f41c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x29914	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x29910	0	NOTYPE	<unknown>	HIDDEN	10
__init_sched_fifo_prio	.symtab	0x11b04	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x9062c	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x1f424	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x1793c	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1ae50	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x17a38	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1afe0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1b068	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x14010	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a6c0	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x14268	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x90a20	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x90628	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x143a0	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1aee0	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1aa8c	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1af70	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17b7c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17c34	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x146a4	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17d00	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x17dbc	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b248	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x13ed0	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x14268	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x90460	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1e4d0	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1aad0	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x114fc	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x11464	152	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x118ec	208	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x117a0	332	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x11670	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x11598	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x1c084	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x1f424	140	FUNC	<unknown>	HIDDEN	2
__make_stacks_executable	.symtab	0xeb2c	8	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x19048	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x180e8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x29bdc	24	OBJECT	<unknown>	DEFAULT	14
__malloc_state	.symtab	0x906a0	888	OBJECT	<unknown>	DEFAULT	15
__malloc_trim	.symtab	0x18f98	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1ef80	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1f42c	132	FUNC	<unknown>	HIDDEN	2
__nptl_create_event	.symtab	0x12158	4	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0xeb34	308	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x1215c	4	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x8d7d0	1	OBJECT	<unknown>	DEFAULT	15
__nptl_last_event	.symtab	0x8b7c0	4	OBJECT	<unknown>	DEFAULT	15
__nptl_nthreads	.symtab	0x29ad0	4	OBJECT	<unknown>	DEFAULT	14
__nptl_setxid	.symtab	0xe834	688	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x8b7b8	8	OBJECT	<unknown>	DEFAULT	15
__open	.symtab	0x1aee0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1aec4	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x90468	4	OBJECT	<unknown>	DEFAULT	15
__preinit_array_end	.symtab	0x29910	0	NOTYPE	<unknown>	HIDDEN	9
__preinit_array_start	.symtab	0x29910	0	NOTYPE	<unknown>	HIDDEN	9
__progname	.symtab	0x29cd8	4	OBJECT	<unknown>	DEFAULT	14
__progname_full	.symtab	0x29cdc	4	OBJECT	<unknown>	DEFAULT	14
__pthread_cleanup_pop	.symtab	0x11f8c	56	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x12068	240	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x11fc4	40	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x11fec	124	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0xf4fc	2692	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x119c4	320	FUNC	<unknown>	HIDDEN	2
__pthread_debug	.symtab	0x90624	4	OBJECT	<unknown>	HIDDEN	15
__pthread_disable_asynccancel	.symtab	0x11e3c	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x11ec4	200	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0xff80	412	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x123ac	752	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x123ac	752	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x8b7cc	8192	OBJECT	<unknown>	DEFAULT	15
__pthread_multiple_threads	.symtab	0x90630	4	OBJECT	<unknown>	HIDDEN	15
__pthread_mutex_lock	.symtab	0x10a80	576	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x104cc	1460	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x10a80	576	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x112cc	8	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x10cc0	1264	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x112cc	8	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x111b0	284	FUNC	<unknown>	HIDDEN	2
__pthread_return_0	.symtab	0x1bb00	8	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x11b50	748	FUNC	<unknown>	HIDDEN	2
__pthread_unwind	.symtab	0x112d4	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x11328	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x1af70	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1af54	24	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x1011c	548	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x1ab34	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
__restore_core_regs	.symtab	0x135c4	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x90470	4	OBJECT	<unknown>	HIDDEN	15
__sched_fifo_max_prio	.symtab	0x29aec	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_min_prio	.symtab	0x29ae8	4	OBJECT	<unknown>	HIDDEN	14
__set_robust_list_avail	.symtab	0x90640	4	OBJECT	<unknown>	HIDDEN	15
__sigaction	.symtab	0xe200	76	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x1801c	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x18040	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x17ff8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1e464	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c098	12	FUNC	<unknown>	DEFAULT	2
__stack_user	.symtab	0x8b7ac	8	OBJECT	<unknown>	DEFAULT	15
__static_tls_align_m1	.symtab	0x90638	4	OBJECT	<unknown>	HIDDEN	15
__static_tls_size	.symtab	0x9063c	4	OBJECT	<unknown>	HIDDEN	15
__stdin	.symtab	0x29b00	4	OBJECT	<unknown>	DEFAULT	14
__stdio_READ	.symtab	0x1e8c4	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1cbac	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1e91c	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1cc88	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1e9e4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1eab8	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1ea14	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1cdc8	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x15870	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29b04	4	OBJECT	<unknown>	DEFAULT	14

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 11
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 00:48:00.367321968 CET	43928	443	192.168.2.23	91.189.91.42
Mar 26, 2025 00:48:05.998445988 CET	42836	443	192.168.2.23	91.189.91.43
Mar 26, 2025 00:48:07.278361082 CET	42516	80	192.168.2.23	109.202.202.202
Mar 26, 2025 00:48:19.574326038 CET	39248	443	192.168.2.23	34.249.145.219
Mar 26, 2025 00:48:19.574405909 CET	443	39248	34.249.145.219	192.168.2.23
Mar 26, 2025 00:48:19.574521065 CET	39248	443	192.168.2.23	34.249.145.219
Mar 26, 2025 00:48:19.575280905 CET	39248	443	192.168.2.23	34.249.145.219
Mar 26, 2025 00:48:19.575308084 CET	443	39248	34.249.145.219	192.168.2.23
Mar 26, 2025 00:48:20.588669062 CET	43928	443	192.168.2.23	91.189.91.42
Mar 26, 2025 00:48:32.874670029 CET	42836	443	192.168.2.23	91.189.91.43
Mar 26, 2025 00:48:36.970057964 CET	42516	80	192.168.2.23	109.202.202.202
Mar 26, 2025 00:49:01.542754889 CET	43928	443	192.168.2.23	91.189.91.42
Mar 26, 2025 00:49:19.566797972 CET	39248	443	192.168.2.23	34.249.145.219
Mar 26, 2025 00:49:19.608310938 CET	443	39248	34.249.145.219	192.168.2.23
Mar 26, 2025 00:50:04.533411026 CET	443	39248	34.249.145.219	192.168.2.23

System Behavior

Analysis Process: main_arm7.elf PID: 6228, Parent PID: 6149

General

Start time (UTC):	23:48:01
Start date (UTC):	25/03/2025
Path:	/tmp/main_arm7.elf
Arguments:	/tmp/main_arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: dash PID: 6288, Parent PID: 4331

General

Start time (UTC):	23:49:19
Start date (UTC):	25/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6288, Parent PID: 4331

General

Start time (UTC):	23:49:19
Start date (UTC):	25/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.v1Ure3NQx6 /tmp/tmp.Q3KwjaY4bn /tmp/tmp.SSikGxBN6K
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6289, Parent PID: 4331

General

Start time (UTC):	23:49:19
Start date (UTC):	25/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6289, Parent PID: 4331

General

Start time (UTC):	23:49:19
Start date (UTC):	25/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.v1Ure3NQx6 /tmp/tmp.Q3KwjaY4bn /tmp/tmp.SSikGxBN6K
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report main_arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: main_arm7.elf PID: 6228, Parent PID: 6149

General

File Activities

File Opened

File Read

Process Activities

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: dash PID: 6288, Parent PID: 4331

General

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6288, Parent PID: 4331

General

File Activities

File Opened

File Deleted

File Read

Linux Analysis Report
main_arm7.elf