Edit tour

Linux Analysis Report
c.elf

Overview

General Information

Sample name:	c.elf
Analysis ID:	1584342
MD5:	da45b6801748e9d3cc98c40f38562818
SHA1:	046cbf55b0f9ab61def454731ba586eb6ac7c1b6
SHA256:	20326bcf9cc77e86bd96c372349fb1ffe0b04aa6a200eb81fefe3c28a9fc315f
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584342
Start date and time:	2025-01-05 08:51:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	c.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/1@0/0

Runtime Messages

Command:	/tmp/c.elf
PID:	6260
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Process Tree

system is lnxubuntu20

c.elf (PID: 6260, Parent: 6185, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/c.elf

c.elf New Fork (PID: 6262, Parent: 6260)

c.elf New Fork (PID: 6264, Parent: 6260)

c.elf New Fork (PID: 6266, Parent: 6264)

dash New Fork (PID: 6283, Parent: 4331)

rm (PID: 6283, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.4KRc4jI7iT /tmp/tmp.AYUwNAWMjD /tmp/tmp.chVd6B7uiG

dash New Fork (PID: 6284, Parent: 4331)

rm (PID: 6284, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.4KRc4jI7iT /tmp/tmp.AYUwNAWMjD /tmp/tmp.chVd6B7uiG

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
c.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: c.elf	Virustotal: Detection: 53%			Perma Link
Source: c.elf	ReversingLabs: Detection: 60%

Spreading

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/c.elf (PID: 6260)

Opens: /proc/net/route

Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 195.133.52.175 ports 65489,4,5,6,8,9

Source: global traffic

TCP traffic: 192.168.2.23:50028 -> 195.133.52.175:65489

Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175
Source: unknown	TCP traffic detected without corresponding DNS query: 195.133.52.175

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39256
Source: unknown	Network traffic detected: HTTP traffic on port 39256 -> 443

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/1@0/0

Source: c.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: c.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: c.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S
Source: c.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/vfork.S

Source: /usr/bin/dash (PID: 6283)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.4KRc4jI7iT /tmp/tmp.AYUwNAWMjD /tmp/tmp.chVd6B7uiG			Jump to behavior
Source: /usr/bin/dash (PID: 6284)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.4KRc4jI7iT /tmp/tmp.AYUwNAWMjD /tmp/tmp.chVd6B7uiG			Jump to behavior

Source: /tmp/c.elf (PID: 6260)

Queries kernel information via 'uname':

Jump to behavior

Source: c.elf, 6260.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp, c.elf, 6262.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp, c.elf, 6264.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/c.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/c.elf
Source: c.elf, 6260.1.00005571476d9000.000055714775e000.rw-.sdmp, c.elf, 6262.1.00005571476d9000.000055714775e000.rw-.sdmp, c.elf, 6264.1.00005571476d9000.000055714775e000.rw-.sdmp	Binary or memory string: mGqU!/etc/qemu-binfmt/m68k
Source: c.elf, 6260.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp, c.elf, 6262.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp, c.elf, 6264.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: c.elf, 6260.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp	Binary or memory string: U$EqU/tmp/qemu-open.vm08qA\DbS
Source: c.elf, 6260.1.00005571476d9000.000055714775e000.rw-.sdmp, c.elf, 6262.1.00005571476d9000.000055714775e000.rw-.sdmp, c.elf, 6264.1.00005571476d9000.000055714775e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: c.elf, 6260.1.00007ffe32a61000.00007ffe32a82000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.vm08qA

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: c.elf, type: SAMPLE

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: c.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
c.elf	53%	Virustotal		Browse
c.elf	61%	ReversingLabs	Linux.Backdoor.Gafgyt

