Edit tour

Linux Analysis Report
13zzcbrXBm.elf

Overview

General Information

Sample name:	13zzcbrXBm.elf renamed because original name is a hash value
Original sample name:	77f19a8ce8d86f74747de99fdf4fe7cc.elf
Analysis ID:	1432418
MD5:	77f19a8ce8d86f74747de99fdf4fe7cc
SHA1:	fe29f892cc076c518f5e761b9d3cddb0ae0dee51
SHA256:	92baabd1045e6a8ae73952451668ed9c8d4f87dbbaf1bfdb76cf90a9b7a915de
Tags:	32armelfmirai
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Detected TCP or UDP traffic on non-standard ports

Reads system information from the proc file system

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432418
Start date and time:	2024-04-27 01:30:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	13zzcbrXBm.elf renamed because original name is a hash value
Original Sample Name:	77f19a8ce8d86f74747de99fdf4fe7cc.elf
Detection:	MAL
Classification:	mal48.linELF@0/0@1/0

Warnings

VT rate limit hit for: 13zzcbrXBm.elf

Runtime Messages

Command:	/tmp/13zzcbrXBm.elf
PID:	5507
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	guess what. you're retarded
Standard Error:

Process Tree

system is lnxubuntu20

13zzcbrXBm.elf (PID: 5507, Parent: 5432, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/13zzcbrXBm.elf

13zzcbrXBm.elf New Fork (PID: 5509, Parent: 5507)

13zzcbrXBm.elf New Fork (PID: 5511, Parent: 5509)

13zzcbrXBm.elf New Fork (PID: 5512, Parent: 5509)

13zzcbrXBm.elf New Fork (PID: 5514, Parent: 5509)

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 13zzcbrXBm.elf

ReversingLabs: Detection: 47%

Source: global traffic

TCP traffic: 192.168.2.14:48816 -> 94.156.248.18:5667

Source: /tmp/13zzcbrXBm.elf (PID: 5507)

Socket: 127.0.0.1::46373

Jump to behavior

Source: global traffic

DNS traffic detected: DNS query: whitepeopleonly.dyn

Source: 13zzcbrXBm.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: classification engine

Classification label: mal48.linELF@0/0@1/0

Source: /tmp/13zzcbrXBm.elf (PID: 5509)

Reads from proc file: /proc/stat

Jump to behavior

Source: /tmp/13zzcbrXBm.elf (PID: 5507)

Queries kernel information via 'uname':

Jump to behavior

Source: 13zzcbrXBm.elf, 5507.1.00007ffde0fde000.00007ffde0fff000.rw-.sdmp, 13zzcbrXBm.elf, 5511.1.00007ffde0fde000.00007ffde0fff000.rw-.sdmp	Binary or memory string: 'x86_64/usr/bin/qemu-arm/tmp/13zzcbrXBm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/13zzcbrXBm.elf
Source: 13zzcbrXBm.elf, 5507.1.0000561b760c6000.0000561b7623d000.rw-.sdmp, 13zzcbrXBm.elf, 5511.1.0000561b760c6000.0000561b7623d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 13zzcbrXBm.elf, 5507.1.00007ffde0fde000.00007ffde0fff000.rw-.sdmp, 13zzcbrXBm.elf, 5511.1.00007ffde0fde000.00007ffde0fff000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: 13zzcbrXBm.elf, 5507.1.0000561b760c6000.0000561b7623d000.rw-.sdmp, 13zzcbrXBm.elf, 5511.1.0000561b760c6000.0000561b7623d000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
13zzcbrXBm.elf	47%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
whitepeopleonly.dyn	85.239.33.65	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.248.18	unknown	Bulgaria		34224	NETERRA-ASBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.156.248.18	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETERRA-ASBG	vtuYyqk0Xt.elf	Get hash	malicious	Gafgyt	Browse	94.156.248.19
	4GtFbR4O3j.elf	Get hash	malicious	Gafgyt	Browse	94.156.248.19
	93dYAEq6GA.elf	Get hash	malicious	Gafgyt	Browse	94.156.248.18
	ZcOjro0Chh.elf	Get hash	malicious	Mirai	Browse	212.73.131.205
	https://www.huiyuan-sh.com/	Get hash	malicious	Unknown	Browse	87.121.112.42
	https://www.cmmnamijedtovnuf.com/	Get hash	malicious	Unknown	Browse	87.121.112.42
	https://www.daopzzvefkdjrnbe.com/	Get hash	malicious	Unknown	Browse	87.121.112.42
	https://huiyuan-sh.com/	Get hash	malicious	Unknown	Browse	87.121.112.42
	J2NWKU2oJi.exe	Get hash	malicious	Amadey, RHADAMANTHYS	Browse	94.156.10.37
	https://zjxcjld.com/	Get hash	malicious	Unknown	Browse	87.121.112.41

