Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1532165
MD5:	1c3bd0890fa6cbf314ec2cdc698fc1c8
SHA1:	f165ecadfa8e07182029ab8cb8a6329b9574a795
SHA256:	021af5763cd627a513838dcde0247979598f8f8efcf66ce4abf9a54fb5f64e4e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532165
Start date and time:	2024-10-12 17:16:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/na.elf
PID:	5759
Exit Code:	1
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5759, Parent: 5685, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x180b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1811c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18144:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18158:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1816c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1820c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
na.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17f78:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x180b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18108:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1811c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18130:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18144:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18158:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1816c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1820c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x17f78:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: na.elf PID: 5759	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5759	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5759	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xc4f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf	Virustotal: Detection: 55%			Perma Link
Source: na.elf	ReversingLabs: Detection: 55%

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5759, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5759, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: na.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/telnetsshwatchdogsshd/usr/compress/bin//compress/bin/compress/usr/bashmain_x86main_x86_64main_mipsmain_mipselmain_armmain_arm5main_arm6main_arm7main_ppcmain_m68kmain_sh4main_spchttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//tmp/var/mnt/boot/home/dev/..//root(deleted)/proc/self/exe

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5759, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5759, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: /tmp/na.elf (PID: 5759)

Queries kernel information via 'uname':