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
195.133.52.175	unknown	Russian Federation	21453	FLEX-ASRU	true
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	main.x86.elf	Get hash	malicious	Mirai	Browse
	main.mpsl.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.sh4.elf	Get hash	malicious	Unknown	Browse
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	powerpc.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	arm6.elf	Get hash	malicious	Mirai	Browse
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse
	gmpsl.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
195.133.52.175	e.elf	Get hash	malicious	Gafgyt	Browse
	x.elf	Get hash	malicious	Gafgyt	Browse
	a.elf	Get hash	malicious	Gafgyt	Browse
	i.elf	Get hash	malicious	Gafgyt	Browse
	176.119.150.11-i-2025-01-04T15_20_35.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.42	Mozi.m.elf	Get hash	malicious	Unknown	Browse
	byte.mpsl.elf	Get hash	malicious	Mirai	Browse
	main_mips.elf	Get hash	malicious	Mirai	Browse
	i.elf	Get hash	malicious	Gafgyt	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	fenty.arm6.elf	Get hash	malicious	Mirai	Browse
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FLEX-ASRU	e.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	x.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	a.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	195.133.78.18
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	195.133.78.18
	i.elf	Get hash	malicious	Gafgyt	Browse	195.133.52.175
	176.119.150.11-i-2025-01-04T15_20_35.elf	Get hash	malicious	Gafgyt, Mirai	Browse	195.133.52.175
	2.elf	Get hash	malicious	Unknown	Browse	94.253.22.15
	linux_i386.elf	Get hash	malicious	Unknown	Browse	195.133.11.40
	i486.elf	Get hash	malicious	Mirai	Browse	94.253.22.179
INIT7CH	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	byte.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fenty.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	fenty.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fenty.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
AMAZON-02US	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	108.139.47.33
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	2.elf	Get hash	malicious	Unknown	Browse	157.175.218.245
	byte.mpsl.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://bit.ly/3VYGxmh	Get hash	malicious	CAPTCHA Scam ClickFix, Phisher	Browse	18.245.31.49
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	armv5l.elf	Get hash	malicious	Unknown	Browse	44.255.115.105
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	45.112.123.126
	2.elf	Get hash	malicious	Unknown	Browse	13.253.163.160

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.vm08qA (deleted)