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.921527022727683
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	13zzcbrXBm.elf
File size:	209'956 bytes
MD5:	77f19a8ce8d86f74747de99fdf4fe7cc
SHA1:	fe29f892cc076c518f5e761b9d3cddb0ae0dee51
SHA256:	92baabd1045e6a8ae73952451668ed9c8d4f87dbbaf1bfdb76cf90a9b7a915de
SHA512:	2dd8872e973968fb47bb66f991fc92bd01c0f701b25fb0754b4a7f1e501394898ebd32cc83f5703f9dd1fc7e4fdd57f372ff1ea5eaa5966851f4644e131ac04f
SSDEEP:	6144:PQpC8zf4J7a42WtvTUXGyJpPK0G+EkM/Rik/:PO4J7a42WtvToP3KmEZ/oS
TLSH:	58242A46AA408B13C0D72BBAFB9F435533339B64D7E763059528AFB43F8679A4F62101
File Content Preview:	.ELF..............(.........4...l.......4. ...(........p.....o...o..`...`...........................<...<...............<...<...<...t...................@...@...@...................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	163692
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1c150	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x24240	0x1c240	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x24250	0x1c250	0x2d74	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x26fc4	0x1efc4	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x26fdc	0x1efdc	0x160	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2f13c	0x1f13c	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2f140	0x1f140	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2f144	0x1f144	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2f144	0x1f144	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2f148	0x1f148	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2f14c	0x1f14c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2f150	0x1f150	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2f210	0x1f210	0x2a0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2f4b0	0x1f4b0	0xe194	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1f4b0	0x12a6	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x20758	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x208d8	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x20b16	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x235bd	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x23f57	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x250e4	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x25420	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x25edc	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x27706	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x27e36	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x27e4c	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2841c	0x71e0	0x10	0x0		29	1085	4
.strtab	STRTAB	0x0	0x2f5fc	0x3e28	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1efdc	0x26fdc	0x26fdc	0x160	0x160	4.6982	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1f13c	0x1f13c	5.9954	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1f13c	0x2f13c	0x2f13c	0x374	0xe508	4.3924	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1f140	0x2f140	0x2f140	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x24240	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x24250	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x26fc4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x26fdc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2f13c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2f140	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2f144	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2f144	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2f148	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2f14c	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2f150	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2f210	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x2f4b0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x24240	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x2424c	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8d9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8f6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x90e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x92cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x97f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x987c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x99e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9aa8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9bec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9c4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9cec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9ea8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa34c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa3b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa55c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa5c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa608	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa9c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xae9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb21c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb78c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb95c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbaf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc00c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc0a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc220	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc2a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xccb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd2b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe468	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xec0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf1c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf89c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfcbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x101a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1049c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11488	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x114a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x115c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1160c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1162c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x116e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x119f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11bf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11eec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x128bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x134dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13700	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13cb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14508	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1455c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1456c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x151c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1532c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15494	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15870	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ac8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15b80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15bc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15f50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15fb0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1601c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x160f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16238	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16fac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16ff4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17028	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x170a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1712c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1714c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x171e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17318	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17380	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1740c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17434	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17504	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17588	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x175c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17718	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17758	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x177d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17818	