Loading ...

Play interactive tourEdit tour

Linux Analysis Report s7vKdnDi77

Overview

General Information

Sample Name:s7vKdnDi77
Analysis ID:553138
MD5:c7004f16f15c92e4acd0d78825329a56
SHA1:08759270368ad69eab73219cc032a3dca620f1da
SHA256:1ed43a0a7805aff1bae9db3a9cdd0a45ceb3fbd18f84ce7d8cf0c4d49d918838
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:96
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Contains symbols with names commonly found in malware
Yara signature match
Sample contains strings indicative of password brute-forcing capabilities
Uses the "uname" system call to query kernel version information (possible evasion)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures
All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work
Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:553138
Start date:14.01.2022
Start time:11:24:23
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 8s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:s7vKdnDi77
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal96.troj.lin@0/0@0/0
Warnings:
Show All
  • Report size exceeded maximum capacity and may have missing network information.

Process Tree

  • system is lnxubuntu20
  • s7vKdnDi77 (PID: 5240, Parent: 5138, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/s7vKdnDi77
  • cleanup

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
s7vKdnDi77SUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
  • 0x18194:$xo1: _}h{~~s='<"
  • 0x18204:$xo1: _}h{~~s='<"
  • 0x18274:$xo1: _}h{~~s='<"
  • 0x182e4:$xo1: _}h{~~s='<"
  • 0x18354:$xo1: _}h{~~s='<"
s7vKdnDi77MAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
  • 0x17108:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
s7vKdnDi77JoeSecurity_Mirai_5Yara detected MiraiJoe Security
    s7vKdnDi77JoeSecurity_Mirai_8Yara detected MiraiJoe Security

      PCAP (Network Traffic)

      SourceRuleDescriptionAuthorStrings
      dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
        • 0x18194:$xo1: _}h{~~s='<"
        • 0x18204:$xo1: _}h{~~s='<"
        • 0x18274:$xo1: _}h{~~s='<"
        • 0x182e4:$xo1: _}h{~~s='<"
        • 0x18354:$xo1: _}h{~~s='<"
        5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
        • 0x17108:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
        5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
          5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
            5240.1.0000000063017c71.000000008031ab92.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
            • 0x3a40:$xo1: _}h{~~s='<"
            • 0x3ab8:$xo1: _}h{~~s='<"
            • 0x3b30:$xo1: _}h{~~s='<"
            • 0x3ba8:$xo1: _}h{~~s='<"
            • 0x3c20:$xo1: _}h{~~s='<"
            Click to see the 7 entries

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Multi AV Scanner detection for submitted fileShow sources
            Source: s7vKdnDi77Virustotal: Detection: 59%Perma Link
            Source: s7vKdnDi77Metadefender: Detection: 37%Perma Link
            Source: s7vKdnDi77ReversingLabs: Detection: 62%

            Networking:

            barindex
            Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 115.53.244.14:23 -> 192.168.2.23:36440
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 115.53.244.14:23 -> 192.168.2.23:36440
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46044
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46044
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46142
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46142
            Source: TrafficSnort IDS: 716 INFO TELNET access 123.142.76.198:23 -> 192.168.2.23:55886
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46316
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.64.214.57:23 -> 192.168.2.23:42890
            Source: TrafficSnort IDS: 716 INFO TELNET access 189.204.52.1:23 -> 192.168.2.23:50546
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37104
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46316
            Source: TrafficSnort IDS: 716 INFO TELNET access 189.204.52.1:23 -> 192.168.2.23:50614
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46514
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37104
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37104
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 209.112.186.138:23 -> 192.168.2.23:46566
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 209.112.186.138:23 -> 192.168.2.23:46566
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46514
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46576
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37258
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46576
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37258
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37258
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46648
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 115.53.244.14:23 -> 192.168.2.23:37106
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 115.53.244.14:23 -> 192.168.2.23:37106
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46648
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37406
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46756
            Source: TrafficSnort IDS: 716 INFO TELNET access 123.142.76.198:23 -> 192.168.2.23:56418
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46756
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37406
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37406
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.64.214.57:23 -> 192.168.2.23:43350
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51320
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:46890
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51372
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:46890
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37618
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47016
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51484
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37618
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37618
            Source: TrafficSnort IDS: 2023447 ET TROJAN Possible Linux.Mirai Login Attempt (service) 192.168.2.23:47112 -> 209.112.186.138:23
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47016
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51566
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 209.112.186.138:23 -> 192.168.2.23:47112
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 209.112.186.138:23 -> 192.168.2.23:47112
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51594
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39608
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47174
            Source: TrafficSnort IDS: 716 INFO TELNET access 115.89.185.158:23 -> 192.168.2.23:34988
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51666
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:37900
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39696
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47174
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:33940
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:33940
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51778
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39814
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47378
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:37900
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:37900
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39910
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:43664
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51910
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47378
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51922
            Source: TrafficSnort IDS: 716 INFO TELNET access 123.142.76.198:23 -> 192.168.2.23:57122
            Source: TrafficSnort IDS: 716 INFO TELNET access 190.6.252.2:23 -> 192.168.2.23:51942
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.64.214.57:23 -> 192.168.2.23:44060
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47526
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:34226
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:34226
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:39986
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:38196
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47526
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40030
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:43800
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:38196
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:38196
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:59908
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47608
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40076
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:59948
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47608
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:34378
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:34378
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40174
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:38384
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:43934
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47738
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60044
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60064
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36852
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36894
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36912
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 177.81.24.52:23 -> 192.168.2.23:38384
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 177.81.24.52:23 -> 192.168.2.23:38384
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47738
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40282
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36920
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36924
            Source: TrafficSnort IDS: 716 INFO TELNET access 115.89.185.158:23 -> 192.168.2.23:35626
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36942
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36950
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36954
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36978
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36982
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36986
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 209.112.186.138:23 -> 192.168.2.23:47896
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 209.112.186.138:23 -> 192.168.2.23:47896
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:36984
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60214
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37006
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37010
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37014
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37020
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:47942
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 221.199.8.158:23 -> 192.168.2.23:44138
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37042
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37048
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37050
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40426
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37058
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 188.162.89.134:23 -> 192.168.2.23:34630
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 188.162.89.134:23 -> 192.168.2.23:34630
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37086
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37092
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37098
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37106
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37134
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37146
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60372
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37160
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37168
            Source: TrafficSnort IDS: 716 INFO TELNET access 112.115.163.194:23 -> 192.168.2.23:34782
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 116.55.54.117:23 -> 192.168.2.23:47942
            Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 221.155.33.194:23 -> 192.168.2.23:57538
            Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 221.155.33.194:23 -> 192.168.2.23:57538
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37194
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37200
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37210
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60434
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37216
            Source: TrafficSnort IDS: 716 INFO TELNET access 177.81.24.52:23 -> 192.168.2.23:38810
            Source: TrafficSnort IDS: 716 INFO TELNET access 218.28.175.187:23 -> 192.168.2.23:40618
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37250
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37260
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37266
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37270
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37290
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37296
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37298
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37304
            Source: TrafficSnort IDS: 716 INFO TELNET access 116.55.54.117:23 -> 192.168.2.23:48230
            Source: TrafficSnort IDS: 716 INFO TELNET access 121.61.14.255:23 -> 192.168.2.23:60516
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37322
            Source: TrafficSnort IDS: 716 INFO TELNET access 65.155.84.89:23 -> 192.168.2.23:37328
            Source: TrafficSnort IDS: 492 INFO TELNET login failed 112.115.163.194:23 -> 192.168.2.23:34782
            Uses known network protocols on non-standard portsShow sources
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35390
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35398
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35404
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35414
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35422
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35430
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35442
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35446
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35450
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35454
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35466
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35454
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35476
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35480
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35492
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35498
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35500
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35512
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35514
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35520
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35554
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35556
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35562
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35566
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35576
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35582
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57426
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57434
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57442
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57466
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57476
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57490
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57502
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57520
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57530
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57550
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57566
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57580
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57600
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57618
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57652
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57668
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57690
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57728
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57742
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57760
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57798
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57816
            Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
            Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
            Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
            Source: global trafficTCP traffic: 192.168.2.23:39428 -> 109.237.96.10:16771
            Source: /tmp/s7vKdnDi77 (PID: 5240)Socket: 127.0.0.1::9473Jump to behavior
            Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
            Source: unknownTCP traffic detected without corresponding DNS query: 109.237.96.10
            Source: unknownTCP traffic detected without corresponding DNS query: 179.152.52.55
            Source: unknownTCP traffic detected without corresponding DNS query: 83.2.90.160
            Source: unknownTCP traffic detected without corresponding DNS query: 152.152.127.54
            Source: unknownTCP traffic detected without corresponding DNS query: 220.115.20.26
            Source: unknownTCP traffic detected without corresponding DNS query: 128.99.42.49
            Source: unknownTCP traffic detected without corresponding DNS query: 165.47.168.40
            Source: unknownTCP traffic detected without corresponding DNS query: 222.77.217.211
            Source: unknownTCP traffic detected without corresponding DNS query: 153.84.214.109
            Source: unknownTCP traffic detected without corresponding DNS query: 108.191.9.10
            Source: unknownTCP traffic detected without corresponding DNS query: 183.161.149.26
            Source: unknownTCP traffic detected without corresponding DNS query: 126.85.218.158
            Source: unknownTCP traffic detected without corresponding DNS query: 148.168.95.159
            Source: unknownTCP traffic detected without corresponding DNS query: 180.42.181.127
            Source: unknownTCP traffic detected without corresponding DNS query: 40.63.80.3
            Source: unknownTCP traffic detected without corresponding DNS query: 95.53.136.208
            Source: unknownTCP traffic detected without corresponding DNS query: 35.197.189.106
            Source: unknownTCP traffic detected without corresponding DNS query: 146.253.81.113
            Source: unknownTCP traffic detected without corresponding DNS query: 199.52.99.108
            Source: unknownTCP traffic detected without corresponding DNS query: 92.185.158.253
            Source: unknownTCP traffic detected without corresponding DNS query: 102.242.177.197
            Source: unknownTCP traffic detected without corresponding DNS query: 207.235.142.149
            Source: unknownTCP traffic detected without corresponding DNS query: 17.76.13.215
            Source: unknownTCP traffic detected without corresponding DNS query: 187.169.23.117
            Source: unknownTCP traffic detected without corresponding DNS query: 211.155.176.161
            Source: unknownTCP traffic detected without corresponding DNS query: 164.96.72.64
            Source: unknownTCP traffic detected without corresponding DNS query: 211.181.176.110
            Source: unknownTCP traffic detected without corresponding DNS query: 118.205.227.152
            Source: unknownTCP traffic detected without corresponding DNS query: 206.211.49.208
            Source: unknownTCP traffic detected without corresponding DNS query: 157.22.237.202
            Source: unknownTCP traffic detected without corresponding DNS query: 113.227.19.160
            Source: unknownTCP traffic detected without corresponding DNS query: 152.88.182.158
            Source: unknownTCP traffic detected without corresponding DNS query: 139.151.39.235
            Source: unknownTCP traffic detected without corresponding DNS query: 1.204.61.234
            Source: unknownTCP traffic detected without corresponding DNS query: 223.70.146.149
            Source: unknownTCP traffic detected without corresponding DNS query: 73.66.22.178
            Source: unknownTCP traffic detected without corresponding DNS query: 24.184.140.0
            Source: unknownTCP traffic detected without corresponding DNS query: 104.7.129.78
            Source: unknownTCP traffic detected without corresponding DNS query: 194.216.87.166
            Source: unknownTCP traffic detected without corresponding DNS query: 63.185.220.145
            Source: unknownTCP traffic detected without corresponding DNS query: 216.225.5.196
            Source: unknownTCP traffic detected without corresponding DNS query: 187.71.94.135
            Source: unknownTCP traffic detected without corresponding DNS query: 222.38.0.160
            Source: unknownTCP traffic detected without corresponding DNS query: 101.19.252.3
            Source: unknownTCP traffic detected without corresponding DNS query: 148.229.20.43
            Source: unknownTCP traffic detected without corresponding DNS query: 179.84.203.140
            Source: unknownTCP traffic detected without corresponding DNS query: 87.1.115.98
            Source: unknownTCP traffic detected without corresponding DNS query: 75.218.47.46
            Source: unknownTCP traffic detected without corresponding DNS query: 137.138.184.242
            Source: unknownTCP traffic detected without corresponding DNS query: 152.18.190.84