Download File

Process:	/tmp/c.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	high, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.066214275370975
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	c.elf
File size:	112'826 bytes
MD5:	da45b6801748e9d3cc98c40f38562818
SHA1:	046cbf55b0f9ab61def454731ba586eb6ac7c1b6
SHA256:	20326bcf9cc77e86bd96c372349fb1ffe0b04aa6a200eb81fefe3c28a9fc315f
SHA512:	1b25ebc90744e6fa44d909ddc111e78cdd1b22f3fff32223c085f620657c2a7a3c09459b08da2f853a842217b46ae58525511097a8544903e23b6af17636e7e9
SSDEEP:	3072:VXRF0CB1nfTLGM7xLvQyoeRVDRmmXQcUcAgnFURe:VX70SfTLGMayo6VDRmmXQcUcAgnFURe
TLSH:	67B31892F900EFA6F40EE77604D34B257270BFA10F531666B31739AA9E362D42827F05
File Content Preview:	.ELF.......................D...4.._`.....4. ...(......................Od..Od...... .......Od..od..od......g....... .dt.Q............................NV..a....da...&TN^NuNV..J9..s(f>"y..o\| QJ.g.X.#...o\|N."y..o\| QJ.f.A.....J.g.Hy..O`N.X.......s(N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	89952
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0x12680	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x80012728	0x12728	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x80012736	0x12736	0x282a	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x80014f60	0x14f60	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x80016f64	0x14f64	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80016f6c	0x14f6c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x80016f74	0x14f74	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x80016f78	0x14f78	0x3b0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x80017328	0x15328	0x6420	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x15328	0xbd0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x15ef8	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x161b8	0x31b0	0x10	0x0		14	298	4
.strtab	STRTAB	0x0	0x19368	0x2552	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x14f64	0x14f64	6.0564	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0x14f64	0x80016f64	0x80016f64	0x3c4	0x67e4	2.9215	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80012728	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x80012736	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x80014f60	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x80016f64	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x80016f6c	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x80016f74	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x80016f78	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x80017328	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
Hexed	.symtab	0x800029c6	338	FUNC	<unknown>	DEFAULT	2
KHcommSOCK	.symtab	0x80017344	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x80016fb4	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x8001d5c0	4	OBJECT	<unknown>	DEFAULT	10
Percocet_bp	.symtab	0x80016f94	4	OBJECT	<unknown>	DEFAULT	9
Q	.symtab	0x8001735e	16384	OBJECT	<unknown>	DEFAULT	10
RSF	.symtab	0x80002b18	554	FUNC	<unknown>	DEFAULT	2
SendHttpRand	.symtab	0x8000361a	486	FUNC	<unknown>	DEFAULT	2
UDPBYPASS	.symtab	0x8000209c	276	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x80016fa8	12	OBJECT	<unknown>	DEFAULT	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x80016f68	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x80016f64	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x80016fc8	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x800138bc	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x80017320	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x80014c60	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x80016fd0	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x80013bbc	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x80016f70	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x80016f6c	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x80014f60	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x80014f60	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x80016fc8	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x800138bc	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x80017320	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x80014c60	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x80016fd0	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x80013bbc	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x80016fcc	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x80017324	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x80016fd4	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x800078c0	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x80011fe8	500	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000a0fc	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8000cc1c	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x8000704c	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x80007160	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x8000755e	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8000c5a4	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8000c6c0	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8000a120	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x800071d0	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8000f780	390	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8000bf40	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x8000bf40	28	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8000f934	64	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80007228	60	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8000a894	48	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x80007264	72	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8001b374	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x8000c230	178	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8000c9a0	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8000c1b4	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x8000fa2c	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x8000704c	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x80007160	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x800104be	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x80011fe8	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x80010300	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x800106bc	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x8000fbcc	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x800072ac	56	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x800091d0	80	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8000fbf4	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8000fc1c	346	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x80009220	162	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x80011fe8	500	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x800072e4	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8000c9f4	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80007318	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8000ca30	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x8000a3cc	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8000a408	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80007354	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x800073c4	90	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x8000a8c4	50	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8000ca6c	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8001b378	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x8000a39c	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8000e900	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8001132a	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x80010e38	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8000bdf6	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80007420	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8000a26c	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x800074ec	20	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80011f3a	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8000df3c	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x800096ee	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8000e558	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8000e678	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8000e6a4	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x800097e0	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8000caa8	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x8000755e	80	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x800075cc	62	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x8000f9d4	88	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80011ebc	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8000b810	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8000bb46	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x800107a0	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80007670	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8000a93c	56	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x8000a974	72	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8000caf8	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x800076c4	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8000a9bc	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8000a9f4	70	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8000aa3c	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8000b9b0	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8000f698	232	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x8000aab0	70	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x8000aaf8	60	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8000ab34	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80007728	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8000c2e4	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8000aa7c	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x8000791c	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8000bc50	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x800121dc	120	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x80009918	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x80009aa0	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x80009aa0	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x80009b10	