Jump to behavior

Source: na.elf, 5759.1.000055920c22a000.000055920c358000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 5759.1.00007ffe48f0a000.00007ffe48f2b000.rw-.sdmp	Binary or memory string: ;Ox86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5759.1.000055920c22a000.000055920c358000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5759.1.00007ffe48f0a000.00007ffe48f2b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5759, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5759.1.00007feaf4017000.00007feaf4031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5759, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
na.elf	55%	Virustotal		Browse
na.elf	55%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.964389475624904
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	183'471 bytes
MD5:	1c3bd0890fa6cbf314ec2cdc698fc1c8
SHA1:	f165ecadfa8e07182029ab8cb8a6329b9574a795
SHA256:	021af5763cd627a513838dcde0247979598f8f8efcf66ce4abf9a54fb5f64e4e
SHA512:	aab772c56a231e14b0b0bf9fbc328b8d750ad0743db9426c8078420b01c85aeb2737d59d47e34ba3471869f65483591fe7b0de24720647db086c68e0001f335c
SSDEEP:	3072:tcAOK4BqxKgde8avF26k1LvSMBFLfZQb3Gj9oWM/Rv0L4qoL0:aAOdqxDw8avF26k1bhLfu3yKWM/RNqog
TLSH:	1E042A46EB404B13C0D627B9F6DF424633239BA497EB73069528AFB43F8679E4F12905
File Content Preview:	.ELF..............(.........4...8)......4. ...(........p`...`...`...p...p...............................................................hf..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	141624
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17780	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f870	0x17870	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f880	0x17880	0x21c8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21a48	0x19a48	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x21a60	0x19a60	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2a000	0x1a000	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2a004	0x1a004	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2a008	0x1a008	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2a008	0x1a008	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2a00c	0x1a00c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2a010	0x1a010	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2a014	0x1a014	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2a0d4	0x1a0d4	0x310	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2a3e4	0x1a3e4	0x6284	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1a3e4	0xeec	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1b2d0	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1b430	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1b66e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1e04d	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1e9d3	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1fab0	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1fdec	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x208a8	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x220d2	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x22802	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x22818	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22de8	0x6620	0x10	0x0		29	945	4
.strtab	STRTAB	0x0	0x29408	0x38a7	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x19a60	0x21a60	0x21a60	0x170	0x170	4.7279	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19bd0	0x19bd0	6.1466	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1a000	0x2a000	0x2a000	0x3e4	0x6668	4.3054	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1a004	0x2a004	0x2a004	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1f870	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1f880	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x21a48	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x21a60	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2a000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2a004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2a008	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2a008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2a00c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2a010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2a014	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2a0d4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x2a3e4	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f870	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1f87c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8228	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x83ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8414	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x86cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x91a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa5a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xac6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb4ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb84c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbc84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbf14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc1f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc280	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc5a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcd30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcec4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd0dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd138	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd9d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xda38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdb3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe068	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe23c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe388	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe3a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe4c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe50c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe52c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe8f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeda4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xedec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xefcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf5cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf7bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x103dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1078c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11a60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11c84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1224c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x122ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1266c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1295c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ed0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1303c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1309c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x131e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1386c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13874	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1387c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1422c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x142d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x143c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1443c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14464	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14478	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14560	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x145e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14660	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14838	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14920	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14964	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ae4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14dc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1541c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x154ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1594c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x159cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16470	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17518	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17690	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17804	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17af0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17cf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1807c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1814c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18190	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18324	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x183a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19258	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19860	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1991c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19bc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a098	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a15c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a91c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a980	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1adf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b14c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b184	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b1e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b214	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b26c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b4e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b77c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bab4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bf2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c344	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c358	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c364	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c3cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c430	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c510	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c524	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c62c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c670	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c71c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c730	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c8a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d088	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d164	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ddd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e260	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e270	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e290	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e460	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e54c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e590	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e62c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e724	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eca4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ecd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f6dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f81c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a00c	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x83a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8a70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x919c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x97b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9ea8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa5a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xac68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb4cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f89c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1f8c0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xbc80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbf10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc1f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc580	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcbd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a0d4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xcd2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcea8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a0d8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2a194	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd0c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd0d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd1a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1bc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2a1c0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2a1c4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xd9c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xda28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdb04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe22c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1c8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xe4ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe528	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe578	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe5d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe8e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xede8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xefc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf7b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x101ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x103cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x105e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1cc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x207ec	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2a1d0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x10784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x115dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1171c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11928	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11a58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ba4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1e4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x12578	