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: s7vKdnDi77, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
            Contains symbols with names commonly found in malwareShow sources
            Source: ELF static info symbol of initial sampleName: attack.c
            Source: ELF static info symbol of initial sampleName: attack_app.c
            Source: ELF static info symbol of initial sampleName: attack_app_http
            Source: ELF static info symbol of initial sampleName: attack_get_opt_int
            Source: ELF static info symbol of initial sampleName: attack_get_opt_ip
            Source: ELF static info symbol of initial sampleName: attack_get_opt_str
            Source: ELF static info symbol of initial sampleName: attack_init
            Source: ELF static info symbol of initial sampleName: attack_method.c
            Source: ELF static info symbol of initial sampleName: attack_method_ack
            Source: ELF static info symbol of initial sampleName: attack_method_gre
            Source: s7vKdnDi77, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: s7vKdnDi77, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: 5240.1.0000000063017c71.000000008031ab92.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: 5246.1.0000000063017c71.000000008031ab92.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
            Source: Process Memory Space: s7vKdnDi77 PID: 5240, type: MEMORYSTRMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: Process Memory Space: s7vKdnDi77 PID: 5246, type: MEMORYSTRMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
            Source: Initial sampleString containing potential weak password found: default
            Source: Initial sampleString containing potential weak password found: admin
            Source: Initial sampleString containing potential weak password found: 54321
            Source: Initial sampleString containing potential weak password found: guest
            Source: Initial sampleString containing potential weak password found: 12345
            Source: Initial sampleString containing potential weak password found: supervisor
            Source: Initial sampleString containing potential weak password found: password
            Source: Initial sampleString containing potential weak password found: admin1234
            Source: Initial sampleString containing potential weak password found: 123456
            Source: Initial sampleString containing potential weak password found: service
            Source: Initial sampleString containing potential weak password found: support
            Source: Initial sampleString containing potential weak password found: 12345678
            Source: classification engineClassification label: mal96.troj.lin@0/0@0/0

            Hooking and other Techniques for Hiding and Protection:

            barindex
            Uses known network protocols on non-standard portsShow sources
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35390
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35398
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35404
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35414
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35422
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35430
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35442
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35446
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35450
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35454
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35466
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35454
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35476
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35480
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35492
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35498
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35500
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35512
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35514
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35520
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35554
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35556
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35562
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35566
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35576
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 35582
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57426
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57434
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57442
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57466
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57476
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57490
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57502
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57520
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57530
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57550
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57566
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57580
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57600
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57618
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57652
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57668
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57690
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57728
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57742
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57760
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57798
            Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57816
            Source: /tmp/s7vKdnDi77 (PID: 5240)Queries kernel information via 'uname': Jump to behavior
            Source: s7vKdnDi77, 5240.1.00000000b6b1ac15.00000000185438df.rw-.sdmp, s7vKdnDi77, 5246.1.00000000b6b1ac15.00000000cef7dc57.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
            Source: s7vKdnDi77, 5240.1.00000000b6b1ac15.00000000185438df.rw-.sdmp, s7vKdnDi77, 5246.1.00000000b6b1ac15.00000000cef7dc57.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
            Source: s7vKdnDi77, 5240.1.00000000c2533b13.00000000a1dd4886.rw-.sdmp, s7vKdnDi77, 5246.1.00000000c2533b13.00000000a1dd4886.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
            Source: s7vKdnDi77, 5240.1.00000000c2533b13.00000000a1dd4886.rw-.sdmp, s7vKdnDi77, 5246.1.00000000c2533b13.00000000a1dd4886.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/s7vKdnDi77SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/s7vKdnDi77

            Stealing of Sensitive Information:

            barindex
            Yara detected MiraiShow sources
            Source: Yara matchFile source: dump.pcap, type: PCAP
            Source: Yara matchFile source: s7vKdnDi77, type: SAMPLE
            Source: Yara matchFile source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY

            Remote Access Functionality:

            barindex
            Yara detected MiraiShow sources
            Source: Yara matchFile source: dump.pcap, type: PCAP
            Source: Yara matchFile source: s7vKdnDi77, type: SAMPLE
            Source: Yara matchFile source: 5240.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5246.1.0000000050b0cb91.00000000265421ed.r-x.sdmp, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessBrute Force1Security Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

            Malware Configuration

            No configs have been found

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 553138 Sample: s7vKdnDi77 Startdate: 14/01/2022 Architecture: LINUX Score: 96 18 41.60.37.74 ZOL-ASGB Mauritius 2->18 20 66.238.150.209 XO-AS15US United States 2->20 22 98 other IPs or domains 2->22 24 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->24 26 Malicious sample detected (through community Yara rule) 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 3 other signatures 2->30 8 s7vKdnDi77 2->8         started        signatures3 process4 process5 10 s7vKdnDi77 8->10         started        process6 12 s7vKdnDi77 10->12         started        14 s7vKdnDi77 10->14         started        16 s7vKdnDi77 10->16         started       

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            s7vKdnDi7759%VirustotalBrowse
            s7vKdnDi7737%MetadefenderBrowse
            s7vKdnDi7763%ReversingLabsLinux.Trojan.Mirai