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80010a54	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80009b6c	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x800108b4	310	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x80009c78	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x80009db8	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x8000e8a8	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x800109ec	104	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x80009f18	484	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8000a248	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8000e80c	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000bf5c	34	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000a2a0	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x800077c8	62	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x8000cb64	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x80011fa8	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x80007880	64	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x80007024	38	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80007950	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8000cbfe	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80007808	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8000cc2c	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8000ccb8	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8000cc90	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8000782c	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x80016f74	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x80016f74	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8001d590	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x800172d0	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x8000ab34	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x80017328	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8000c67c	68	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x8000c620	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x80016fcc	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x80017324	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x80016fd4	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x8001d5bc	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x80016f80	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x8001186c	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x80012360	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8001158c	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x8000ea6c	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x800126f4	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x80016f78	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x80012254	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8001139c	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8001176c	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x8001d588	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x800078c0	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8001d580	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x80011fe8	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x80016f64	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x80016f64	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__free_to_heap	.symtab	0x8000b04c	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byname_r	.symtab	0x8000f664	50	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x8000a0fc	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8000cc1c	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x8000b62a	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x8000b3f6	150	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x8000b526	144	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000aff4	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000b35c	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000b48c	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x8000b66c	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x8000b3b4	66	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x8000b4e4	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x8000b5b8	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x8000b5fe	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x80016f64	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x80016f64	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x800124b4	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x80011834	56	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x80007228	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8000a894	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x800075ae	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x8000704c	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x80007160	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x800072ac	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x80007354	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x80011f3a	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8000caa8	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x8000755e	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x8000f9d4	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80007670	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8000a93c	56	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x8000a974	72	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x800076c4	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8000a9bc	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8000a9f4	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8000f698	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x8001d584	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x80007808	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x8000782c	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x8000ad00	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x80017114	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x8001d568	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x8001d702	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x8001d72a	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x8001d736	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x80011a38	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8000f31c	840	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x8001d58c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x80016f64	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x80016f64	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8000c60e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8000c60e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8000c60e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8000c60e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8000c60e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8000c618	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x80011ebc	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x80011a80	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x800172f0	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x8001d594	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x8001d71a	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x8001d73a	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x8000ac74	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8000acb8	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x8000ac24	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8000c954	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x80016fe4	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x80012528	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8000cd88	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8000fd78	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8000cec4	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x80007a80	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x80013ebc	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x800125b4	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80010298	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80012610	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8000d0cc	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x80007b98	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x80016fe8	4	OBJECT	<unknown>	DEFAULT	9
__syscall_exit	.symtab	0x80007198	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x80007108	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_kill	.symtab	0x800074a4	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x80011ed8	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x80007500	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x8000f974	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_wait4	.symtab	0x8000cba4	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x8000c5a4	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8000c6c0	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8000c70a	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x800172e8	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x80007024	38	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8000a120	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x80007c0c	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8000f908	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8001d73e	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x8001d742	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x80007cfe	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x80017328	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8001d748	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_endswith	.symtab	0x80006d82	126	FUNC	<unknown>	DEFAULT	2
_errno	.symtab	0x8001b374	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x800071d0	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80012728	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8001b384	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x80007c56	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8000d574	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8001b378	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x80008b38	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x8000d26c	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x80006b32	54	FUNC	<unknown>	DEFAULT	2
_memmove	.symtab	0x80006b68	118	FUNC	<unknown>	DEFAULT	2
_memset	.symtab	0x80006bde	48	FUNC	<unknown>	DEFAULT	2