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x12eb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1385c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x14188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1420c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x143b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1445c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x144ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14524	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1459c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x145dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1461c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1465c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x146b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14834	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14874	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x148e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1491c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ab0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cfc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14dbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20988	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x14f4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x152b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15348	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x154e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15918	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15b14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1f0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2a1ec	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1644c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a04	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1674c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2d4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x20a0c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17078	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17428	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a90	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x17b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17cf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17da8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17df0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17fb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18028	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18188	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x183a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2d8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x18e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1984c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a2f0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a308	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2a3a0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x19bc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19c94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x215fc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a13c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a3b4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1a284	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a8a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a918	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ad84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1adec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b3fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b464	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b4d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b710	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b880	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b930	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b988	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1baa8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a3cc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1be6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1becc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bf20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c2cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a3d0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1c340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c3c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c42c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c4cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c61c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c66c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c714	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c980	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ce68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21a00	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1ddbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e378	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e458	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e544	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e71c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e84c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e998	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eb80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2a1e0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x2a3dc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x216e8	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x2166c	12	OBJECT	<unknown>	DEFAULT	4
C.31.4587	.symtab	0x1f8c0	44	OBJECT	<unknown>	DEFAULT	4
C.32.4588	.symtab	0x1f89c	36	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x20988	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x21678	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x209ac	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x209dc	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x209b8	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x209d0	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x209c4	12	OBJECT	<unknown>	DEFAULT	4
GET_UID	.symtab	0x3009c	1	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR	.symtab	0x30094	4	OBJECT	<unknown>	DEFAULT	15
LOCAL_ADDR2	.symtab	0x300dc	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x176b8	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x176d4	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x1c364	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2a014	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x12c68	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x12c6c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1391c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x12c60	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x12ca4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x13940	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x140e0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x12c98	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x138b0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x138d4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x138f8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x12bc8	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x131e0	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x12c14	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2a3dc	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x216e8	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2a000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2a000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2a3dc	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1b110	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1b0f4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2a3e0	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x14238	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1dc98	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x179cc	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1b110	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x142d0	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1b1a0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1b230	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1e790	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1c344	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x12418	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x1241c	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1b1a0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1b184	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x2b3e8	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x11594	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x115e8	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1b230	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1b214	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1adf4	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x182dc	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x18300	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x182b8	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x2b3c8	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1be04	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1bed4	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1e790	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1e774	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x179e4	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1c364	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x19738	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x17bfc	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x19e84	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x17c70	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1e800	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x14404	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1b110	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x14b24	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1ccbc	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1ccf0	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1c994	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x17cf8	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1a098	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x14f94	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x142d0	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x17094	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1db54	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1dc98	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x16cc8	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x17440	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x152c4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a980	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x153bc	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x174e0	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1e9a0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1e9c4	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1c3cc	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x17518	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1dc98	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1c4d0	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1c4fc	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1c510	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1c524	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1443c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1af7c	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x14478	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x17d6c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x144b0	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1c538	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x17b90	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1e62c	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x19ca0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1c54c	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x17af0	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x144f0	56	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1edb4	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1e290	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x175e0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1e260	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x176f0	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1e380	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x175f0	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x14114	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1c62c	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x145e0	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x14660	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1b1a0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x14d04	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x152e4	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1afc4	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x19878	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x19b38	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1b230	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x14e78	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1c8a8	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x147b8	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x17e3c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x17ef4	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x15358	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1c670	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1c6b0	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x14964	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17fc0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1807c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x149e8	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x18104	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x19d98	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x14190	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x18190	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x181e0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x181f4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x14a28	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x153ec	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1814c	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x19bc8	