Play interactive tour

Edit tour

Linux Analysis Report 7r4phwK4EY

Overview

General Information

Sample Name:	7r4phwK4EY
Analysis ID:	534001
MD5:	55a143ca8c7d1e9f511d313ff6009f43
SHA1:	1e9d9222e1c61471a213f7e2e6ee4aec9a3423f4
SHA256:	32d108e9f2885bb81fbcec251a4c01c0530b48a5c10eb25820807f8c3330e1aa
Tags:	32elfgafgytsparc
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Contains symbols with names commonly found in malware

Opens /proc/net/* files useful for finding connected devices and routers

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	534001
Start date:	04.12.2021
Start time:	22:57:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7r4phwK4EY
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal72.spre.troj.lin@0/1@0/0

Process Tree

system is lnxubuntu20

7r4phwK4EY (PID: 5219, Parent: 5116, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/7r4phwK4EY

7r4phwK4EY New Fork (PID: 5222, Parent: 5219)

7r4phwK4EY New Fork (PID: 5223, Parent: 5219)

7r4phwK4EY New Fork (PID: 5226, Parent: 5223)

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
7r4phwK4EY	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5222.1.000000002d672358.0000000056ce449d.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5223.1.000000002d672358.0000000056ce449d.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5219.1.000000002d672358.0000000056ce449d.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: 7r4phwK4EY

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: 7r4phwK4EY	Virustotal: Detection: 61%			Perma Link
Source: 7r4phwK4EY	ReversingLabs: Detection: 60%

Spreading:

Opens /proc/net/* files useful for finding connected devices and routers

Show sources

Source: /tmp/7r4phwK4EY (PID: 5219)

Opens: /proc/net/route

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:35716 -> 96.8.118.142:888

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 218.23.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 218.23.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 218.23.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 218.23.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 218.23.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 218.23.170.240
Source: unknown	TCP traffic detected without corresponding DNS query: 68.180.106.147
Source: unknown	TCP traffic detected without corresponding DNS query: 68.180.106.147
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.153.251.53
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 96.8.118.142
Source: unknown	TCP traffic detected without corresponding DNS query: 170.39.121.65
Source: unknown	TCP traffic detected without corresponding DNS query: 170.39.121.65
Source: unknown	TCP traffic detected without corresponding DNS query: 123.22.50.195
Source: unknown	TCP traffic detected without corresponding DNS query: 123.22.50.195
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 14.231.93.121
Source: unknown	TCP traffic detected without corresponding DNS query: 14.231.93.121
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 211.138.12.155
Source: unknown	TCP traffic detected without corresponding DNS query: 207.170.200.34
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 204.29.87.251
Source: unknown	TCP traffic detected without corresponding DNS query: 204.29.87.251
Source: unknown	TCP traffic detected without corresponding DNS query: 207.170.200.34

System Summary:

Contains symbols with names commonly found in malware

Show sources

Source: ELF static info symbol of initial sample

Name: vseattack

Source: classification engine

Classification label: mal72.spre.troj.lin@0/1@0/0

Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/memchr.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/memcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/memset.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strchr.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strcmp.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strcpy.S
Source: ELF static info symbol of initial sample	FILE: libc/string/sparc/strlen.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/crt1.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/crti.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/crtn.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/fork.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/rem.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/udiv.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/umul.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/urem.S
Source: ELF static info symbol of initial sample	FILE: libc/sysdeps/linux/sparc/vfork.S

Source: /tmp/7r4phwK4EY (PID: 5219)

Queries kernel information via 'uname':