            Dropped Files

            No Antivirus matches

            Domains

            No Antivirus matches

            URLs

            No Antivirus matches

            Domains and IPs

            Contacted Domains

            No contacted domains info

            Contacted IPs

            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs

            Public

            IPDomainCountryFlagASNASN NameMalicious
            204.27.217.172
            unknownUnited States
            18682AAMU-INTERNETUSfalse
            135.32.10.197
            unknownUnited States
            54614CIKTELECOM-CABLECAfalse
            190.214.138.57
            unknownEcuador
            28006CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPECfalse
            45.50.54.71
            unknownUnited States
            20001TWC-20001-PACWESTUSfalse
            187.18.188.123
            unknownBrazil
            28270VideomarRedeNordesteSABRfalse
            46.204.222.241
            unknownPoland
            12912TMPLfalse
            85.136.26.166
            unknownSpain
            12357COMUNITELSPAINESfalse
            194.0.84.190
            unknownCroatia (LOCAL Name: Hrvatska)
            28862INA-HR-ASHRfalse
            42.23.111.98
            unknownKorea Republic of
            9644SKTELECOM-NET-ASSKTelecomKRfalse
            179.30.41.166
            unknownUruguay
            6057AdministracionNacionaldeTelecomunicacionesUYfalse
            183.59.101.253
            unknownChina
            4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            62.212.42.29
            unknownGeorgia
            34797SYSTEM-NETGEfalse
            66.238.150.209
            unknownUnited States
            2828XO-AS15USfalse
            186.198.141.191
            unknownBrazil
            26615TIMSABRfalse
            114.53.185.89
            unknownKorea Republic of
            18302SKG_NW-AS-KRSKTelecomKRfalse
            110.11.240.214
            unknownKorea Republic of
            9318SKB-ASSKBroadbandCoLtdKRfalse
            168.197.111.122
            unknownSint Maarten
            27781SMITCOMSNVSXfalse
            41.60.37.74
            unknownMauritius
            30969ZOL-ASGBfalse
            19.113.76.30
            unknownUnited States
            3MIT-GATEWAYSUSfalse
            162.144.165.123
            unknownUnited States
            46606UNIFIEDLAYER-AS-1USfalse
            133.199.204.240
            unknownJapan2516KDDIKDDICORPORATIONJPfalse
            71.52.220.73
            unknownUnited States
            209CENTURYLINK-US-LEGACY-QWESTUSfalse
            74.200.43.113
            unknownUnited States
            14010JACKHENRYUSfalse
            105.239.2.105
            unknownSudan
            36998SDN-MOBITELSDfalse
            164.147.60.211
            unknownSouth Africa
            37130SITA-ASZAfalse
            35.41.112.192
            unknownUnited States
            36375UMICH-AS-5USfalse
            149.224.54.91
            unknownGermany
            15943WTNET-ASwilhelmtelGmbHDEfalse
            90.216.232.241
            unknownUnited Kingdom
            5607BSKYB-BROADBAND-ASGBfalse
            68.244.123.135
            unknownUnited States
            10507SPCSUSfalse
            53.249.211.64
            unknownGermany
            31399DAIMLER-ASITIGNGlobalNetworkDEfalse
            87.198.165.182
            unknownIreland
            34245MAGNET-ASIEfalse
            147.29.88.207
            unknownDenmark
            5624DXCTechnologyDKfalse
            23.28.227.136
            unknownUnited States
            12083WOW-INTERNETUSfalse
            64.216.75.5
            unknownUnited States
            7018ATT-INTERNET4USfalse
            8.17.40.162
            unknownUnited States
            23089HOTWIRE-COMMUNICATIONSUSfalse
            155.244.100.186
            unknownUnited States
            668DNIC-AS-00668USfalse
            196.14.61.84
            unknownSouth Africa
            3741ISZAfalse
            20.192.81.234
            unknownUnited States
            8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            20.220.180.144
            unknownUnited States
            8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            14.244.110.225
            unknownViet Nam
            45899VNPT-AS-VNVNPTCorpVNfalse
            115.45.252.11
            unknownChina
            17962TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCNfalse
            194.61.106.8
            unknownLuxembourg
            21155ASN-PROSERVEAmsterdamNLfalse
            161.30.249.20
            unknownUnited Kingdom
            31515INMARSATGBfalse
            97.78.53.125
            unknownUnited States
            33363BHN-33363USfalse
            2.73.205.136
            unknownKazakhstan
            29355KCELL-ASKZfalse
            151.231.128.231
            unknownUnited Kingdom
            5607BSKYB-BROADBAND-ASGBfalse
            94.35.200.82
            unknownItaly
            8612TISCALI-ITfalse
            43.116.224.15
            unknownJapan4249LILLY-ASUSfalse
            213.197.169.156
            unknownLithuania
            15440BALTNETACustomersASLTfalse
            110.159.18.253
            unknownMalaysia
            4788TMNET-AS-APTMNetInternetServiceProviderMYfalse
            89.55.185.212
            unknownGermany
            5430FREENETDEfreenetDatenkommunikationsGmbHDEfalse
            86.122.212.89
            unknownRomania
            8708RCS-RDS73-75DrStaicoviciROfalse
            62.206.208.159
            unknownGermany
            20676PLUSNETDEfalse
            206.90.168.39
            unknownUnited States
            3549LVLT-3549USfalse
            114.190.66.65
            unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
            171.37.201.41
            unknownChina
            4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            206.234.73.102
            unknownUnited States
            174COGENT-174USfalse
            17.115.203.104
            unknownUnited States
            714APPLE-ENGINEERINGUSfalse
            200.115.155.162
            unknownPanama
            21599CableOndaPAfalse
            164.184.8.118
            unknownUnited States
            37717EL-KhawarizmiTNfalse
            43.189.160.67
            unknownJapan4249LILLY-ASUSfalse
            65.161.32.126
            unknownUnited States
            1239SPRINTLINKUSfalse
            182.248.10.121
            unknownJapan2516KDDIKDDICORPORATIONJPfalse
            45.75.247.63
            unknownUnited Kingdom
            49425DIGITAL-REALTY-UKGBfalse
            139.162.198.100
            unknownNetherlands
            63949LINODE-APLinodeLLCUSfalse
            20.197.35.159
            unknownUnited States
            8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            9.226.52.184
            unknownUnited States
            3356LEVEL3USfalse
            160.115.102.54
            unknownSouth Africa
            6711HUNGARNET-SZEGEDSzegedUniversityAssociationandHUfalse
            13.27.46.121
            unknownUnited States
            26662XEROX-WVUSfalse
            24.1.63.121
            unknownUnited States
            7922COMCAST-7922USfalse
            143.118.4.154
            unknownSweden
            1881FMVSEfalse
            57.255.10.200
            unknownBelgium
            2686ATGS-MMD-ASUSfalse
            89.70.205.186
            unknownPoland
            6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
            187.117.54.244
            unknownBrazil
            26599TELEFONICABRASILSABRfalse
            164.171.204.250
            unknownUnited States
            22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
            166.73.67.203
            unknownUnited States
            6318CHECKFREEUSfalse
            142.254.167.45
            unknownUnited States
            12271TWC-12271-NYCUSfalse
            183.54.199.129
            unknownChina
            4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            197.228.244.196
            unknownSouth Africa
            37251TELKOMMOBILEZAfalse
            94.56.115.42
            unknownUnited Arab Emirates
            5384EMIRATES-INTERNETEmiratesInternetAEfalse
            131.143.147.98
            unknownUnited States
            1742HARVARD-UNIVUSfalse
            131.127.5.215
            unknownUnited States
            668DNIC-AS-00668USfalse
            94.110.83.77
            unknownBelgium
            47377ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquiredfalse
            39.215.102.196
            unknownIndonesia
            23693TELKOMSEL-ASN-IDPTTelekomunikasiSelularIDfalse
            144.246.29.224
            unknownUnited States
            1477DNIC-ASBLK-01474-01477USfalse
            2.196.140.242
            unknownItaly
            16232ASN-TIMServiceProviderITfalse
            138.209.172.72
            unknownUnited States
            21727HAMLINE-EDUUSfalse
            142.184.216.13
            unknownCanada
            577BACOMCAfalse
            188.103.181.58
            unknownGermany
            3209VODANETInternationalIP-BackboneofVodafoneDEfalse
            213.73.12.176
            unknownPoland
            21064OLMAN-COM-ASOLMANMetropolitanAreaNetworkcommercialASfalse
            66.159.117.247
            unknownCanada
            5690VIANET-NOCAfalse
            88.252.86.135
            unknownTurkey
            9121TTNETTRfalse
            179.247.8.25
            unknownBrazil
            26599TELEFONICABRASILSABRfalse
            176.8.233.93
            unknownUkraine
            15895KSNET-ASUAfalse
            140.89.210.143
            unknownUnited States
            33651CMCSUSfalse
            216.18.233.102
            unknownUnited States
            33569ALLHOSTSHOPUSfalse
            58.222.142.125
            unknownChina
            137697CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZfalse
            170.73.136.1
            unknownUnited States
            16761FEDMOG-ASN-01USfalse
            182.37.50.95
            unknownChina
            4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            155.159.23.90
            unknownSouth Africa
            137951CLAYERLIMITED-AS-APClayerLimitedHKfalse


            Runtime Messages

            Command:/tmp/s7vKdnDi77
            Exit Code:0
            Exit Code Info:
            Killed:False
            Standard Output:
            connecterror
            Standard Error:

