Edit tour

Linux Analysis Report
Federalarm7Agent.elf

Overview

General Information

Sample name:	Federalarm7Agent.elf
Analysis ID:	1642462
MD5:	33fd833afc2d62a02b556a9616004af0
SHA1:	1e9e9be788ac04bd374f1c745c9ff157f7165d2b
SHA256:	77c607982092d3975005f7a0dac25caab7c8ea36c74ddc2886390a7a70a338df
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1642462
Start date and time:	2025-03-19 03:50:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Federalarm7Agent.elf
Detection:	MAL
Classification:	mal76.troj.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Federalarm7Agent.elf
PID:	6265
Exit Code:	139
Exit Code Info:	SIGSEGV (11) Segmentation fault invalid memory reference
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

Federalarm7Agent.elf (PID: 6265, Parent: 6187, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Federalarm7Agent.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Federalarm7Agent.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Federalarm7Agent.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1683c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1688c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1692c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1697c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6265.1.00007f426c017000.00007f426c031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6265.1.00007f426c017000.00007f426c031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1683c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1688c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x168f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1692c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1697c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Federalarm7Agent.elf PID: 6265	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x122af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1233b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1234f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1238b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1239f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1242b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1243f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Federalarm7Agent.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Federalarm7Agent.elf	Virustotal: Detection: 60%			Perma Link
Source: Federalarm7Agent.elf	ReversingLabs: Detection: 52%

Source: /tmp/Federalarm7Agent.elf (PID: 6265)

Socket: 192.168.2.23:9473

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Federalarm7Agent.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6265.1.00007f426c017000.00007f426c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Federalarm7Agent.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_ovhudp
Source: ELF static info symbol of initial sample	Name: attack_method_std
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex

Source: Federalarm7Agent.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Federalarm7Agent.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6265.1.00007f426c017000.00007f426c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Federalarm7Agent.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.linELF@0/0@0/0

Source: /tmp/Federalarm7Agent.elf (PID: 6265)

Queries kernel information via 'uname':