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17878	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x178fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1793c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1797c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x179ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17aec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17bf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ecc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18064	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18140	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x184e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1862c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18df8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1908c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x190e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19650	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19760	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x198e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19900	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19984	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ef4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19f7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ff0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a07c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a240	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a284	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a340	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a57c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1af98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b978	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1baa0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1be08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bfd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c100	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c39c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf8c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cfd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d034	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d204	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d334	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d38c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d394	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d4ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d4e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d53c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d570	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d6d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d74c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d7b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dc60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dd84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1de1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e000	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e1fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e614	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e628	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e764	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e78c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e824	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e8e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eb88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1efa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f060	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f390	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f48c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f8ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fa2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fb7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fba8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fd04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x204f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x205d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20d54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20dc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x20e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2114c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x216bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21800	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2191c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21bcc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x21f78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x220a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22144	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22234	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x223c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x224b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x225a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x225e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22634	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22680	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x227b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22a10	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22dbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22e14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x22f5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x230f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23114	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x232f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x234b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2350c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x235d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23604	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x236a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x236e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x23b70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2400c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x2414c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x241a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f148	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f144	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8308	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8d58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f210	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f214	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f218	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f21c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f23c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x8ef0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8f5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x90c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9160	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9be0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9c20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9cc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9dd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa9bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xae58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb018	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb1f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb5f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb780	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f248	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xbac4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbaf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc098	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc1d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f26c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f28c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0xcca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xec08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf880	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x254a4	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x254c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xff18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x258ac	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x101a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25cac	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x10b38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25ce2	