            Joe Sandbox View / Context

            IPs

            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
            41.60.37.742C8yZ0YVrnGet hashmaliciousBrowse
              66.238.150.209DQak2G9Ly5Get hashmaliciousBrowse
                105.239.2.105DEMONS.arm7Get hashmaliciousBrowse

                  Domains

                  No context

                  ASN

                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                  CIKTELECOM-CABLECAsora.arm7Get hashmaliciousBrowse
                  • 135.40.190.27
                  EZS4EZ0anuGet hashmaliciousBrowse
                  • 135.24.37.115
                  jew.x86Get hashmaliciousBrowse
                  • 135.49.66.245
                  XnrieHp37kGet hashmaliciousBrowse
                  • 135.41.207.106
                  bziV7sec2eGet hashmaliciousBrowse
                  • 162.208.146.189
                  sora.arm-20220109-2200Get hashmaliciousBrowse
                  • 135.16.94.25
                  tBIZ9KD0zWGet hashmaliciousBrowse
                  • 135.47.229.222
                  arm7-20220109-1500Get hashmaliciousBrowse
                  • 135.37.83.174
                  K0FLQjeV3NGet hashmaliciousBrowse
                  • 135.28.225.118
                  DP035lJwIYGet hashmaliciousBrowse
                  • 135.25.250.183
                  NqTY7jNt32Get hashmaliciousBrowse
                  • 135.46.215.35
                  x86Get hashmaliciousBrowse
                  • 135.44.148.219
                  FNQ4uxDVeFGet hashmaliciousBrowse
                  • 135.36.152.180
                  ak6K4nfbk8Get hashmaliciousBrowse
                  • 45.74.70.2
                  bMffqpGs95Get hashmaliciousBrowse
                  • 135.52.163.213
                  3yAESnTq4kGet hashmaliciousBrowse
                  • 135.45.138.118
                  pQsnMSKRxzGet hashmaliciousBrowse
                  • 162.208.234.139
                  dndnchpurXGet hashmaliciousBrowse
                  • 135.0.61.74
                  AS5G7mD36AGet hashmaliciousBrowse
                  • 135.44.88.112
                  4gl0KW05BjGet hashmaliciousBrowse
                  • 135.50.191.230
                  CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPECa2XLh2LkbqGet hashmaliciousBrowse
                  • 201.219.1.139
                  Ybkk4CLvn2Get hashmaliciousBrowse
                  • 186.178.122.96
                  nhv56L031ZGet hashmaliciousBrowse
                  • 190.214.13.191
                  djM7awk3dyGet hashmaliciousBrowse
                  • 181.211.5.138
                  ArxutQ1HjLGet hashmaliciousBrowse
                  • 186.47.192.5
                  kKRcFyvuGEGet hashmaliciousBrowse
                  • 186.178.134.50
                  jKira.x86Get hashmaliciousBrowse
                  • 186.46.181.193
                  jKira.armGet hashmaliciousBrowse
                  • 181.196.14.136
                  sora.arm7Get hashmaliciousBrowse
                  • 181.211.10.54
                  nW8dVU0U98.exeGet hashmaliciousBrowse
                  • 181.196.148.202
                  yB9IhcEMywGet hashmaliciousBrowse
                  • 181.196.173.14
                  R3MbVJmhD9.exeGet hashmaliciousBrowse
                  • 181.196.148.202
                  H6c1x1Xlyg.exeGet hashmaliciousBrowse
                  • 181.196.148.202
                  apep.x86Get hashmaliciousBrowse
                  • 181.113.7.51
                  SecuriteInfo.com.W32.AIDetect.malware1.29332.exeGet hashmaliciousBrowse
                  • 181.196.148.202
                  b3xIZURN95.exeGet hashmaliciousBrowse
                  • 181.196.148.202
                  KtX5uVEPQaGet hashmaliciousBrowse
                  • 190.214.187.20
                  gXq4cfbMIxGet hashmaliciousBrowse
                  • 186.46.79.237
                  Se23ydIlT7.dllGet hashmaliciousBrowse
                  • 181.196.148.202
                  Se23ydIlT7.dllGet hashmaliciousBrowse
                  • 181.196.148.202
                  AAMU-INTERNETUSDarknet.x86Get hashmaliciousBrowse
                  • 204.27.217.163

                  JA3 Fingerprints

                  No context

                  Dropped Files

                  No context

                  Created / dropped Files

                  No created / dropped files found

                  Static File Info

                  General

                  File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
                  Entropy (8bit):6.01865945547176
                  TrID:
                  • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                  File name:s7vKdnDi77
                  File size:155973
                  MD5:c7004f16f15c92e4acd0d78825329a56
                  SHA1:08759270368ad69eab73219cc032a3dca620f1da
                  SHA256:1ed43a0a7805aff1bae9db3a9cdd0a45ceb3fbd18f84ce7d8cf0c4d49d918838
                  SHA512:0cff76c00181c4943540a4ab1d15e890979917b9c800c382269432c84180b959f4c9bf02c0c913309335a32709adc4fae543be13db323fee635966af2deb787c
                  SSDEEP:3072:9cQ07QqwGqv3B0o0fS1q7usQeifOrTLtHoSEX/5M/95R9vU:9cTQ1GqJX31q7usQVfQdoSEXxM/9/BU
                  File Content Preview:.ELF..............(.........4...........4. ...(........p.................................................................................4..........................................Q.td..................................-...L..................@-.,@...0....S

                  Static ELF Info

                  ELF header

                  Class:ELF32
                  Data:2's complement, little endian
                  Version:1 (current)
                  Machine:ARM
                  Version Number:0x1
                  Type:EXEC (Executable file)
                  OS/ABI:UNIX - System V
                  ABI Version:0
                  Entry Point Address:0x8194
                  Flags:0x4000002
                  ELF Header Size:52
                  Program Header Offset:52
                  Program Header Size:32
                  Number of Program Headers:5
                  Section Header Offset:126968
                  Section Header Size:40
                  Number of Section Headers:29
                  Header String Table Index:26

                  Sections

                  NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                  NULL0x00x00x00x00x0000
                  .initPROGBITS0x80d40xd40x100x00x6AX004
                  .textPROGBITS0x80f00xf00x170080x00x6AX0016
                  .finiPROGBITS0x1f0f80x170f80x100x00x6AX004
                  .rodataPROGBITS0x1f1080x171080x1acc0x00x2A004
                  .ARM.extabPROGBITS0x20bd40x18bd40x180x00x2A004
                  .ARM.exidxARM_EXIDX0x20bec0x18bec0x1180x00x82AL204
                  .eh_framePROGBITS0x290000x190000x40x00x3WA004
                  .tbssNOBITS0x290040x190040x80x00x403WAT004
                  .init_arrayINIT_ARRAY0x290040x190040x40x00x3WA004
                  .fini_arrayFINI_ARRAY0x290080x190080x40x00x3WA004
                  .jcrPROGBITS0x2900c0x1900c0x40x00x3WA004
                  .gotPROGBITS0x290100x190100xa80x40x3WA004
                  .dataPROGBITS0x290b80x190b80x21c0x00x3WA004
                  .bssNOBITS0x292d40x192d40x32240x00x3WA004
                  .commentPROGBITS0x00x192d40x93a0x00x0001
                  .debug_arangesPROGBITS0x00x19c100xc00x00x0008
                  .debug_pubnamesPROGBITS0x00x19cd00x2130x00x0001
                  .debug_infoPROGBITS0x00x19ee30x1d230x00x0001
                  .debug_abbrevPROGBITS0x00x1bc060x6920x00x0001
                  .debug_linePROGBITS0x00x1c2980x9c70x00x0001
                  .debug_framePROGBITS0x00x1cc600x2b80x00x0004
                  .debug_strPROGBITS0x00x1cf180x8ca0x10x30MS001
                  .debug_locPROGBITS0x00x1d7e20x118f0x00x0001
                  .debug_rangesPROGBITS0x00x1e9710x5580x00x0001
                  .ARM.attributesARM_ATTRIBUTES0x00x1eec90x160x00x0001
                  .shstrtabSTRTAB0x00x1eedf0x1170x00x0001
                  .symtabSYMTAB0x00x1f4800x49500x100x0286844
                  .strtabSTRTAB0x00x23dd00x23750x00x0001

                  Program Segments

                  TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                  EXIDX0x18bec0x20bec0x20bec0x1180x1181.54550x4R 0x4.ARM.exidx
                  LOAD0x00x80000x80000x18d040x18d043.35280x5R E0x8000.init .text .fini .rodata .ARM.extab .ARM.exidx
                  LOAD0x190000x290000x290000x2d40x34f82.11400x6RW 0x8000.eh_frame .init_array .fini_array .jcr .got .data .bss
                  TLS0x190040x290040x290040x00x80.00000x4R 0x4
                  GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                  Symbols