Jump to behavior

Source: Federalarm7Agent.elf, 6265.1.00007ffc2640f000.00007ffc26430000.rw-.sdmp	Binary or memory string: wx86_64/usr/bin/qemu-arm/tmp/Federalarm7Agent.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Federalarm7Agent.elf
Source: Federalarm7Agent.elf, 6265.1.000055d5e9ded000.000055d5e9f1b000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Federalarm7Agent.elf, 6265.1.000055d5e9ded000.000055d5e9f1b000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Federalarm7Agent.elf, 6265.1.00007ffc2640f000.00007ffc26430000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Federalarm7Agent.elf, 6265.1.00007ffc2640f000.00007ffc26430000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Federalarm7Agent.elf, type: SAMPLE
Source: Yara match	File source: 6265.1.00007f426c017000.00007f426c031000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Federalarm7Agent.elf, type: SAMPLE
Source: Yara match	File source: 6265.1.00007f426c017000.00007f426c031000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Federalarm7Agent.elf	61%	Virustotal		Browse
Federalarm7Agent.elf	53%	ReversingLabs	Linux.Backdoor.Bushido
Federalarm7Agent.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	Federalm68kAgent.elf	Get hash	malicious	Mirai	Browse
	Federalsh4Agent.elf	Get hash	malicious	Mirai	Browse
	FederalarmAgent.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Federali486Agent.elf	Get hash	malicious	Unknown	Browse
	FederalmipsAgent.elf	Get hash	malicious	Mirai	Browse
	hoho.arm5.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	Federalm68kAgent.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Federalsh4Agent.elf	Get hash	malicious	Mirai	Browse
	FederalarmAgent.elf	Get hash	malicious	Mirai	Browse
	Federalarm7Agent.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Federalm68kAgent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	Federalsh4Agent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	FederalarmAgent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Federalarm7Agent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Federalm68kAgent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	Federalsh4Agent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	FederalarmAgent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Federalarm7Agent.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	Federalm68kAgent.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	Federalsh4Agent.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	FederalarmAgent.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Federalarm7Agent.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.054839212587655
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Federalarm7Agent.elf
File size:	166'820 bytes
MD5:	33fd833afc2d62a02b556a9616004af0
SHA1:	1e9e9be788ac04bd374f1c745c9ff157f7165d2b
SHA256:	77c607982092d3975005f7a0dac25caab7c8ea36c74ddc2886390a7a70a338df
SHA512:	94de687e938476d09f88efa1be1a5d775d9299fd37455446b6cb1acc9be9fb37d288f34de833cc49b603c039c237fcb2dc45c1abacd362fe2ffa93578e40132f
SSDEEP:	3072:CBF6pcUYnm+3W9aPa9pTWMFQjf3BZhSo40XsXIDsM/9slxNn2Pmqwb4XhR:Cj6pcUYm3EPa9pTWMFefdbhXsXIgM/9R
TLSH:	BCF35C56F6414F13C4C6177ABA9F42453322A7A4D3DB73069928BFB43F8669F0E23A05
File Content Preview:	.ELF..............(.........4...........4. ...(........p.................................................................................x..........................................Q.td..................................-...L..................@-.,@...0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	132816
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16724	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1e814	0x16814	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1e828	0x16828	0x2d98	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x215c0	0x195c0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x215d8	0x195d8	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x296f0	0x196f0	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x296f4	0x196f4	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x296f4	0x196f4	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x296f8	0x196f8	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x296fc	0x196fc	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x29700	0x19700	0xac	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x297ac	0x197ac	0x710	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x29ebc	0x19ebc	0x7130	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x19ebc	0xb8c	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1aa48	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1ab88	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ad9b	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1cdde	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1d4c0	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1e338	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1e5f0	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1eeba	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x20049	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x205a1	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x205b7	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x20b58	0x5500	0x10	0x0		28	778	4
.strtab	STRTAB	0x0	0x26058	0x2b4c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x195d8	0x215d8	0x215d8	0x118	0x118	4.4822	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x196f0	0x196f0	6.2094	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x196f0	0x296f0	0x296f0	0x7cc	0x78fc	4.6279	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x196f4	0x296f4	0x296f4	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80d4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80f0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1e814	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1e828	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x215c0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x215d8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x296f0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x296f4	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x296f4	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x296f8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x296fc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x29700	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x297ac	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x29ebc	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
$a	.symtab	0x80d4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1e814	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80e0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1e820	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8194	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x82cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x84e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8554	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x85c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8b30	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8de0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9080	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x997c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9e68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa61c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xad38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbb80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbe5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc31c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc7b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xcc5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd3e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xddd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe544	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe594	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe638	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xe798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xed08	