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x115ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11608	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11628	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11678	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x116d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x119e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11be4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11e8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11ee8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12020	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x120c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x121ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x128b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x132ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x134cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x136e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f298	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x25cf8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x2f29c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x13cb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14550	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14690	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1489c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15058	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f2b0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1548c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15824	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x15dc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x1709c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17120	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x171dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17314	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17378	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1742c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1747c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17540	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17584	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x175c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17698	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x177d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17814	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17870	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x178f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17938	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x179e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17b28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bb4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17bf4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ec0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25e94	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x18050	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x180f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1813c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18198	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x182cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18344	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1849c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f2bc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f2b8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x18dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25ef8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19088	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x190d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19620	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f3a0	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x25f00	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19720	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19d24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25f90	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19e10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19eec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19f74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19fe8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a074	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a168	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a1b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a238	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a27c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a2ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a338	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a3c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a408	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a44c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a4a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a570	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1af74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f3a4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1b0bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b91c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f3bc	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1bb40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bbf8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcb8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f3d4	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2f46c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1be04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bed4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bfc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c0b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26afc	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1c2c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c37c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f480	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1c4c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cae0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cf64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cfc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d1ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d2e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d330	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d3c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d4e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d6cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d7a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d9e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db50	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dc58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dd78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1de0c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1dfe4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e02c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f498	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e13c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e19c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e1f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e59c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f49c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1e610	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e7dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e860	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e8c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1eb74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ef24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f05c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f380	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f488	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f8b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1fb04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x204d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26f00	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x205cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20d28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20db8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2112c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26f64	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x216a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x26f90	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x21bb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21f60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2209c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2222c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2230c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x223bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x224ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22770	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22a00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22da4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22e08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22f54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23000	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x230e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x234b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x235d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x236a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x23750	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2f2ac	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x2b8	0	NOTYPE	<unknown>	DEFAULT	22