_ppfs_init	.symtab	0x800086d8	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x80008b9e	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x800087a8	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80008814	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80008ae4	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8000c618	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8000c618	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x8001d682	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_startswith	.symtab	0x80006d40	66	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x8000fed8	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x80007a18	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x80016fec	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x80016ff0	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x80010388	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x8001b380	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x80017008	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x8001b37c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x80017024	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x80007aa0	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x80017020	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x8000bf80	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8000d35c	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strcat	.symtab	0x80006c48	68	FUNC	<unknown>	DEFAULT	2
_strcmp	.symtab	0x80006abe	116	FUNC	<unknown>	DEFAULT	2
_strcpy	.symtab	0x80006c0e	58	FUNC	<unknown>	DEFAULT	2
_strdup	.symtab	0x80006c8c	64	FUNC	<unknown>	DEFAULT	2
_string_syserrmsgs	.symtab	0x80013f80	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_strlen	.symtab	0x80006a9a	36	FUNC	<unknown>	DEFAULT	2
_strstr	.symtab	0x80006ccc	116	FUNC	<unknown>	DEFAULT	2
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8000d3bc	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x80008544	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x8000e098	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x8000e316	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x800092c4	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x800094fa	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x8000f780	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x800071e0	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x80003482	170	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x80006304	120	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x8000bf40	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8000bf40	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8000a228	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8001d5b8	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x8001d598	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x8000f934	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8000ab34	238	FUNC	<unknown>	DEFAULT	2
buf.4831	.symtab	0x8001d388	460	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x80016fbc	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x8001271e	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x8000af7c	118	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x8000016c	126	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x800001ea	288	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x8000030a	288	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x800078d0	76	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x80007228	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2170	.symtab	0x80017328	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x8000a894	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x800016a4	462	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x800075ae	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x800019b6	228	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x80016f80	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x80007264	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x8001d588	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x8001b374	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execl	.symtab	0x8000c230	178	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8000c9a0	84	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8000c1b4	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x80014b6a	108	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x8000fa2c	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x8000704c	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x80007160	54	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x800011dc	118	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x8001b35e	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x80001080	348	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x80000e78	520	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x800104be	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x80011fe8	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x80010300	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x800106bc	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x8000197e	56	FUNC	<unknown>	DEFAULT	2
fix_errno	.symtab	0x8000703c	0	NOTYPE	<unknown>	DEFAULT	2
fmt	.symtab	0x80014b56	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x8000fbcc	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x800072ac	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x800091d0	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8000b1a2	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x8000fbf4	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8000fbf4	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8000fc1c	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x80009220	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x800051a6	10	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x800013e8	56	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x80004fa2	516	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x80011fe8	500	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x800072e4	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8000c9f4	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80007318	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8000ca30	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x8000a3cc	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8000a408	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80007354	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x8000738c	56	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x800073c4	90	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x8000a8c4	50	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8000a8f8	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8000ca6c	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4830	.symtab	0x8001d554	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x8001b378	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x80016f84	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x80016f88	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x80016f8c	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x80016f90	4	OBJECT	<unknown>	DEFAULT	9
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x80012a06	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x8000a37a	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8000a386	22	FUNC	<unknown>	DEFAULT	2
i.4439	.symtab	0x80016fc0	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x80009918	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8000a39c	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8000e900	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x8001132a	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x80010e98	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x80011068	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x80010e38	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80010aa4	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x80010bbe	634	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x80004e06	412	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x80000540	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x80017118	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x8000b8e2	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8000bdf6	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80007420	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8000a26c	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x800074ec	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x80017354	4	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x80001872	268	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80011f3a	108	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x80017358	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x800051b0	1538	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x80001b60	132	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x80001458	118	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x80002eea	148	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000aed2	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x8000df3c	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x800096ee	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8000e558	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8000e678	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8000e6a4	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x800097e0	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mylock	.symtab	0x8001721c	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x8001d59c	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x80017308	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x8000caa8	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1067	.symtab	0x8001d384	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x8001d5c8	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x8000a358	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8000a364	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x8001734c	8	OBJECT	<unknown>	DEFAULT	10
object.2251	.symtab	0x8001732a	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x8000755e	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x8001d5c4	4	OBJECT	<unknown>	DEFAULT	10