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xeea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xef5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf29c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfad8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfeac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10558	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10580	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x106b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x108e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11904	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11f74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fbc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fe0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x121ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12208	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1229c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1232c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12454	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x125f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1270c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12790	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x127d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12954	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12bf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ca8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12d90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12db0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12e88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12eb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12f88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13008	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1316c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1319c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x132e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13aac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b4c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13b90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14304	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1433c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14400	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14410	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14420	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x144e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14564	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14630	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1472c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14744	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14850	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1499c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x149e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14a98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14adc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14b94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c1c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14de4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f28	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14fb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15004	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15018	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15148	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15af8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15ff8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16498	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x164d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16600	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16618	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x166bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16774	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16834	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x168d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16968	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16a40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16b38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c60	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16e38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16efc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17048	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1766c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x176bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17a88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17b68	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17c58	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17dec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17df4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f14	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17f9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18058	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x181f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18248	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x182a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1868c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18734	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x187f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18898	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x188fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1899c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18a64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18aa4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ab8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18afc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18bdc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18dd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x192dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x196e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x197c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19c24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19d64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ee0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a03c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a830	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a974	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1aa90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad40	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b0ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b218	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b2c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b864	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b944	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bbb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bcf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bd70	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bdd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c02c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c070	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c0c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c12c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c458	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c5a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c64c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c87c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cc98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d314	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d36c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d398	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d3b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d5d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d720	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d73c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d79c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d808	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d8e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1da24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1df84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e040	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e084	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e798	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8128	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296f8	0	NOTYPE	<unknown>	DEFAULT	10