                  NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                  .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  .symtab0x80d40SECTION<unknown>DEFAULT1
                  .symtab0x80f00SECTION<unknown>DEFAULT2
                  .symtab0x1f0f80SECTION<unknown>DEFAULT3
                  .symtab0x1f1080SECTION<unknown>DEFAULT4
                  .symtab0x20bd40SECTION<unknown>DEFAULT5
                  .symtab0x20bec0SECTION<unknown>DEFAULT6
                  .symtab0x290000SECTION<unknown>DEFAULT7
                  .symtab0x290040SECTION<unknown>DEFAULT8
                  .symtab0x290040SECTION<unknown>DEFAULT9
                  .symtab0x290080SECTION<unknown>DEFAULT10
                  .symtab0x2900c0SECTION<unknown>DEFAULT11
                  .symtab0x290100SECTION<unknown>DEFAULT12
                  .symtab0x290b80SECTION<unknown>DEFAULT13
                  .symtab0x292d40SECTION<unknown>DEFAULT14
                  .symtab0x00SECTION<unknown>DEFAULT15
                  .symtab0x00SECTION<unknown>DEFAULT16
                  .symtab0x00SECTION<unknown>DEFAULT17
                  .symtab0x00SECTION<unknown>DEFAULT18
                  .symtab0x00SECTION<unknown>DEFAULT19
                  .symtab0x00SECTION<unknown>DEFAULT20
                  .symtab0x00SECTION<unknown>DEFAULT21
                  .symtab0x00SECTION<unknown>DEFAULT22
                  .symtab0x00SECTION<unknown>DEFAULT23
                  .symtab0x00SECTION<unknown>DEFAULT24
                  .symtab0x00SECTION<unknown>DEFAULT25
                  $a.symtab0x80d40NOTYPE<unknown>DEFAULT1
                  $a.symtab0x1f0f80NOTYPE<unknown>DEFAULT3
                  $a.symtab0x80e00NOTYPE<unknown>DEFAULT1
                  $a.symtab0x1f1040NOTYPE<unknown>DEFAULT3
                  $a.symtab0x80f00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x81340NOTYPE<unknown>DEFAULT2
                  $a.symtab0x81940NOTYPE<unknown>DEFAULT2
                  $a.symtab0x81d00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x84fc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x90280NOTYPE<unknown>DEFAULT2
                  $a.symtab0x9f600NOTYPE<unknown>DEFAULT2
                  $a.symtab0x9fbc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xa0b80NOTYPE<unknown>DEFAULT2
                  $a.symtab0xa2d40NOTYPE<unknown>DEFAULT2
                  $a.symtab0xa3400NOTYPE<unknown>DEFAULT2
                  $a.symtab0xa3b00NOTYPE<unknown>DEFAULT2
                  $a.symtab0xa73c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xaa440NOTYPE<unknown>DEFAULT2
                  $a.symtab0xace40NOTYPE<unknown>DEFAULT2
                  $a.symtab0xadec0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xb5180NOTYPE<unknown>DEFAULT2
                  $a.symtab0xbbd40NOTYPE<unknown>DEFAULT2
                  $a.symtab0xc28c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xc9440NOTYPE<unknown>DEFAULT2
                  $a.symtab0xce3c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xd19c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xd8300NOTYPE<unknown>DEFAULT2
                  $a.symtab0xdd340NOTYPE<unknown>DEFAULT2
                  $a.symtab0xdd840NOTYPE<unknown>DEFAULT2
                  $a.symtab0xde280NOTYPE<unknown>DEFAULT2
                  $a.symtab0xe41c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xe44c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xe7180NOTYPE<unknown>DEFAULT2
                  $a.symtab0xee840NOTYPE<unknown>DEFAULT2
                  $a.symtab0xf4000NOTYPE<unknown>DEFAULT2
                  $a.symtab0xf4180NOTYPE<unknown>DEFAULT2
                  $a.symtab0xf4740NOTYPE<unknown>DEFAULT2
                  $a.symtab0xf5d40NOTYPE<unknown>DEFAULT2
                  $a.symtab0xf7b40NOTYPE<unknown>DEFAULT2
                  $a.symtab0xff7c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0xffd80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x100400NOTYPE<unknown>DEFAULT2
                  $a.symtab0x101100NOTYPE<unknown>DEFAULT2
                  $a.symtab0x101ec0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x102100NOTYPE<unknown>DEFAULT2
                  $a.symtab0x102b00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x103500NOTYPE<unknown>DEFAULT2
                  $a.symtab0x110040NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1102c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x121bc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1232c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x123f00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x124a00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x125680NOTYPE<unknown>DEFAULT2
                  $a.symtab0x126bc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x127800NOTYPE<unknown>DEFAULT2
                  $a.symtab0x148b40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x14ee00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1577c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x157a40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x157cc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x158440NOTYPE<unknown>DEFAULT2
                  $a.symtab0x158680NOTYPE<unknown>DEFAULT2
                  $a.symtab0x158b00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x158d40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x158f80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1591c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x159880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15ac40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15b200NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15bb40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15c440NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15cc40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15d580NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15da80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15e300NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15e900NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15ed80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x15fd40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x160e80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1622c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x162400NOTYPE<unknown>DEFAULT2
                  $a.symtab0x162d80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x163cc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x163e00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x164c00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x164f80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1653c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1657c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x165c00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x166440NOTYPE<unknown>DEFAULT2
                  $a.symtab0x166840NOTYPE<unknown>DEFAULT2
                  $a.symtab0x167100NOTYPE<unknown>DEFAULT2
                  $a.symtab0x167400NOTYPE<unknown>DEFAULT2
                  $a.symtab0x168500NOTYPE<unknown>DEFAULT2
                  $a.symtab0x169200NOTYPE<unknown>DEFAULT2
                  $a.symtab0x169e40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16a940NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16b7c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16b9c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16bd00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16be00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16bf00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16c900NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16cb40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16cdc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16d200NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16d940NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16dd80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16e1c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16e900NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16ed40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16f1c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16f5c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x16fa00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x170100NOTYPE<unknown>DEFAULT2
                  $a.symtab0x170580NOTYPE<unknown>DEFAULT2
                  $a.symtab0x170e00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x171240NOTYPE<unknown>DEFAULT2
                  $a.symtab0x171940NOTYPE<unknown>DEFAULT2
                  $a.symtab0x171e00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x172680NOTYPE<unknown>DEFAULT2
                  $a.symtab0x172b00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x172f40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x173440NOTYPE<unknown>DEFAULT2
                  $a.symtab0x173580NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1741c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x174880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x17e380NOTYPE<unknown>DEFAULT2
                  $a.symtab0x17f780NOTYPE<unknown>DEFAULT2
                  $a.symtab0x183380NOTYPE<unknown>DEFAULT2
                  $a.symtab0x187d80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x188180NOTYPE<unknown>DEFAULT2
                  $a.symtab0x189400NOTYPE<unknown>DEFAULT2
                  $a.symtab0x189580NOTYPE<unknown>DEFAULT2
                  $a.symtab0x189fc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18ab40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18b740NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18c180NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18ca80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18d800NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18e780NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18f640NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18f840NOTYPE<unknown>DEFAULT2
                  $a.symtab0x18fa00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x191780NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1923c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x193880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x199ac0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x199fc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x19dc80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x19e600NOTYPE<unknown>DEFAULT2