$d	.symtab	0x118f	0	NOTYPE	<unknown>	DEFAULT	24
$d	.symtab	0x0	0	TLS	<unknown>	DEFAULT	8
$d	.symtab	0x2f4a8	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x26bd8	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x26b68	12	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x25e94	24	OBJECT	<unknown>	DEFAULT	4
C.7.4238	.symtab	0x25cac	54	OBJECT	<unknown>	DEFAULT	4
C.7.4258	.symtab	0x254c8	44	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x26b74	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x25eac	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x25ed0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x26ed8	12	OBJECT	<unknown>	DEFAULT	4
C.7.6365	.symtab	0x25f84	12	OBJECT	<unknown>	DEFAULT	4
C.8.4259	.symtab	0x254a4	36	OBJECT	<unknown>	DEFAULT	4
C.8.4297	.symtab	0x25ce2	21	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x25ec4	12	OBJECT	<unknown>	DEFAULT	4
C.9.4214	.symtab	0x258ac	1024	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x25eb8	12	OBJECT	<unknown>	DEFAULT	4
KillerCheckFd	.symtab	0xb020	508	FUNC	<unknown>	DEFAULT	2
KillerGetUid	.symtab	0xae9c	388	FUNC	<unknown>	DEFAULT	2
LOCAL_ADDR	.symtab	0x351e4	4	OBJECT	<unknown>	DEFAULT	15
Laligned	.symtab	0x19928	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x19944	0	NOTYPE	<unknown>	DEFAULT	2
Nodes	.symtab	0x2f4f0	4	OBJECT	<unknown>	DEFAULT	15
_Exit	.symtab	0x17318	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2f150	0	OBJECT	<unknown>	HIDDEN	13
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x15b7c	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x15b80	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x16830	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x15b74	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x15bb8	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x16854	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x16ff4	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x15bac	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x167c4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x167e8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1680c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x15adc	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x160f4	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x15b28	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2f4a8	4	OBJECT	<unknown>	DEFAULT	14
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x26bd8	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2f13c	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2f13c	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2f4a8	4	OBJECT	<unknown>	HIDDEN	14
__GI___close	.symtab	0x1d350	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x1d334	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x2f4ac	4	OBJECT	<unknown>	HIDDEN	14
__GI___errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___fcntl_nocancel	.symtab	0x1714c	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x21f78	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x19c10	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x1d350	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x171e4	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1d3e0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x1d500	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x1d470	100	FUNC	<unknown>	HIDDEN	2
__GI___longjmp	.symtab	0x1e614	20	FUNC	<unknown>	HIDDEN	2
__GI___nptl_create_event	.symtab	0x1532c	4	FUNC	<unknown>	HIDDEN	2
__GI___nptl_death_event	.symtab	0x15330	4	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x1d3e0	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x1d3c4	24	FUNC	<unknown>	HIDDEN	2
__GI___pthread_cleanup_upto	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__GI___pthread_keys	.symtab	0x30528	8192	OBJECT	<unknown>	HIDDEN	15
__GI___pthread_unwind	.symtab	0x14508	84	FUNC	<unknown>	HIDDEN	2
__GI___pthread_unwind_next	.symtab	0x1455c	16	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x1d500	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x1d4e4	24	FUNC	<unknown>	HIDDEN	2
__GI___register_atfork	.symtab	0x1d034	392	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1a5a0	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1a5c4	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1a57c	36	FUNC	<unknown>	HIDDEN	2
__GI___stack_user	.symtab	0x30508	8	OBJECT	<unknown>	HIDDEN	15
__GI___uClibc_fini	.symtab	0x1e0d4	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x1e1a4	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x1d470	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x1d454	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x19c28	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x17318	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1b978	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x19e80	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1c0c4	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x19ef4	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x22dbc	88	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x173c0	56	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1d350	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x17c28	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1eeb0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1eee4	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1eb88	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x19f7c	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1c2d8	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1f060	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x171e4	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x21bcc	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x216bc	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x21f78	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x21800	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x220a4	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1f390	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1cbc0	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x181a4	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x19728	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x230f0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x232f4	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1e634	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x19760	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x21f78	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1e738	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1e764	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x173f8	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1e778	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1740c	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1d1bc	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x17448	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x19ff0	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x17480	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1e78c	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x19e14	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x22680	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1bee0	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x175c8	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x19d74	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x176a8	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x1a07c	