$d	.symtab	0x8180	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x296f4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x81c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x82c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ae4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x935c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9978	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9e64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa618	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xad34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb44c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbb7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc0bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc7b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xcc58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd3d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xddbc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xe4ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x297ac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x297b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x297b4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xe784	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xed00	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xee84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xeef4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x297b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xef10	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xef54	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf0ac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf298	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf310	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfaa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29cac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29cb0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29cb4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29cb8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0xfb24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfb8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x104a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29cbc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1057c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x106b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1077c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x108d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11390	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11864	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2024b	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x20254	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x20	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x26	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x124e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x125d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x126c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12708	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1274c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1278c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x127d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12850	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12920	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12a48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12bec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ca0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20258	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x12d7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12e48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12f80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12ff8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13150	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29cc4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29cc0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x13a88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x202c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x13d3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13d88	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x142d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29da8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x202d0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x143f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14628	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20354	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x148cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14970	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x149d8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14a90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14b8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d14	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14d98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14ddc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14e98	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14f68	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14fac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15000	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x150d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15ad4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29dac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x15c1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15fd8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1647c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x164d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165ec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29dc4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x166a0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16758	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16818	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x168bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ddc	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x29e74	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x16964	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16a34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16b28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x20ec0	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x16e28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16edc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29e88	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x17024	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x176b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17a60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17c4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17d90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17e20	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17eb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17f40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1812c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x181e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18240	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18294	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18640	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x29ea0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18700	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18730	