p.2168	.symtab	0x80016f7c	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x80001252	84	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x8001d5d0	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x800075cc	62	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x8000f9d4	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x8000760c	98	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4042	.symtab	0x80013ee1	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x80000ace	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8000087c	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80000996	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x800008c0	214	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x80003800	5638	FUNC	<unknown>	DEFAULT	2
qual_chars.4045	.symtab	0x80013ef4	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80011ebc	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8000b800	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x80005888	128	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x80005908	106	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x800007ba	194	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x800006a2	280	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x800057b4	84	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x80005808	128	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8000b810	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x80014ada	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8000bb46	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstrings	.symtab	0x80016f98	16	OBJECT	<unknown>	DEFAULT	9
randtbl	.symtab	0x80017250	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x800107a0	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80007670	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x8000b1c4	408	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x8000a93c	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x800014ce	470	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x8000a974	72	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_domain_to_hostname	.symtab	0x80005974	140	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x8000600e	56	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x80005a9e	1392	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x80005a00	158	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x80002650	886	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x8000caf8	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x8001d5cc	4	OBJECT	<unknown>	DEFAULT	10
select	.symtab	0x800076c4	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8000a9bc	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x80002d42	424	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8000a9f4	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8000aa3c	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8000b86e	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8000b9b0	406	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8000f698	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x8000aab0	70	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x8000aaf8	60	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x8000ab34	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80007728	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8000c2e4	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x8000aa7c	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8000352c	238	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x80000dca	174	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x80013f08	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x80013eed	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x80013f31	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x80013f46	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x80013f18	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x80013f28	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x8000791c	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8000b958	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8000b958	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8000bc50	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x800172ec	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x8001d5b4	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x80016fe0	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x80016fd8	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x80016fdc	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x800121dc	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x80009918	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x80009aa0	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x80009aa0	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x80009b10	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80010a54	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8000a120	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x80009b6c	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x800108b4	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x80009c78	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x80009db8	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x8000e8a8	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x800109ec	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x80009f18	484	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8000a248	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8000e80c	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000bf5c	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x80000da2	40	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x8001d5d4	174	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x80006048	514	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x80016fc4	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x80006284	58	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x800062be	70	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x8000624a	58	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8000a2a0	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x800021b0	1184	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x80001a9a	198	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x800077c8	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x8000cb64	62	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x8000637c	286	FUNC	<unknown>	DEFAULT	2
tolower	.symtab	0x80011fa8	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x80007880	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x800005d0	210	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x80013f4e	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x80013f66	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x80001be4	1208	FUNC	<unknown>	DEFAULT	2
unknown.1089	.symtab	0x80013f72	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x80017234	28	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x80001420	56	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x80016fb8	4	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x8000c514	142	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x8000667c	444	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x80006eb4	142	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x80006f72	64	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x80006ff2	48	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x80006fb2	64	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x80006f42	48	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x80006838	260	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x80006e00	180	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x80006620	54	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x8000693c	122	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x800065ea	54	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x80006542	114	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x800065b4	54	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x800069b6	228	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x8000649c	42	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x800064c6	124	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x80006656	38	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x80007024	38	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x80002f7e	1284	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x80007950	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x8001b370	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x8000cbfe	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80007808	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x8000042c	276	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x80017348	4	OBJECT	<unknown>	DEFAULT	10
wcrtomb	.symtab	0x8000cc2c	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8000ccb8	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8000cc90	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x800012a6	322	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x8000782c	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x8001b364	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3095	.symtab	0x80014c30	17	OBJECT	<unknown>	DEFAULT	4
y	.symtab	0x8001b368	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x8001b36c	4	OBJECT	<unknown>	DEFAULT	10
zprintf	.symtab	0x80000d7e	36	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 08:52:17.062503099 CET	50028	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:17.067348957 CET	65489	50028	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:17.067567110 CET	50028	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:17.068146944 CET	50028	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:17.072952032 CET	65489	50028	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:17.788036108 CET	65489	50028	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:17.788183928 CET	65489	50028	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:17.788204908 CET	50028	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:17.788680077 CET	50028	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:17.794008017 CET	65489	50028	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:18.774152040 CET	43928	443	192.168.2.23	91.189.91.42
Jan 5, 2025 08:52:31.257239103 CET	443	39256	34.249.145.219	192.168.2.23
Jan 5, 2025 08:52:31.257635117 CET	39256	443	192.168.2.23	34.249.145.219
Jan 5, 2025 08:52:31.266995907 CET	443	39256	34.249.145.219	192.168.2.23