                  $a.symtab0x19ea80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x19f980NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a0d40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a12c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a1340NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a1640NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a1bc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a1c40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a1f40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a24c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a2540NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a2840NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a2dc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a2e40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a3100NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a3980NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a4740NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a5340NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a5880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a5e00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1a9cc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1aa480NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1aa740NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1aafc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ab040NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ab100NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ab200NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ab300NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ab700NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1abd80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ac3c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1acdc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ad080NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ad1c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ad300NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ad440NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ad6c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ada40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ade40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1adf80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ae3c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ae7c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1aebc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1af1c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1af880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1af9c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1b1140NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1b2000NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1b5a40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1b8d40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1b8f40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1bd540NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1bdd40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1bf380NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1bf680NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1c0ac0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1c1c80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1c4780NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1c8240NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1c9500NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1c9f00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1ce800NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1cea00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1cf000NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1cff00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d0dc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d1200NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d1700NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d1bc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d1e00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d25c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d3540NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d3cc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d4340NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d6880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d6940NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d6cc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d7240NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d77c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d7880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d8d00NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1d9280NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1da040NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1da340NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dad80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dafc0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1db3c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dbac0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dbf80NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dc440NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dc4c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dc500NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dc7c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dc880NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1dc940NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1deb40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e0040NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e0200NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e0800NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e0ec0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e1a40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e1c40NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e3080NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e8500NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e8580NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e8600NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e8680NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e9240NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1e9680NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1f07c0NOTYPE<unknown>DEFAULT2
                  $a.symtab0x1f0c40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x81280NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290080NOTYPE<unknown>DEFAULT10
                  $d.symtab0x81800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290040NOTYPE<unknown>DEFAULT9
                  $d.symtab0x81c40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x84e80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x8fe80NOTYPE<unknown>DEFAULT2
                  $d.symtab0xa0b00NOTYPE<unknown>DEFAULT2
                  $d.symtab0xa7080NOTYPE<unknown>DEFAULT2
                  $d.symtab0xaa400NOTYPE<unknown>DEFAULT2
                  $d.symtab0xade40NOTYPE<unknown>DEFAULT2
                  $d.symtab0xb5140NOTYPE<unknown>DEFAULT2
                  $d.symtab0xbbd00NOTYPE<unknown>DEFAULT2
                  $d.symtab0xc2880NOTYPE<unknown>DEFAULT2
                  $d.symtab0xc9400NOTYPE<unknown>DEFAULT2
                  $d.symtab0xce340NOTYPE<unknown>DEFAULT2
                  $d.symtab0xd1940NOTYPE<unknown>DEFAULT2
                  $d.symtab0xd82c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0xdd300NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1f9280NOTYPE<unknown>DEFAULT4
                  $d.symtab0x1fc1c0NOTYPE<unknown>DEFAULT4
                  $d.symtab0xe4100NOTYPE<unknown>DEFAULT2
                  $d.symtab0xe4480NOTYPE<unknown>DEFAULT2
                  $d.symtab0xe70c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0xeddc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0xf3fc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290b80NOTYPE<unknown>DEFAULT13
                  $d.symtab0x1fdcc0NOTYPE<unknown>DEFAULT4
                  $d.symtab0x290bc0NOTYPE<unknown>DEFAULT13
                  $d.symtab0x1fdd00NOTYPE<unknown>DEFAULT4
                  $d.symtab0xf4100NOTYPE<unknown>DEFAULT2
                  $d.symtab0xf4700NOTYPE<unknown>DEFAULT2
                  $d.symtab0xf5c80NOTYPE<unknown>DEFAULT2
                  $d.symtab0xf7b00NOTYPE<unknown>DEFAULT2
                  $d.symtab0xff440NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290d00NOTYPE<unknown>DEFAULT13
                  $d.symtab0x290d40NOTYPE<unknown>DEFAULT13
                  $d.symtab0x290d80NOTYPE<unknown>DEFAULT13
                  $d.symtab0x290dc0NOTYPE<unknown>DEFAULT13
                  $d.symtab0xffc80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x100300NOTYPE<unknown>DEFAULT2
                  $d.symtab0x101000NOTYPE<unknown>DEFAULT2
                  $d.symtab0x101dc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1020c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x102a80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x103480NOTYPE<unknown>DEFAULT2
                  $d.symtab0x10ed40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290e00NOTYPE<unknown>DEFAULT13
                  $d.symtab0x110280NOTYPE<unknown>DEFAULT2
                  $d.symtab0x123240NOTYPE<unknown>DEFAULT2
                  $d.symtab0x123e40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x125640NOTYPE<unknown>DEFAULT2
                  $d.symtab0x126ec0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x147840NOTYPE<unknown>DEFAULT2
                  $d.symtab0x14ebc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x207ef0NOTYPE<unknown>DEFAULT4
                  $d.symtab0x207f80NOTYPE<unknown>DEFAULT4
                  $d.symtab0x00NOTYPE<unknown>DEFAULT21
                  $d.symtab0x200NOTYPE<unknown>DEFAULT21
                  $d.symtab0x260NOTYPE<unknown>DEFAULT21
                  $d.symtab0x2c0NOTYPE<unknown>DEFAULT21
                  $d.symtab0x4c0NOTYPE<unknown>DEFAULT21
                  $d.symtab0x530NOTYPE<unknown>DEFAULT21
                  $d.symtab0x162d00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x163bc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x164b00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x164f40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x165380NOTYPE<unknown>DEFAULT2
                  $d.symtab0x165780NOTYPE<unknown>DEFAULT2
                  $d.symtab0x165bc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1663c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x166800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1670c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x168340NOTYPE<unknown>DEFAULT2
                  $d.symtab0x169180NOTYPE<unknown>DEFAULT2
                  $d.symtab0x169d80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16a8c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x207fc0NOTYPE<unknown>DEFAULT4