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x187b0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1882c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x188f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18998	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18aa0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18af8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b78	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18bd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18c40	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18eac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1925c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x196b8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x197c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19bf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e3c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a810	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x21578	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1ad24	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b0d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b210	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b838	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1b93c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bb18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bcf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bd58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bdc8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c004	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c064	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c114	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c26c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c574	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c648	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c734	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x4c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x53	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x1d5b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x58	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x23c	0	NOTYPE	<unknown>	DEFAULT	21
$d	.symtab	0xe39	0	NOTYPE	<unknown>	DEFAULT	23
$d	.symtab	0x29eac	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x20f52	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x29eb4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x21252	0	NOTYPE	<unknown>	DEFAULT	4
C.11.5548	.symtab	0x20f30	12	OBJECT	<unknown>	DEFAULT	4
C.42.5012	.symtab	0x20254	3	OBJECT	<unknown>	DEFAULT	4
C.43.5013	.symtab	0x2024b	9	OBJECT	<unknown>	DEFAULT	4
C.5.5083	.symtab	0x20258	24	OBJECT	<unknown>	DEFAULT	4
C.7.5370	.symtab	0x20f3c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6078	.symtab	0x2027c	12	OBJECT	<unknown>	DEFAULT	4
C.7.6109	.symtab	0x202a0	12	OBJECT	<unknown>	DEFAULT	4
C.7.6182	.symtab	0x21554	12	OBJECT	<unknown>	DEFAULT	4
C.8.6110	.symtab	0x20294	12	OBJECT	<unknown>	DEFAULT	4
C.9.6119	.symtab	0x20288	12	OBJECT	<unknown>	DEFAULT	4
KillStructure	.symtab	0x297b8	1268	OBJECT	<unknown>	DEFAULT	13
LOCAL_ADDR	.symtab	0x30a0c	4	OBJECT	<unknown>	DEFAULT	14
Laligned	.symtab	0x14508	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x14524	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x29ee0	16384	OBJECT	<unknown>	DEFAULT	14
_Exit	.symtab	0x18830	104	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x29700	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_Unwind_Complete	.symtab	0x1d368	4	FUNC	<unknown>	HIDDEN	2
_Unwind_DeleteException	.symtab	0x1d36c	44	FUNC	<unknown>	HIDDEN	2
_Unwind_ForcedUnwind	.symtab	0x1e01c	36	FUNC	<unknown>	HIDDEN	2
_Unwind_GetCFA	.symtab	0x1d360	8	FUNC	<unknown>	HIDDEN	2
_Unwind_GetDataRelBase	.symtab	0x1d3a4	12	FUNC	<unknown>	HIDDEN	2
_Unwind_GetLanguageSpecificData	.symtab	0x1e040	68	FUNC	<unknown>	HIDDEN	2
_Unwind_GetRegionStart	.symtab	0x1e7e0	52	FUNC	<unknown>	HIDDEN	2
_Unwind_GetTextRelBase	.symtab	0x1d398	12	FUNC	<unknown>	HIDDEN	2
_Unwind_RaiseException	.symtab	0x1dfb0	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume	.symtab	0x1dfd4	36	FUNC	<unknown>	HIDDEN	2
_Unwind_Resume_or_Rethrow	.symtab	0x1dff8	36	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Get	.symtab	0x1d2c8	76	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Pop	.symtab	0x1d8e0	324	FUNC	<unknown>	HIDDEN	2
_Unwind_VRS_Set	.symtab	0x1d314	76	FUNC	<unknown>	HIDDEN	2
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x29eac	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x20f52	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x29eb4	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x21252	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x296f0	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x296f0	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x29eac	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x29eb4	4	OBJECT	<unknown>	HIDDEN	13
__GI___close	.symtab	0x17db0	100	FUNC	<unknown>	HIDDEN	2
__GI___close_nocancel	.symtab	0x17d94	24	FUNC	<unknown>	HIDDEN	2
__GI___ctype_b	.symtab	0x29eb0	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x29eb8	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x12d90	32	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x12454	152	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1b0ec	300	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1472c	24	FUNC	<unknown>	HIDDEN	2
__GI___libc_close	.symtab	0x17db0	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x124ec	244	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x17e40	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_read	.symtab	0x17f60	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_write	.symtab	0x17ed0	100	FUNC	<unknown>	HIDDEN	2
__GI___open	.symtab	0x17e40	100	FUNC	<unknown>	HIDDEN	2
__GI___open_nocancel	.symtab	0x17e24	24	FUNC	<unknown>	HIDDEN	2
__GI___read	.symtab	0x17f60	100	FUNC	<unknown>	HIDDEN	2
__GI___read_nocancel	.symtab	0x17f44	24	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x15100	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x15124	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x150dc	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x18178	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x18248	88	FUNC	<unknown>	HIDDEN	2
__GI___write	.symtab	0x17ed0	100	FUNC	<unknown>	HIDDEN	2
__GI___write_nocancel	.symtab	0x17eb4	24	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x14744	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x18830	104	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x164d8	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x149e0	116	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x16c24	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x14a54	68	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1c0c8	88	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x17db0	100	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x12954	272	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x191e8	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1921c	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x18ec0	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x14adc	116	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x16e38	196	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x19398	816	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x124ec	244	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1ad40	940	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1a830	324	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1b0ec	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1a974	284	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1b218	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x196c8	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x176bc	972	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x12e58	48	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x14304	56	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1c274	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1c298	448	