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x1e7a0	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x236e4	112	FUNC	<unknown>	HIDDEN	2
__GI_mbrtowc	.symtab	0x22f5c	172	FUNC	<unknown>	HIDDEN	2
__GI_mbsnrtowcs	.symtab	0x23008	232	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x22144	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x19820	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x19830	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x19960	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x22234	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x19840	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x17028	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1e7e0	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x17798	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x17818	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1d3e0	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x17e08	196	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1d204	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1bab8	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1bd78	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x22314	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1d500	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x17f7c	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1ea9c	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x178bc	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1a100	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1a1b8	136	FUNC	<unknown>	HIDDEN	2
__GI_remove	.symtab	0x18140	100	FUNC	<unknown>	HIDDEN	2
__GI_rmdir	.symtab	0x1e824	64	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1e864	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x17a68	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1a284	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1a340	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x17aec	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1a3c8	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1bfd8	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x170a4	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1a454	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1a4a4	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1a4b8	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x17b2c	140	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x181d4	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1a410	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1be08	216	FUNC	<unknown>	HIDDEN	2
__GI_sscanf	.symtab	0x19650	48	FUNC	<unknown>	HIDDEN	2
__GI_strcat	.symtab	0x19984	40	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x223c4	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x224b4	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x198e0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x198e0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x199ac	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x225a0	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x19900	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x199d0	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x19d34	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x225e4	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x22634	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x19a9c	252	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x19b98	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1c0e4	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1c4e8	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x19d98	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x17bf8	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x1e8d0	20	FUNC	<unknown>	HIDDEN	2
__GI_ungetc	.symtab	0x23114	480	FUNC	<unknown>	HIDDEN	2
__GI_unlink	.symtab	0x1e8e4	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x184e8	324	FUNC	<unknown>	HIDDEN	2
__GI_vfscanf	.symtab	0x205d0	1896	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x18204	208	FUNC	<unknown>	HIDDEN	2
__GI_vsscanf	.symtab	0x19680	168	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1ef2c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1efa4	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1ef80	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1d470	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2f14c	0	OBJECT	<unknown>	DEFAULT	12
__JCR_LIST__	.symtab	0x2f14c	0	OBJECT	<unknown>	DEFAULT	12
___Unwind_ForcedUnwind	.symtab	0x16830	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x167c4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x167e8	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1680c	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x23760	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x240bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x240bc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x240a0	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2f	.symtab	0x241a0	160	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x2414c	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x23760	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x240d4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x2411c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x24134	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x24104	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x240ec	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x23e00	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x23b70	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x23754	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x2375c	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x23abc	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x23a94	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x15984	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x15ab0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x23b10	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x115b0	8	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x23a70	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x15870	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x1596c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x23afc	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x16790	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x16788	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x16780	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x351c8	4	OBJECT	<unknown>	HIDDEN	15
__atexit_lock	.symtab	0x2f480	24	OBJECT	<unknown>	DEFAULT	14
__bss_end__	.symtab	0x3d644	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2f4b0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2f4b0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x1e150	84	FUNC	<unknown>	DEFAULT	2
__clone	.symtab	0x1cb5c	100	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x1d350	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x1d334	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x2401c	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2f4ac	4	OBJECT	<unknown>	DEFAULT	14
__curbrk	.symtab	0x351d0	4	OBJECT	<unknown>	HIDDEN	15
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x2f210	0	NOTYPE	<unknown>	DEFAULT	14
__deallocate_stack	.symtab	0x120cc	304	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x17144	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x17138	0	FUNC	<unknown>	DEFAULT	2
__default_stacksize	.symtab	0x2f2ac	4	OBJECT	<unknown>	HIDDEN	14
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x15ac8	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x23e00	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x15984	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2f148	0	OBJECT	<unknown>	DEFAULT	11