Jan 5, 2025 08:52:32.791915894 CET	50030	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:32.796818018 CET	65489	50030	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:32.796906948 CET	50030	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:32.796962976 CET	50030	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:32.801855087 CET	65489	50030	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:33.518663883 CET	65489	50030	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:33.518815041 CET	50030	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:33.518980026 CET	65489	50030	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:33.519107103 CET	50030	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:33.523904085 CET	65489	50030	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:35.411869049 CET	42516	80	192.168.2.23	109.202.202.202
Jan 5, 2025 08:52:39.507172108 CET	43928	443	192.168.2.23	91.189.91.42
Jan 5, 2025 08:52:48.521095037 CET	50032	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:48.526053905 CET	65489	50032	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:48.526140928 CET	50032	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:48.526201010 CET	50032	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:48.531017065 CET	65489	50032	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:49.249677896 CET	65489	50032	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:49.249783993 CET	65489	50032	195.133.52.175	192.168.2.23
Jan 5, 2025 08:52:49.249806881 CET	50032	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:49.249871016 CET	50032	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:52:49.254765034 CET	65489	50032	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:04.252052069 CET	50034	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:04.256992102 CET	65489	50034	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:04.257044077 CET	50034	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:04.257071018 CET	50034	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:04.261881113 CET	65489	50034	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:04.989752054 CET	65489	50034	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:04.990084887 CET	50034	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:04.990309954 CET	65489	50034	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:04.990392923 CET	50034	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:04.995213985 CET	65489	50034	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:19.992860079 CET	50036	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:19.997694016 CET	65489	50036	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:19.997750998 CET	50036	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:19.997795105 CET	50036	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:20.002566099 CET	65489	50036	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:20.461585999 CET	43928	443	192.168.2.23	91.189.91.42
Jan 5, 2025 08:53:20.699204922 CET	65489	50036	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:20.699331999 CET	50036	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:20.699378014 CET	65489	50036	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:20.699491024 CET	50036	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:20.704257011 CET	65489	50036	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:35.701695919 CET	50038	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:35.706604004 CET	65489	50038	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:35.706672907 CET	50038	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:35.706707954 CET	50038	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:35.711519003 CET	65489	50038	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:36.408098936 CET	65489	50038	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:36.408210039 CET	50038	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:36.408235073 CET	65489	50038	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:36.408288956 CET	50038	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:36.413086891 CET	65489	50038	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:51.410264015 CET	50040	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:51.415182114 CET	65489	50040	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:51.415234089 CET	50040	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:51.415257931 CET	50040	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:51.420023918 CET	65489	50040	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:52.124521971 CET	65489	50040	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:52.124617100 CET	50040	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:52.124646902 CET	65489	50040	195.133.52.175	192.168.2.23
Jan 5, 2025 08:53:52.124705076 CET	50040	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:53:52.129491091 CET	65489	50040	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:07.126657963 CET	50042	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:07.131529093 CET	65489	50042	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:07.131630898 CET	50042	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:07.131630898 CET	50042	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:07.136421919 CET	65489	50042	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:07.851841927 CET	65489	50042	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:07.851905107 CET	65489	50042	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:07.852104902 CET	50042	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:07.852147102 CET	50042	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:07.856911898 CET	65489	50042	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:22.854718924 CET	50044	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:22.860737085 CET	65489	50044	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:22.860810995 CET	50044	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:22.860840082 CET	50044	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:22.867939949 CET	65489	50044	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:23.586803913 CET	65489	50044	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:23.586935997 CET	50044	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:23.587018013 CET	65489	50044	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:23.587109089 CET	50044	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:23.591905117 CET	65489	50044	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:38.590632915 CET	50046	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:38.595480919 CET	65489	50046	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:38.595556021 CET	50046	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:38.595577002 CET	50046	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:38.600378990 CET	65489	50046	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:39.302304983 CET	65489	50046	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:39.302318096 CET	65489	50046	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:39.302424908 CET	50046	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:39.302639008 CET	50046	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:39.311661959 CET	65489	50046	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:54.305639029 CET	50048	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:54.311306000 CET	65489	50048	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:54.311475992 CET	50048	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:54.311520100 CET	50048	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:54.316304922 CET	65489	50048	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:55.013827085 CET	65489	50048	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:55.013907909 CET	65489	50048	195.133.52.175	192.168.2.23
Jan 5, 2025 08:54:55.014044046 CET	50048	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:55.014091969 CET	50048	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:54:55.018809080 CET	65489	50048	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:10.016684055 CET	50050	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:10.021486998 CET	65489	50050	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:10.021545887 CET	50050	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:10.021565914 CET	50050	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:10.026352882 CET	65489	50050	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:10.724035978 CET	65489	50050	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:10.724200010 CET	65489	50050	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:10.724252939 CET	50050	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:10.724390984 CET	50050	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:10.729137897 CET	65489	50050	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:25.727400064 CET	50052	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:25.732281923 CET	65489	50052	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:25.732377052 CET	50052	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:25.732398987 CET	50052	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:25.737138987 CET	65489	50052	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:26.456887007 CET	65489	50052	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:26.457011938 CET	50052	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:26.457186937 CET	65489	50052	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:26.457257986 CET	50052	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:26.462038994 CET	65489	50052	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:41.459758043 CET	50054	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:41.464678049 CET	65489	50054	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:41.464744091 CET	50054	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:41.464757919 CET	50054	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:41.469577074 CET	65489	50054	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:42.182821989 CET	65489	50054	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:42.182955027 CET	50054	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:42.182986021 CET	65489	50054	195.133.52.175	192.168.2.23
Jan 5, 2025 08:55:42.183096886 CET	50054	65489	192.168.2.23	195.133.52.175
Jan 5, 2025 08:55:42.187879086 CET	65489	50054	195.133.52.175	192.168.2.23