                  $d.symtab0x16b680NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16b980NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16bcc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16d180NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16d8c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16dd00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16e140NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16e880NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16ecc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16f140NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16f580NOTYPE<unknown>DEFAULT2
                  $d.symtab0x16f980NOTYPE<unknown>DEFAULT2
                  $d.symtab0x170080NOTYPE<unknown>DEFAULT2
                  $d.symtab0x170540NOTYPE<unknown>DEFAULT2
                  $d.symtab0x170d80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1711c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1718c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x171d80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x172600NOTYPE<unknown>DEFAULT2
                  $d.symtab0x172a80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x172ec0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x173400NOTYPE<unknown>DEFAULT2
                  $d.symtab0x174100NOTYPE<unknown>DEFAULT2
                  $d.symtab0x17e140NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290e40NOTYPE<unknown>DEFAULT13
                  $d.symtab0x17f5c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x183180NOTYPE<unknown>DEFAULT2
                  $d.symtab0x187bc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x188100NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1892c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x290fc0NOTYPE<unknown>DEFAULT13
                  $d.symtab0x189e00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x18a980NOTYPE<unknown>DEFAULT2
                  $d.symtab0x18b580NOTYPE<unknown>DEFAULT2
                  $d.symtab0x18bfc0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x291140NOTYPE<unknown>DEFAULT13
                  $d.symtab0x291ac0NOTYPE<unknown>DEFAULT13
                  $d.symtab0x18ca40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x18d740NOTYPE<unknown>DEFAULT2
                  $d.symtab0x18e680NOTYPE<unknown>DEFAULT2
                  $d.symtab0x18f580NOTYPE<unknown>DEFAULT2
                  $d.symtab0x208140NOTYPE<unknown>DEFAULT4
                  $d.symtab0x191680NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1921c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x291c00NOTYPE<unknown>DEFAULT13
                  $d.symtab0x193640NOTYPE<unknown>DEFAULT2
                  $d.symtab0x199800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x199f80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x19da00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x19f8c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a0b80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a0d00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a1600NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a1f00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a2800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a46c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a5200NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a5800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a5d40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1a9800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x291d80NOTYPE<unknown>DEFAULT13
                  $d.symtab0x1aa400NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1aa700NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1aaf00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ab6c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1abd00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ac380NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1acd80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ad640NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ada00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ade00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ae380NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1ae780NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1aeb80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1af140NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1af800NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1b1ec0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1b59c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1b8c40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1bd200NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1bdc40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1bf1c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x291f00NOTYPE<unknown>DEFAULT13
                  $d.symtab0x291ec0NOTYPE<unknown>DEFAULT13
                  $d.symtab0x1c45c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1c80c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1c9480NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1cfe80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d0d40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d2580NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d34c0NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d3b40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d4240NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d6600NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d6c00NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d7700NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1d8c80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1da000NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1dad40NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1dba80NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1de980NOTYPE<unknown>DEFAULT2
                  $d.symtab0x1e8400NOTYPE<unknown>DEFAULT2
                  $d.symtab0x580NOTYPE<unknown>DEFAULT21
                  $d.symtab0x00NOTYPE<unknown>DEFAULT23
                  $d.symtab0x23c0NOTYPE<unknown>DEFAULT21
                  $d.symtab0xe390NOTYPE<unknown>DEFAULT23
                  $d.symtab0x291e40NOTYPE<unknown>DEFAULT13
                  $d.symtab0x208a20NOTYPE<unknown>DEFAULT4
                  C.11.5548.symtab0x2088012OBJECT<unknown>DEFAULT4
                  C.23.4863.symtab0x1fc1c68OBJECT<unknown>DEFAULT4
                  C.34.5163.symtab0x1f9288OBJECT<unknown>DEFAULT4
                  C.43.5535.symtab0x207f83OBJECT<unknown>DEFAULT4
                  C.44.5536.symtab0x207ef9OBJECT<unknown>DEFAULT4
                  C.5.5083.symtab0x207fc24OBJECT<unknown>DEFAULT4
                  C.7.5370.symtab0x2088c12OBJECT<unknown>DEFAULT4
                  C.7.6109.symtab0x20bc812OBJECT<unknown>DEFAULT4
                  C.7.6182.symtab0x20ba412OBJECT<unknown>DEFAULT4
                  C.8.6110.symtab0x20bbc12OBJECT<unknown>DEFAULT4
                  C.9.6119.symtab0x20bb012OBJECT<unknown>DEFAULT4
                  LOCAL_ADDR.symtab0x2be104OBJECT<unknown>DEFAULT14
                  Laligned.symtab0x1cec80NOTYPE<unknown>DEFAULT2
                  Llastword.symtab0x1cee40NOTYPE<unknown>DEFAULT2
                  _Exit.symtab0x1ab70104FUNC<unknown>DEFAULT2
                  _GLOBAL_OFFSET_TABLE_.symtab0x290100OBJECT<unknown>HIDDEN12
                  _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                  _Unwind_Complete.symtab0x1dc4c4FUNC<unknown>HIDDEN2
                  _Unwind_DeleteException.symtab0x1dc5044FUNC<unknown>HIDDEN2
                  _Unwind_ForcedUnwind.symtab0x1e90036FUNC<unknown>HIDDEN2
                  _Unwind_GetCFA.symtab0x1dc448FUNC<unknown>HIDDEN2
                  _Unwind_GetDataRelBase.symtab0x1dc8812FUNC<unknown>HIDDEN2
                  _Unwind_GetLanguageSpecificData.symtab0x1e92468FUNC<unknown>HIDDEN2
                  _Unwind_GetRegionStart.symtab0x1f0c452FUNC<unknown>HIDDEN2
                  _Unwind_GetTextRelBase.symtab0x1dc7c12FUNC<unknown>HIDDEN2
                  _Unwind_RaiseException.symtab0x1e89436FUNC<unknown>HIDDEN2
                  _Unwind_Resume.symtab0x1e8b836FUNC<unknown>HIDDEN2
                  _Unwind_Resume_or_Rethrow.symtab0x1e8dc36FUNC<unknown>HIDDEN2
                  _Unwind_VRS_Get.symtab0x1dbac76FUNC<unknown>HIDDEN2
                  _Unwind_VRS_Pop.symtab0x1e1c4324FUNC<unknown>HIDDEN2
                  _Unwind_VRS_Set.symtab0x1dbf876FUNC<unknown>HIDDEN2
                  _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                  __C_ctype_b.symtab0x291e44OBJECT<unknown>DEFAULT13
                  __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                  __C_ctype_b_data.symtab0x208a2768OBJECT<unknown>DEFAULT4
                  __EH_FRAME_BEGIN__.symtab0x290000OBJECT<unknown>DEFAULT7
                  __FRAME_END__.symtab0x290000OBJECT<unknown>DEFAULT7
                  __GI___C_ctype_b.symtab0x291e44OBJECT<unknown>HIDDEN13
                  __GI___close.symtab0x1a0f0100FUNC<unknown>HIDDEN2
                  __GI___close_nocancel.symtab0x1a0d424FUNC<unknown>HIDDEN2
                  __GI___ctype_b.symtab0x291e84OBJECT<unknown>HIDDEN13
                  __GI___errno_location.symtab0x16b7c32FUNC<unknown>HIDDEN2
                  __GI___fcntl_nocancel.symtab0x16240152FUNC<unknown>HIDDEN2
                  __GI___fgetc_unlocked.symtab0x1c824300FUNC<unknown>HIDDEN2
                  __GI___libc_close.symtab0x1a0f0100FUNC<unknown>HIDDEN2
                  __GI___libc_fcntl.symtab0x162d8244FUNC<unknown>HIDDEN2
                  __GI___libc_open.symtab0x1a180100FUNC<unknown>HIDDEN2
                  __GI___libc_read.symtab0x1a2a0100FUNC<unknown>HIDDEN2
                  __GI___libc_write.symtab0x1a210100FUNC<unknown>HIDDEN2
                  __GI___open.symtab0x1a180100FUNC<unknown>HIDDEN2
                  __GI___open_nocancel.symtab0x1a16424FUNC<unknown>HIDDEN2
                  __GI___read.symtab0x1a2a0100FUNC<unknown>HIDDEN2
                  __GI___read_nocancel.symtab0x1a28424FUNC<unknown>HIDDEN2
                  __GI___sigaddset.symtab0x1744036FUNC<unknown>HIDDEN2
                  __GI___sigdelset.symtab0x1746436FUNC<unknown>HIDDEN2
                  __GI___sigismember.symtab0x1741c36FUNC<unknown>HIDDEN2
                  __GI___uClibc_fini.symtab0x1a4b8124FUNC<unknown>HIDDEN2
                  __GI___uClibc_init.symtab0x1a58888FUNC<unknown>HIDDEN2
                  __GI___write.symtab0x1a210100FUNC<unknown>HIDDEN2
                  __GI___write_nocancel.symtab0x1a1f424FUNC<unknown>HIDDEN2