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x18898	100	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1433c	188	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1b0ec	300	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1899c	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x189c8	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x189dc	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x189f0	20	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x18a04	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x17b20	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x18a2c	56	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x14b50	68	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x18a64	64	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x18aa4	20	FUNC	<unknown>	HIDDEN	2
__GI_inet_addr	.symtab	0x14974	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1bc00	248	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x16a40	248	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x125f4	224	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x148d4	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x126d4	56	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x14bdc	64	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1c6c8	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1b750	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x14400	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x14410	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1b840	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1b864	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x14420	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x1868c	124	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x18ab8	68	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x18afc	64	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x18b7c	96	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x17e40	100	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x12b34	196	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x12de4	116	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x17b68	240	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x16618	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x168d8	144	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x17f60	100	FUNC	<unknown>	HIDDEN	2
__GI_readdir	.symtab	0x12ca8	232	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x18dd4	236	FUNC	<unknown>	HIDDEN	2
__GI_readlink	.symtab	0x12750	64	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x14c60	112	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x14d18	136	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x18bdc	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x127d4	132	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x14de4	112	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x14ea0	136	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x12858	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x14f28	72	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x16b38	236	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x18734	136	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x14fb4	80	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x15004	20	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x15018	196	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x12898	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x17c58	300	FUNC	<unknown>	HIDDEN	2
__GI_snprintf	.symtab	0x12e88	48	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x14f70	68	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x16968	216	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x14850	132	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1b944	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1ba34	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x144c0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x144c0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x14540	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1bb20	68	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x144e0	96	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x14564	204	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1bb64	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1bbb4	76	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x14630	252	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x16c44	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x17048	1572	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x148f8	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x12924	48	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x18c48	20	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1319c	324	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x12eb8	208	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x19264	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x192dc	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x192b8	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x17ed0	100	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x296fc	0	OBJECT	<unknown>	DEFAULT	11
__JCR_LIST__	.symtab	0x296fc	0	OBJECT	<unknown>	DEFAULT	11
___Unwind_ForcedUnwind	.symtab	0x1e01c	36	FUNC	<unknown>	HIDDEN	2
___Unwind_RaiseException	.symtab	0x1dfb0	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume	.symtab	0x1dfd4	36	FUNC	<unknown>	HIDDEN	2
___Unwind_Resume_or_Rethrow	.symtab	0x1dff8	36	FUNC	<unknown>	HIDDEN	2
__adddf3	.symtab	0x1c888	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1d1e4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1d1e4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1d1c8	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1d274	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1c888	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1d1fc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1d244	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1d25c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1d22c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1d214	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1cf28	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1cc98	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1c87c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1c884	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1cbe4	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1cbbc	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x1c738	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x1c864	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1cc38	96	FUNC	<unknown>	HIDDEN	2
__aeabi_read_tp	.symtab	0x187e0	8	FUNC	<unknown>	DEFAULT	2
__aeabi_ui2d	.symtab	0x1cb98	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x1232c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x12428	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1cc24	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1df7c	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr1	.symtab	0x1df74	8	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr2	.symtab	0x1df6c	8	FUNC	<unknown>	HIDDEN	2
__app_fini	.symtab	0x304c4	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x29e88	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x30fec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x29ebc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x29ebc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x181f4	84	FUNC	<unknown>	DEFAULT	2
__close	.symtab	0x17db0	100	FUNC	<unknown>	DEFAULT	2
__close_nocancel	.symtab	0x17d94	24	FUNC	<unknown>	DEFAULT	2
__cmpdf2	.symtab	0x1d144	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x29eb0	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x29eb8	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x30a08	4	OBJECT	<unknown>	HIDDEN	14
__cxa_begin_cleanup	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_call_unexpected	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_type_match	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__data_start	.symtab	