System Behavior

Analysis Process: c.elf PID: 6260, Parent PID: 6185

General

Start time (UTC):	07:52:16
Start date (UTC):	05/01/2025
Path:	/tmp/c.elf
Arguments:	/tmp/c.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: c.elf PID: 6262, Parent PID: 6260

General

Start time (UTC):	07:52:16
Start date (UTC):	05/01/2025
Path:	/tmp/c.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: c.elf PID: 6264, Parent PID: 6260

General

Start time (UTC):	07:52:16
Start date (UTC):	05/01/2025
Path:	/tmp/c.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: c.elf PID: 6266, Parent PID: 6264

General

Start time (UTC):	07:52:16
Start date (UTC):	05/01/2025
Path:	/tmp/c.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: dash PID: 6283, Parent PID: 4331

General

Start time (UTC):	07:52:30
Start date (UTC):	05/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6283, Parent PID: 4331

General

Start time (UTC):	07:52:30
Start date (UTC):	05/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.4KRc4jI7iT /tmp/tmp.AYUwNAWMjD /tmp/tmp.chVd6B7uiG
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6284, Parent PID: 4331

General

Start time (UTC):	07:52:30
Start date (UTC):	05/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6284, Parent PID: 4331

General

Start time (UTC):	07:52:30
Start date (UTC):	05/01/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.4KRc4jI7iT /tmp/tmp.AYUwNAWMjD /tmp/tmp.chVd6B7uiG
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report c.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.vm08qA (deleted)

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: c.elf PID: 6260, Parent PID: 6185

General

Chronological Activities

Analysis Process: c.elf PID: 6262, Parent PID: 6260

General

Chronological Activities

Analysis Process: c.elf PID: 6264, Parent PID: 6260

General

Chronological Activities

Analysis Process: c.elf PID: 6266, Parent PID: 6264

General

Chronological Activities

Analysis Process: dash PID: 6283, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6283, Parent PID: 4331

General

Chronological Activities

Linux Analysis Report
c.elf