                  __GI__exit.symtab0x1ab70104FUNC<unknown>HIDDEN2
                  __GI_abort.symtab0x18818296FUNC<unknown>HIDDEN2
                  __GI_accept.symtab0x16d20116FUNC<unknown>HIDDEN2
                  __GI_atoi.symtab0x18f6432FUNC<unknown>HIDDEN2
                  __GI_bind.symtab0x16d9468FUNC<unknown>HIDDEN2
                  __GI_brk.symtab0x1d72488FUNC<unknown>HIDDEN2
                  __GI_close.symtab0x1a0f0100FUNC<unknown>HIDDEN2
                  __GI_closedir.symtab0x16740272FUNC<unknown>HIDDEN2
                  __GI_config_close.symtab0x1b52852FUNC<unknown>HIDDEN2
                  __GI_config_open.symtab0x1b55c72FUNC<unknown>HIDDEN2
                  __GI_config_read.symtab0x1b200808FUNC<unknown>HIDDEN2
                  __GI_connect.symtab0x16e1c116FUNC<unknown>HIDDEN2
                  __GI_exit.symtab0x19178196FUNC<unknown>HIDDEN2
                  __GI_fclose.symtab0x1b5a4816FUNC<unknown>HIDDEN2
                  __GI_fcntl.symtab0x162d8244FUNC<unknown>HIDDEN2
                  __GI_fflush_unlocked.symtab0x1c478940FUNC<unknown>HIDDEN2
                  __GI_fgetc.symtab0x1bf68324FUNC<unknown>HIDDEN2
                  __GI_fgetc_unlocked.symtab0x1c824300FUNC<unknown>HIDDEN2
                  __GI_fgets.symtab0x1c0ac284FUNC<unknown>HIDDEN2
                  __GI_fgets_unlocked.symtab0x1c950160FUNC<unknown>HIDDEN2
                  __GI_fopen.symtab0x1b8d432FUNC<unknown>HIDDEN2
                  __GI_fork.symtab0x199fc972FUNC<unknown>HIDDEN2
                  __GI_fstat.symtab0x1abd8100FUNC<unknown>HIDDEN2
                  __GI_getc_unlocked.symtab0x1c824300FUNC<unknown>HIDDEN2
                  __GI_getdtablesize.symtab0x1acdc44FUNC<unknown>HIDDEN2
                  __GI_getegid.symtab0x1ad0820FUNC<unknown>HIDDEN2
                  __GI_geteuid.symtab0x1ad1c20FUNC<unknown>HIDDEN2
                  __GI_getgid.symtab0x1ad3020FUNC<unknown>HIDDEN2
                  __GI_getpagesize.symtab0x1ad4440FUNC<unknown>HIDDEN2
                  __GI_getpid.symtab0x19e6072FUNC<unknown>HIDDEN2
                  __GI_getrlimit.symtab0x1ad6c56FUNC<unknown>HIDDEN2
                  __GI_getsockname.symtab0x16e9068FUNC<unknown>HIDDEN2
                  __GI_gettimeofday.symtab0x1ada464FUNC<unknown>HIDDEN2
                  __GI_getuid.symtab0x1ade420FUNC<unknown>HIDDEN2
                  __GI_inet_addr.symtab0x16cb440FUNC<unknown>HIDDEN2
                  __GI_inet_aton.symtab0x1d25c248FUNC<unknown>HIDDEN2
                  __GI_initstate_r.symtab0x18d80248FUNC<unknown>HIDDEN2
                  __GI_ioctl.symtab0x163e0224FUNC<unknown>HIDDEN2
                  __GI_isatty.symtab0x1d1bc36FUNC<unknown>HIDDEN2
                  __GI_kill.symtab0x164c056FUNC<unknown>HIDDEN2
                  __GI_listen.symtab0x16f1c64FUNC<unknown>HIDDEN2
                  __GI_lseek64.symtab0x1db3c112FUNC<unknown>HIDDEN2
                  __GI_memcpy.symtab0x16bd04FUNC<unknown>HIDDEN2
                  __GI_memmove.symtab0x16be04FUNC<unknown>HIDDEN2
                  __GI_mempcpy.symtab0x1dad836FUNC<unknown>HIDDEN2
                  __GI_memset.symtab0x16bf0156FUNC<unknown>HIDDEN2
                  __GI_mmap.symtab0x1a9cc124FUNC<unknown>HIDDEN2
                  __GI_mremap.symtab0x1adf868FUNC<unknown>HIDDEN2
                  __GI_munmap.symtab0x1ae3c64FUNC<unknown>HIDDEN2
                  __GI_nanosleep.symtab0x1aebc96FUNC<unknown>HIDDEN2
                  __GI_open.symtab0x1a180100FUNC<unknown>HIDDEN2
                  __GI_opendir.symtab0x16920196FUNC<unknown>HIDDEN2
                  __GI_raise.symtab0x19ea8240FUNC<unknown>HIDDEN2
                  __GI_random.symtab0x18958164FUNC<unknown>HIDDEN2
                  __GI_random_r.symtab0x18c18144FUNC<unknown>HIDDEN2
                  __GI_read.symtab0x1a2a0100FUNC<unknown>HIDDEN2
                  __GI_readdir.symtab0x16a94232FUNC<unknown>HIDDEN2
                  __GI_readdir64.symtab0x1b114236FUNC<unknown>HIDDEN2
                  __GI_readlink.symtab0x1653c64FUNC<unknown>HIDDEN2
                  __GI_recv.symtab0x16fa0112FUNC<unknown>HIDDEN2
                  __GI_recvfrom.symtab0x17058136FUNC<unknown>HIDDEN2
                  __GI_sbrk.symtab0x1af1c108FUNC<unknown>HIDDEN2
                  __GI_select.symtab0x165c0132FUNC<unknown>HIDDEN2
                  __GI_send.symtab0x17124112FUNC<unknown>HIDDEN2
                  __GI_sendto.symtab0x171e0136FUNC<unknown>HIDDEN2
                  __GI_setsid.symtab0x1664464FUNC<unknown>HIDDEN2
                  __GI_setsockopt.symtab0x1726872FUNC<unknown>HIDDEN2
                  __GI_setstate_r.symtab0x18e78236FUNC<unknown>HIDDEN2
                  __GI_sigaction.symtab0x1aa74136FUNC<unknown>HIDDEN2
                  __GI_sigaddset.symtab0x172f480FUNC<unknown>HIDDEN2
                  __GI_sigemptyset.symtab0x1734420FUNC<unknown>HIDDEN2
                  __GI_signal.symtab0x17358196FUNC<unknown>HIDDEN2
                  __GI_sigprocmask.symtab0x16684140FUNC<unknown>HIDDEN2
                  __GI_sleep.symtab0x19f98300FUNC<unknown>HIDDEN2
                  __GI_socket.symtab0x172b068FUNC<unknown>HIDDEN2
                  __GI_srandom_r.symtab0x18ca8216FUNC<unknown>HIDDEN2
                  __GI_strchr.symtab0x1cf00240FUNC<unknown>HIDDEN2
                  __GI_strchrnul.symtab0x1cff0236FUNC<unknown>HIDDEN2
                  __GI_strcmp.symtab0x1ce8028FUNC<unknown>HIDDEN2
                  __GI_strcoll.symtab0x1ce8028FUNC<unknown>HIDDEN2
                  __GI_strcpy.symtab0x16c9036FUNC<unknown>HIDDEN2
                  __GI_strcspn.symtab0x1d0dc68FUNC<unknown>HIDDEN2
                  __GI_strlen.symtab0x1cea096FUNC<unknown>HIDDEN2
                  __GI_strrchr.symtab0x1d12080FUNC<unknown>HIDDEN2
                  __GI_strspn.symtab0x1d17076FUNC<unknown>HIDDEN2
                  __GI_strtol.symtab0x18f8428FUNC<unknown>HIDDEN2
                  __GI_sysconf.symtab0x193881572FUNC<unknown>HIDDEN2
                  __GI_tcgetattr.symtab0x1d1e0124FUNC<unknown>HIDDEN2
                  __GI_time.symtab0x1671048FUNC<unknown>HIDDEN2
                  __GI_times.symtab0x1af8820FUNC<unknown>HIDDEN2
                  __GI_write.symtab0x1a210100FUNC<unknown>HIDDEN2
                  __JCR_END__.symtab0x2900c0OBJECT<unknown>DEFAULT11
                  __JCR_LIST__.symtab0x2900c0OBJECT<unknown>DEFAULT11
                  ___Unwind_ForcedUnwind.symtab0x1e90036FUNC<unknown>HIDDEN2
                  ___Unwind_RaiseException.symtab0x1e89436FUNC<unknown>HIDDEN2
                  ___Unwind_Resume.symtab0x1e8b836FUNC<unknown>HIDDEN2
                  ___Unwind_Resume_or_Rethrow.symtab0x1e8dc36FUNC<unknown>HIDDEN2
                  __aeabi_idiv.symtab0x160e80FUNC<unknown>HIDDEN2
                  __aeabi_idivmod.symtab0x1621424FUNC<unknown>HIDDEN2
                  __aeabi_read_tp.symtab0x1ab208FUNC<unknown>DEFAULT2
                  __aeabi_uidiv.symtab0x15fd40FUNC<unknown>HIDDEN2
                  __aeabi_uidivmod.symtab0x160d024FUNC<unknown>HIDDEN2
                  __aeabi_unwind_cpp_pr0.symtab0x1e8608FUNC<unknown>HIDDEN2
                  __aeabi_unwind_cpp_pr1.symtab0x1e8588FUNC<unknown>HIDDEN2
                  __aeabi_unwind_cpp_pr2.symtab0x1e8508FUNC<unknown>HIDDEN2
                  __app_fini.symtab0x298a44OBJECT<unknown>HIDDEN14
                  __atexit_lock.symtab0x291c024OBJECT<unknown>DEFAULT13
                  __bss_end__.symtab0x2c4f80NOTYPE<unknown>DEFAULTSHN_ABS
                  __bss_start.symtab0x292d40NOTYPE<unknown>DEFAULTSHN_ABS
                  __bss_start__.symtab0x292d40NOTYPE<unknown>DEFAULTSHN_ABS
                  __check_one_fd.symtab0x1a53484FUNC<unknown>DEFAULT2
                  __close.symtab0x1a0f0100FUNC<unknown>DEFAULT2
                  __close_nocancel.symtab0x1a0d424FUNC<unknown>DEFAULT2
                  __ctype_b.symtab0x291e84OBJECT<unknown>DEFAULT13
                  __curbrk.symtab0x2be084OBJECT<unknown>HIDDEN14
                  __cxa_begin_cleanup.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  __cxa_call_unexpected.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  __cxa_type_match.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  __data_start.symtab0x290b80NOTYPE<unknown>DEFAULT13
                  __default_rt_sa_restorer.symtab0x1ab140FUNC<unknown>DEFAULT2
                  __default_sa_restorer.symtab0x1ab080FUNC<unknown>DEFAULT2
                  __deregister_frame_info.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  __div0.symtab0x1622c20FUNC<unknown>HIDDEN2
                  __divsi3.symtab0x160e8300FUNC<unknown>HIDDEN2
                  __do_global_dtors_aux.symtab0x80f00FUNC<unknown>DEFAULT2
                  __do_global_dtors_aux_fini_array_entry.symtab0x290080OBJECT<unknown>DEFAULT10
                  __end__.symtab0x2c4f80NOTYPE<unknown>DEFAULTSHN_ABS
                  __environ.symtab0x2989c4OBJECT<unknown>DEFAULT14
                  __errno_location.symtab0x16b7c32FUNC<unknown>DEFAULT2
                  __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                  __exidx_end.symtab0x20d040NOTYPE<unknown>DEFAULTSHN_ABS
                  __exidx_start.symtab0x20bec0NOTYPE<unknown>DEFAULTSHN_ABS
                  __exit_cleanup.symtab0x2934c4OBJECT<unknown>HIDDEN14
                  __fcntl_nocancel.symtab0x16240152FUNC<unknown>DEFAULT2
                  __fgetc_unlocked.symtab0x1c824300FUNC<unknown>DEFAULT2
                  __fini_array_end.symtab0x2900c0NOTYPE<unknown>HIDDEN10
                  __fini_array_start.symtab0x290080NOTYPE<unknown>HIDDEN10
                  __fork.symtab0x199fc972FUNC<unknown>DEFAULT2
                  __fork_generation_pointer.symtab0x2c4c44OBJECT<unknown>HIDDEN14
                  __fork_handlers.symtab0x2c4c84OBJECT<unknown>HIDDEN14
                  __fork_lock.symtab0x293504OBJECT<unknown>HIDDEN14
                  __frame_dummy_init_array_entry.symtab0x290040OBJECT<unknown>DEFAULT9
                  __getdents.symtab0x1ac3c160FUNC<unknown>HIDDEN2
                  __getdents64.symtab0x1d788328FUNC<unknown>HIDDEN2
                  __getpagesize.symtab0x1ad4440FUNC<unknown>DEFAULT2
                  __getpid.symtab0x19e6072FUNC<unknown>DEFAULT2
                  __gnu_Unwind_Find_exidx.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                  __gnu_Unwind_ForcedUnwind.symtab0x1e00428FUNC<unknown>HIDDEN2
                  __gnu_Unwind_RaiseException.symtab0x1e0ec184FUNC<unknown>HIDDEN2
                  __gnu_Unwind_Restore_VFP.symtab0x1e8840FUNC<unknown>HIDDEN2
                  __gnu_Unwind_Resume.symtab0x1e080108FUNC<unknown>HIDDEN2
                  __gnu_Unwind_Resume_or_Rethrow.symtab0x1e1a432FUNC<unknown>HIDDEN2
                  __gnu_Unwind_Save_VFP.symtab0x1e88c0FUNC<unknown>HIDDEN2
                  __gnu_unwind_execute.symtab0x1e9681812FUNC<unknown>HIDDEN2