0x297ac	0	NOTYPE	<unknown>	DEFAULT	13
__default_rt_sa_restorer	.symtab	0x187d4	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x187c8	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x12440	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1cf28	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x1c738	300	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x80f0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x296f8	0	OBJECT	<unknown>	DEFAULT	10
__end__	.symtab	0x30fec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x304bc	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1d144	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x12d90	32	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exidx_end	.symtab	0x216f0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x215d8	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x2ff6c	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1cbe4	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x12454	152	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1b0ec	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x296fc	0	NOTYPE	<unknown>	HIDDEN	10
__fini_array_start	.symtab	0x296f8	0	NOTYPE	<unknown>	HIDDEN	10
__fixunsdfsi	.symtab	0x1d274	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1cc38	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1cbbc	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1cc24	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1cb98	36	FUNC	<unknown>	HIDDEN	2
__fork	.symtab	0x176bc	972	FUNC	<unknown>	DEFAULT	2
__fork_generation_pointer	.symtab	0x30fb8	4	OBJECT	<unknown>	HIDDEN	14
__fork_handlers	.symtab	0x30fbc	4	OBJECT	<unknown>	HIDDEN	14
__fork_lock	.symtab	0x2ff70	4	OBJECT	<unknown>	HIDDEN	14
__frame_dummy_init_array_entry	.symtab	0x296f4	0	OBJECT	<unknown>	DEFAULT	9
__gedf2	.symtab	0x1d134	148	FUNC	<unknown>	HIDDEN	2
__getdents	.symtab	0x188fc	160	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1c12c	328	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x18a04	40	FUNC	<unknown>	DEFAULT	2
__getpid	.symtab	0x17b20	72	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1472c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gnu_Unwind_Find_exidx	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gnu_Unwind_ForcedUnwind	.symtab	0x1d720	28	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_RaiseException	.symtab	0x1d808	184	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Restore_VFP	.symtab	0x1dfa0	0	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume	.symtab	0x1d79c	108	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Resume_or_Rethrow	.symtab	0x1d8c0	32	FUNC	<unknown>	HIDDEN	2
__gnu_Unwind_Save_VFP	.symtab	0x1dfa8	0	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_execute	.symtab	0x1e084	1812	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_frame	.symtab	0x1e798	72	FUNC	<unknown>	HIDDEN	2
__gnu_unwind_pr_common	.symtab	0x1da24	1352	FUNC	<unknown>	DEFAULT	2
__gtdf2	.symtab	0x1d134	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__init_array_end	.symtab	0x296f8	0	NOTYPE	<unknown>	HIDDEN	9
__init_array_start	.symtab	0x296f4	0	NOTYPE	<unknown>	HIDDEN	9
__ledf2	.symtab	0x1d13c	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x149e0	116	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x17db0	100	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x14adc	116	FUNC	<unknown>	DEFAULT	2
__libc_disable_asynccancel	.symtab	0x17fd0	136	FUNC	<unknown>	HIDDEN	2
__libc_enable_asynccancel	.symtab	0x18058	220	FUNC	<unknown>	HIDDEN	2
__libc_errno	.symtab	0x0	4	TLS	<unknown>	HIDDEN	8
__libc_fcntl	.symtab	0x124ec	244	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x176bc	972	FUNC	<unknown>	DEFAULT	2
__libc_h_errno	.symtab	0x4	4	TLS	<unknown>	HIDDEN	8
__libc_multiple_threads	.symtab	0x30fc0	4	OBJECT	<unknown>	HIDDEN	14
__libc_nanosleep	.symtab	0x18b7c	96	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x17e40	100	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x17f60	100	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x14c60	112	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x14d18	136	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x127d4	132	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x14de4	112	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x14ea0	136	FUNC	<unknown>	DEFAULT	2
__libc_setup_tls	.symtab	0x1bdfc	560	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x18734	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x304b8	4	OBJECT	<unknown>	DEFAULT	14
__libc_write	.symtab	0x17ed0	100	FUNC	<unknown>	DEFAULT	2
__lll_lock_wait_private	.symtab	0x17a88	152	FUNC	<unknown>	HIDDEN	2
__ltdf2	.symtab	0x1d13c	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x160a8	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x15148	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x29dac	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x30c40	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x15ff8	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1cc98	656	FUNC	<unknown>	HIDDEN	2
__nedf2	.symtab	0x1d144	132	FUNC	<unknown>	HIDDEN	2
__nptl_deallocate_tsd	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__nptl_nthreads	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__open	.symtab	0x17e40	100	FUNC	<unknown>	DEFAULT	2
__open_nocancel	.symtab	0x17e24	24	FUNC	<unknown>	DEFAULT	2
__pagesize	.symtab	0x304c0	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x296f4	0	NOTYPE	<unknown>	HIDDEN	8
__preinit_array_start	.symtab	0x296f4	0	NOTYPE	<unknown>	HIDDEN	8
__progname	.symtab	0x29ea4	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x29ea8	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x1c02c	12	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_init	.symtab	0x1813c	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x18134	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x18134	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x18134	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x18134	8	FUNC	<unknown>	DEFAULT	2
__pthread_unwind	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__read	.symtab	0x17f60	100	FUNC	<unknown>	DEFAULT	2
__read_nocancel	.symtab	0x17f44	24	FUNC	<unknown>	DEFAULT	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__restore_core_regs	.symtab	0x1df84	28	FUNC	<unknown>	HIDDEN	2
__rtld_fini	.symtab	0x304c8	4	OBJECT	<unknown>	HIDDEN	14
__sigaddset	.symtab	0x15100	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x15124	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x150dc	36	FUNC	<unknown>	DEFAULT	2
__sigjmp_save	.symtab	0x1c688	64	FUNC	<unknown>	HIDDEN	2
__sigsetjmp	.symtab	0x1c120	12	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x29cd0	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1c458	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x196e8	220	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1c4b0	200	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x19c24	320	FUNC	<unknown>	HIDDEN	2
__stdio_rfill	.symtab	0x1c578	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1c64c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1c5a8	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x19d64	220	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1316c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x29cd4	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1c884	788	FUNC	<unknown>	HIDDEN	2
__sys_accept	.symtab	0x1499c	68	FUNC	<unknown>	DEFAULT	2
__sys_connect	.symtab	0x14a98	68	FUNC	<unknown>	DEFAULT	2
__sys_recv	.symtab	0x14c1c	68	FUNC	<unknown>	DEFAULT	2
__sys_recvfrom	.symtab	0x14cd0	72	FUNC	<unknown>	DEFAULT	2
__sys_send	.symtab	0x14da0	68	FUNC	<unknown>	DEFAULT	2
__sys_sendto	.symtab	0x14e54	76	FUNC	<unknown>	DEFAULT	2
__syscall_error	.symtab	0x18708	44	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_nanosleep	.symtab	0x18b3c	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x187f0	64	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_select	.symtab	0x12790	68	FUNC	<unknown>	DEFAULT	2
__tls_get_addr	.symtab	0x1bdd8	36	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x18178	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x18248	88	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x182a0	1004	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x29ea0	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x1232c	252	FUNC	<unknown>	HIDDEN	2
__write	.symtab	0x17ed0	100	FUNC	<unknown>	DEFAULT	2
__write_nocancel	.symtab	0x17eb4	24	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r	.symtab	0x14744	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x18d28	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x18c5c	204	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x2ff5c	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x30fec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x132e0	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x30be8	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x30c10	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x29da8	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1c038	56	FUNC	<unknown>	DEFAULT	2
_dl_nothread_init_static_tls	.symtab	0x1c070	88	FUNC	<unknown>	HIDDEN	2