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x17714	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1e460	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1e270	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1e270	28	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1e54c	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x17690	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x17804	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1e590	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1e5e0	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x178d0	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x19ea4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1a2a8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x17b14	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x14ab4	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1c71c	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x14ae4	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x15b60	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1541c	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1cd38	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1cdb0	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1cd8c	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1e790	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2a010	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x2a010	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x1391c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x138b0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x138d4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x138f8	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1ee30	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1f78c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1f78c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1f770	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1f81c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1ee30	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1f7a4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1f7ec	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1f804	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1f7d4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1f7bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1f4d0	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1f240	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1ee24	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1ee2c	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1f18c	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1f164	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x12a70	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x12b9c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1f1e0	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0xe4b0	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1f140	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1295c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12a58	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1f1cc	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1387c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x13874	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1386c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x30088	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x2a3b4	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x30668	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2a3e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2a3e4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1be80	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1a91c	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1b110	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1b0f4	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1f6ec	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2a3e0	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x30090	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2a0d4	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0xefcc	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x14230	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x14224	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x2a1e0	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x12bb4	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1f4d0	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x12a70	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2a00c	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x30668	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x30080	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x1f6ec	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0xe50c	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1a97c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x21bd0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x21a60	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2f5f4	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x1f18c	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x14238	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1dc98	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0xe7c0	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x2a010	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x2a00c	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x1f81c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1f1e0	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1f164	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1f1cc	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1f140	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0xe388	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x30250	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x30634	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x30638	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x2f5f8	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x2a008	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0xef28	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0xf0fc	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x1f6dc	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1c430	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1e858	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1443c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1af7c	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x179cc	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x13020	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x13108	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x138a0	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1309c	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x131c0	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x138a8	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x13984	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x14098	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x13324	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1f6dc	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2a00c	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x2a008	0	NOTYPE	<unknown>	HIDDEN	10
__init_sched_fifo_prio	.symtab	0x11dc4	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x30248	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x1f6e4	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x17bfc	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1b110	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x17cf8	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1b2a0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1b328	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x142d0	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a980	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x14528	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x3063c	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x30244	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x14660	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1b1a0	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1ad4c	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1b230	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x17e3c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x17ef4	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x14964	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17fc0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1807c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1b508	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x14190	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x14528	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x3007c	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1e790	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1ad90	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x117bc	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x11724	152	FUNC	<unknown>	HIDDEN	2
__lll_robust_lock_wait	.symtab	0x11bac	208	FUNC	<unknown>	HIDDEN	2
__lll_robust_timedlock_wait	.symtab	0x11a60	332	FUNC	<unknown>	HIDDEN	2
__lll_timedlock_wait	.symtab	0x11930	304	FUNC	<unknown>	HIDDEN	2
__lll_timedwait_tid	.symtab	0x11858	216	FUNC	<unknown>	HIDDEN	2
__longjmp	.symtab	0x1c344	20	FUNC	<unknown>	DEFAULT	2
__ltdf2	.symtab	0x1f6e4	140	FUNC	<unknown>	HIDDEN	2
__make_stacks_executable	.symtab	0xedec	8	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x19308	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x183a8	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2a2d8	24	OBJECT	<unknown>	DEFAULT	14
__malloc_state	.symtab	0x302bc	888	OBJECT	<unknown>	DEFAULT	15
__malloc_trim	.symtab	0x19258	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1f240	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1f6ec	132	FUNC	<unknown>	HIDDEN	2
__nptl_create_event	.symtab	0x12418	4	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0xedf4	308	FUNC	<unknown>	HIDDEN	2
__nptl_death_event	.symtab	0x1241c	4	FUNC	<unknown>	DEFAULT	2
__nptl_initial_report_events	.symtab	0x2d3ec	1	OBJECT	<unknown>	DEFAULT	15
__nptl_last_event	.symtab	0x2b3dc	4	OBJECT	<unknown>	DEFAULT	15
__nptl_nthreads	.symtab	0x2a1cc	4	OBJECT	<unknown>	DEFAULT	14
__nptl_setxid	.symtab	0xeaf4	688	FUNC	<unknown>	HIDDEN	2
__nptl_threads_events	.symtab	0x2b3d4	8	OBJECT	<unknown>	DEFAULT	15
__open	.symtab	0x1b1a0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x1b184	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x30084	4	OBJECT	<unknown>	DEFAULT	15
__preinit_array_end	.symtab	0x2a008	0	NOTYPE	<unknown>	HIDDEN	9
__preinit_array_start	.symtab	0x2a008	0	NOTYPE	<unknown>	HIDDEN	9
__progname	.symtab	0x2a3d4	4	OBJECT	<unknown>	DEFAULT	14
__progname_full	.symtab	0x2a3d8	4	OBJECT	<unknown>	DEFAULT	14
__pthread_cleanup_pop	.symtab	0x1224c	56	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_pop_restore	.symtab	0x12328	240	FUNC	<unknown>	DEFAULT	2
__pthread_cleanup_push	.symtab	0x12284	40	FUNC	<unknown>	HIDDEN	2
__pthread_cleanup_push_defer	.symtab	0x122ac	124	FUNC	<unknown>	DEFAULT	2
__pthread_create_2_1	.symtab	0xf7bc	2692	FUNC	<unknown>	DEFAULT	2
__pthread_current_priority	.symtab	0x11c84	320	FUNC	<unknown>	HIDDEN	2
__pthread_debug	.symtab	0x30240	4	OBJECT	<unknown>	HIDDEN	15
__pthread_disable_asynccancel	.symtab	0x120fc	136	FUNC	<unknown>	HIDDEN	2
__pthread_enable_asynccancel	.symtab	0x12184	200	FUNC	<unknown>	HIDDEN	2
__pthread_init_static_tls	.symtab	0x10240	412	FUNC	<unknown>	HIDDEN	2
__pthread_initialize_minimal	.symtab	0x1266c	752	FUNC	<unknown>	DEFAULT	2
__pthread_initialize_minimal_internal	.symtab	0x1266c	752	FUNC	<unknown>	HIDDEN	2
__pthread_keys	.symtab	0x2b3e8	8192	OBJECT	<unknown>	DEFAULT	15
__pthread_multiple_threads	.symtab	0x3024c	4	OBJECT	<unknown>	HIDDEN	15
__pthread_mutex_lock	.symtab	0x10d40	576	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_lock_full	.symtab	0x1078c	1460	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock_internal	.symtab	0x10d40	576	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock	.symtab	0x1158c	8	FUNC	<unknown>	PROTECTED	2
__pthread_mutex_unlock_full	.symtab	0x10f80	1264	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock_internal	.symtab	0x1158c	8	FUNC	<unknown>	HIDDEN	2
__pthread_mutex_unlock_usercnt	.symtab	0x11470	284	FUNC	<unknown>	HIDDEN	2
__pthread_return_0	.symtab	0x1bdc0	8	FUNC	<unknown>	DEFAULT	2
__pthread_tpp_change_priority	.symtab	0x11e10	748	FUNC	<unknown>	HIDDEN	2
__pthread_unwind	.symtab	0x11594	84	FUNC	<unknown>	DEFAULT	2
__pthread_unwind_next	.symtab	0x115e8	16	FUNC	<unknown>	DEFAULT	2
__read	.symtab	0x1b230	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x1b214	24	FUNC	<unknown>	DEFAULT	2
__reclaim_stacks	.symtab	0x103dc	548	FUNC	<unknown>	HIDDEN	2
__register_atfork	.symtab	0x1adf4	392	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resp	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
__restore_core_regs	.symtab	0x13884	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x3008c	4	OBJECT	<unknown>	HIDDEN	15
__sched_fifo_max_prio	.symtab	0x2a1e8	4	OBJECT	<unknown>	HIDDEN	14
__sched_fifo_min_prio	.symtab	0x2a1e4	4	OBJECT	<unknown>	HIDDEN	14
__set_robust_list_avail	.symtab	0x3025c	4	OBJECT	<unknown>	HIDDEN	15
__sigaction	.symtab	0xe4c0	76	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x182dc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x18300	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x182b8	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1e724	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c358	12	FUNC	<unknown>	DEFAULT	2
__stack_user	.symtab	0x2b3c8	8	OBJECT	<unknown>	DEFAULT	15
__static_tls_align_m1	.symtab	0x30254	4	OBJECT	<unknown>	HIDDEN	15
__static_tls_size	.symtab	0x30258	4	OBJECT	<unknown>	HIDDEN	15
__stdin	.symtab	0x2a1fc	4	OBJECT	<unknown>	DEFAULT	14
__stdio_READ	.symtab	0x1eb84	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1ce6c	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1ebdc	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1cf48	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1eca4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1ed78	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1ecd4	164	FUNC	<unknown>	HIDDEN	2

Network Behavior

⊘No network behavior found

System Behavior

Analysis Process: na.elf PID: 5759, Parent PID: 5685

General

Start time (UTC):	15:17:56
Start date (UTC):	12/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

System Behavior

Analysis Process: na.elf PID: 5759, Parent PID: 5685

General

Chronological Activities

Linux Analysis Report
na.elf