__end__	.symtab	0x3d644	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x351c0	4	OBJECT	<unknown>	DEFAULT	15
__eqdf2	.symtab	0x2401c	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x1160c	32	FUNC	<unknown>	DEFAULT	2
__error	.symtab	0x1cbbc	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x2713c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x26fdc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x34734	4	OBJECT	<unknown>	HIDDEN	15
__extendsfdf2	.symtab	0x23abc	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x1714c	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x21f78	300	FUNC	<unknown>	DEFAULT	2
__find_in_stack_list	.symtab	0x118c0	308	FUNC	<unknown>	HIDDEN	2
__fini_array_end	.symtab	0x2f14c	0	NOTYPE	<unknown>	HIDDEN	11
__fini_array_start	.symtab	0x2f148	0	NOTYPE	<unknown>	HIDDEN	11
__fixunsdfsi	.symtab	0x2414c	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x23b10	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x23a94	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x23afc	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x23a70	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x11488	24	FUNC	<unknown>	DEFAULT	2
__fork_generation	.symtab	0x3d22c	4	OBJECT	<unknown>	HIDDEN	15
__fork_generation_pointer	.symtab	0x3d610	4	OBJECT	<unknown>	HIDDEN	15
__fork_handlers	.symtab	0x3d614	4	OBJECT	<unknown>	HIDDEN	15
__fork_lock	.symtab	0x34738	4	OBJECT	<unknown>	HIDDEN	15
__frame_dummy_init_array_entry	.symtab	0x2f144	0	OBJECT	<unknown>	DEFAULT	10
__free_stacks	.symtab	0x12028	164	FUNC	<unknown>	HIDDEN	2
__free_tcb	.symtab	0x121fc	116	FUNC	<unknown>	HIDDEN	2
__gedf2	.symtab	0x2400c	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x1e698	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x22e14	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1740c	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x1d1bc	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x19c10	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x15f34	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1601c	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x167b4	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x15fb0	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x160d4	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x167bc	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x16898	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x16fac	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x16238	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x2400c	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x2f148	0	NOTYPE	<unknown>	HIDDEN	10
__init_array_start	.symtab	0x2f144	0	NOTYPE	<unknown>	HIDDEN	10
__init_scan_cookie	.symtab	0x20d54	108	FUNC	<unknown>	HIDDEN	2
__init_sched_fifo_prio	.symtab	0x14d38	76	FUNC	<unknown>	HIDDEN	2
__is_smp	.symtab	0x3d224	4	OBJECT	<unknown>	HIDDEN	15
__ledf2	.symtab	0x24014	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x19e80	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1d350	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x19f7c	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x1d570	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x1d5f8	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	9
__libc_fcntl	.symtab	0x171e4	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1cbc0	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x8	4	TLS	<unknown>	HIDDEN	9
__libc_longjmp	.symtab	0x176e0	56	FUNC	<unknown>	DEFAULT	2
__libc_multiple_threads	.symtab	0x3d618	4	OBJECT	<unknown>	HIDDEN	15
__libc_multiple_threads_ptr	.symtab	0x3d220	4	OBJECT	<unknown>	HIDDEN	15
__libc_nanosleep	.symtab	0x17818	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1d3e0	100	FUNC	<unknown>	DEFAULT	2
__libc_pthread_init	.symtab	0x1cf8c	68	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1d500	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1a100	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1a1b8	136	FUNC	<unknown>	DEFAULT	2
__libc_resp	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_select	.symtab	0x17a68	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1a284	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1a340	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1d7d8	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x170a4	136	FUNC	<unknown>	DEFAULT	2
__libc_siglongjmp	.symtab	0x176e0	56	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x351bc	4	OBJECT	<unknown>	DEFAULT	15
__libc_write	.symtab	0x1d470	100	FUNC	<unknown>	DEFAULT	2
__linkin_atfork	.symtab	0x1cfd0	100	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait	.symtab	0x14730	156	FUNC	<unknown>	HIDDEN	2
__lll_lock_wait_private	.symtab	0x14698	152	FUNC	<unknown>	HIDDEN	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 01:30:54.638149977 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:30:54.901021004 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:30:54.901088953 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:30:54.909419060 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:30:55.171324015 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:30:55.171389103 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:30:55.435038090 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:31:09.924227953 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:31:10.186392069 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:31:10.186567068 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:31:10.186801910 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:31:25.449826956 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:31:25.450067997 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:31:40.715876102 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:31:40.716294050 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:31:55.980864048 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:31:55.981061935 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:32:11.242448092 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:32:11.242948055 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:32:26.510688066 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:32:26.510842085 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:32:40.247140884 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:32:40.516376972 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:32:40.516396046 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:32:40.516561985 CEST	48816	5667	192.168.2.14	94.156.248.18
Apr 27, 2024 01:32:56.001454115 CEST	5667	48816	94.156.248.18	192.168.2.14
Apr 27, 2024 01:32:56.001737118 CEST	48816	5667	192.168.2.14	94.156.248.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2024 01:30:54.468282938 CEST	48823	53	192.168.2.14	195.10.195.195
Apr 27, 2024 01:30:54.637490988 CEST	53	48823	195.10.195.195	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 27, 2024 01:30:54.468282938 CEST	192.168.2.14	195.10.195.195	0x70df	Standard query (0)	whitepeopleonly.dyn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 27, 2024 01:30:54.637490988 CEST	195.10.195.195	192.168.2.14	0x70df	No error (0)	whitepeopleonly.dyn	85.239.33.65	A (IP address)	IN (0x0001)	false
Apr 27, 2024 01:30:54.637490988 CEST	195.10.195.195	192.168.2.14	0x70df	No error (0)	whitepeopleonly.dyn	94.156.248.18	A (IP address)	IN (0x0001)	false
Apr 27, 2024 01:30:54.637490988 CEST	195.10.195.195	192.168.2.14	0x70df	No error (0)	whitepeopleonly.dyn	31.220.1.44	A (IP address)	IN (0x0001)	false
Apr 27, 2024 01:30:54.637490988 CEST	195.10.195.195	192.168.2.14	0x70df	No error (0)	whitepeopleonly.dyn	94.156.248.19	A (IP address)	IN (0x0001)	false
Apr 27, 2024 01:30:54.637490988 CEST	195.10.195.195	192.168.2.14	0x70df	No error (0)	whitepeopleonly.dyn	94.156.248.20	A (IP address)	IN (0x0001)	false
Apr 27, 2024 01:30:54.637490988 CEST	195.10.195.195	192.168.2.14	0x70df	No error (0)	whitepeopleonly.dyn	91.92.254.116	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 13zzcbrXBm.elf PID: 5507, Parent PID: 5432

General

Start time (UTC):	23:30:53
Start date (UTC):	26/04/2024
Path:	/tmp/13zzcbrXBm.elf
Arguments:	/tmp/13zzcbrXBm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5509, Parent PID: 5507

General

Start time (UTC):	23:30:53
Start date (UTC):	26/04/2024
Path:	/tmp/13zzcbrXBm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5511, Parent PID: 5509

General

Start time (UTC):	23:30:53
Start date (UTC):	26/04/2024
Path:	/tmp/13zzcbrXBm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5512, Parent PID: 5509

General

Start time (UTC):	23:30:53
Start date (UTC):	26/04/2024
Path:	/tmp/13zzcbrXBm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5514, Parent PID: 5509

General

Start time (UTC):	23:30:53
Start date (UTC):	26/04/2024
Path:	/tmp/13zzcbrXBm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 13zzcbrXBm.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: 13zzcbrXBm.elf PID: 5507, Parent PID: 5432

General

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5509, Parent PID: 5507

General

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5511, Parent PID: 5509

General

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5512, Parent PID: 5509

General

Chronological Activities

Analysis Process: 13zzcbrXBm.elf PID: 5514, Parent PID: 5509

General

Chronological Activities

Linux Analysis Report
13zzcbrXBm.elf