_dl_phdr	.symtab	0x30fe4	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x30fe8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_gaps	.symtab	0x30fd8	1	OBJECT	<unknown>	DEFAULT	14
_dl_tls_dtv_slotinfo_list	.symtab	0x30fd4	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_generation	.symtab	0x30fdc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_max_dtv_idx	.symtab	0x30fcc	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_setup	.symtab	0x1bd70	104	FUNC	<unknown>	DEFAULT	2
_dl_tls_static_align	.symtab	0x30fc8	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_nelem	.symtab	0x30fe0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_size	.symtab	0x30fd0	4	OBJECT	<unknown>	DEFAULT	14
_dl_tls_static_used	.symtab	0x30fc4	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x29ebc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x30fec	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_exit	.symtab	0x18830	104	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1e814	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x2df5c	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x13334	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1a03c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_init	.symtab	0x80d4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x19e40	116	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1b2c0	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x13aac	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x13d94	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x13b4c	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x13b90	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x13d40	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x1814c	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x18144	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_setjmp	.symtab	0x187bc	8	FUNC	<unknown>	DEFAULT	2
_sigintr	.symtab	0x30c38	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x8194	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x197c4	1120	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x12f88	128	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x29cd8	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2df3c	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_dec_use	.symtab	0x1aa90	688	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x2df58	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2df48	12	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_use_count	.symtab	0x2df54	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x29cdc	204	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x13008	356	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x29cc0	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x16c60	472	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x19eb4	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x20364	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x19ee0	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x133b8	1780	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x164d8	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x149e0	116	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
add_auth_entry	.symtab	0x10780	352	FUNC	<unknown>	DEFAULT	2
anti_gdb_entry	.symtab	0xef00	24	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x16c24	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x16c24	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_get_opt_int	.symtab	0x8554	112	FUNC	<unknown>	DEFAULT	2
attack_get_opt_ip	.symtab	0x84e8	108	FUNC	<unknown>	DEFAULT	2
attack_gre_ip	.symtab	0x9360	1564	FUNC	<unknown>	DEFAULT	2
attack_init	.symtab	0x85c4	1388	FUNC	<unknown>	DEFAULT	2
attack_method.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
attack_method_nudp	.symtab	0xddd0	1908	FUNC	<unknown>	DEFAULT	2
attack_method_ovhudp	.symtab	0xd3e4	2540	FUNC	<unknown>	DEFAULT	2
attack_method_std	.symtab	0xbb80	732	FUNC	<unknown>	DEFAULT	2
attack_method_stdhex	.symtab	0x9080	736	FUNC	<unknown>	DEFAULT	2
attack_method_stdplain	.symtab	0xc0c0	604	FUNC	<unknown>	DEFAULT	2
attack_method_synurgplain	.symtab	0xad38	1816	FUNC	<unknown>	DEFAULT	2
attack_method_tcpack	.symtab	0xcc5c	1928	FUNC	<unknown>	DEFAULT	2
attack_method_tcpplain	.symtab	0xb450	1840	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstomp	.symtab	0x9e68	1972	FUNC	<unknown>	DEFAULT	2
attack_method_tcpstrong	.symtab	0xa61c	1820	FUNC	<unknown>	DEFAULT	2
attack_method_udpbypass	.symtab	0xbe5c	612	FUNC	<unknown>	DEFAULT	2
attack_method_udpgeneric	.symtab	0x997c	1260	FUNC	<unknown>	DEFAULT	2
attack_method_udphex	.symtab	0x8b30	688	FUNC	<unknown>	DEFAULT	2
attack_method_udpkick	.symtab	0xc31c	1180	FUNC	<unknown>	DEFAULT	2
attack_method_udpplain	.symtab	0x8de0	672	FUNC	<unknown>	DEFAULT	2
attack_method_udpvse	.symtab	0xc7b8	1188	FUNC	<unknown>	DEFAULT	2
attack_parse	.symtab	0x82cc	540	FUNC	<unknown>	DEFAULT	2
attack_start	.symtab	0x81d0	252	FUNC	<unknown>	DEFAULT	2
auth_table	.symtab	0x2df30	4	OBJECT	<unknown>	DEFAULT	14
auth_table_len	.symtab	0x2df04	4	OBJECT	<unknown>	DEFAULT	14
auth_table_max_weight	.symtab	0x2df34	2	OBJECT	<unknown>	DEFAULT	14
been_there_done_that	.symtab	0x2ff68	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x14a54	68	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
brk	.symtab	0x1c0c8	88	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x15018	196	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x297b0	4	OBJECT	<unknown>	DEFAULT	13
calloc	.symtab	0x15af8	320	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0xe544	80	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0xe594	164	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x12db0	52	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x17db0	100	FUNC	<unknown>	DEFAULT	2

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 7
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 03:51:08.509958029 CET	43928	443	192.168.2.23	91.189.91.42
Mar 19, 2025 03:51:10.557713985 CET	42516	80	192.168.2.23	109.202.202.202
Mar 19, 2025 03:51:13.885248899 CET	42836	443	192.168.2.23	91.189.91.43
Mar 19, 2025 03:51:30.266916990 CET	43928	443	192.168.2.23	91.189.91.42
Mar 19, 2025 03:51:40.505423069 CET	42836	443	192.168.2.23	91.189.91.43
Mar 19, 2025 03:51:40.505424976 CET	42516	80	192.168.2.23	109.202.202.202
Mar 19, 2025 03:52:11.221184969 CET	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: Federalarm7Agent.elf PID: 6265, Parent PID: 6187

General

Start time (UTC):	02:51:09
Start date (UTC):	19/03/2025
Path:	/tmp/Federalarm7Agent.elf
Arguments:	/tmp/Federalarm7Agent.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Federalarm7Agent.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Federalarm7Agent.elf PID: 6265, Parent PID: 6187

General

File Activities

File Opened

File Read

Process Activities

Signal Sent

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Linux Analysis Report
Federalarm7Agent.elf