Jump to behavior

Source: 7r4phwK4EY, 5219.1.00000000afd90c06.000000009e9f162e.rw-.sdmp	Binary or memory string: bU/tmp/qemu-open.cnetFQ\
Source: 7r4phwK4EY, 5219.1.00000000332bb906.000000001584c815.rw-.sdmp, 7r4phwK4EY, 5222.1.00000000332bb906.000000001584c815.rw-.sdmp, 7r4phwK4EY, 5223.1.00000000332bb906.000000001584c815.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: 7r4phwK4EY, 5219.1.00000000afd90c06.000000009e9f162e.rw-.sdmp, 7r4phwK4EY, 5222.1.00000000afd90c06.000000009e9f162e.rw-.sdmp, 7r4phwK4EY, 5223.1.00000000afd90c06.000000009e9f162e.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/7r4phwK4EYSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/7r4phwK4EY
Source: 7r4phwK4EY, 5219.1.00000000afd90c06.000000009e9f162e.rw-.sdmp	Binary or memory string: /tmp/qemu-open.cnetFQ
Source: 7r4phwK4EY, 5219.1.00000000332bb906.000000001584c815.rw-.sdmp, 7r4phwK4EY, 5222.1.00000000332bb906.000000001584c815.rw-.sdmp, 7r4phwK4EY, 5223.1.00000000332bb906.000000001584c815.rw-.sdmp	Binary or memory string: LcU!/etc/qemu-binfmt/sparc
Source: 7r4phwK4EY, 5219.1.00000000afd90c06.000000009e9f162e.rw-.sdmp, 7r4phwK4EY, 5222.1.00000000afd90c06.000000009e9f162e.rw-.sdmp, 7r4phwK4EY, 5223.1.00000000afd90c06.000000009e9f162e.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: 7r4phwK4EY, type: SAMPLE
Source: Yara match	File source: 5222.1.000000002d672358.0000000056ce449d.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000002d672358.0000000056ce449d.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5219.1.000000002d672358.0000000056ce449d.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; en) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; ja) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; fr) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Source: Initial sample	User agent string found: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.7
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3; HTC_0PCV2 Build/KTU84L) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/4.0 (compatible; MSIE 8.0; X11; Linux x86_64; pl) Opera 11.00
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:33.0) Gecko/20100101 Firefox/33.0

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: 7r4phwK4EY, type: SAMPLE
Source: Yara match	File source: 5222.1.000000002d672358.0000000056ce449d.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000002d672358.0000000056ce449d.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5219.1.000000002d672358.0000000056ce449d.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Remote System Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7r4phwK4EY	61%	Virustotal		Browse
7r4phwK4EY	60%	ReversingLabs	Linux.Trojan.LnxGafgyt
7r4phwK4EY	100%	Avira	LINUX/Mirai.Gafgyt.

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
37.112.203.140	unknown	Russian Federation	50544	KRSK-ASRU	false
218.23.170.240	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
68.180.106.147	unknown	United States	23473	PAVLOVMEDIAUS	false
123.22.50.195	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
149.62.33.230	unknown	Moldova Republic of	205124	AS_TELEHOST_COLOMD	false
170.39.121.65	unknown	Reserved	139776	PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	false
41.60.254.245	unknown	Mauritius	30844	LIQUID-ASGB	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
39.153.251.53	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
177.101.125.251	unknown	Brazil	28343	UnifiqueTelecomunicacoesSABR	false
151.247.234.89	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
204.29.87.251	unknown	United States	3464	ASC-NETUS	false
96.8.118.142	unknown	United States	36352	AS-COLOCROSSINGUS	false
14.231.93.121	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
207.170.200.34	unknown	United States	3549	LVLT-3549US	false
211.138.12.155	unknown	China	24547	CMNET-V4HEBEI-AS-APHebeiMobileCommunicationCompanyLimit	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
192.24.49.93	unknown	Canada	393632	NORTHFRONTENACTELCA	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Runtime Messages

Command:	/tmp/7r4phwK4EY
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate alot
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
96.8.118.142	Jqj1JC6iTV	Get hash	malicious	Browse
	5r63A9I65E	Get hash	malicious	Browse
	okSlk77ukP	Get hash	malicious	Browse
	UlyGshHQH7	Get hash	malicious	Browse
	Mwm8dcpFLm	Get hash	malicious	Browse
	3J2pqO4CJg	Get hash	malicious	Browse
	boecvH9kPT	Get hash	malicious	Browse
	HF12iXIw1s	Get hash	malicious	Browse
	jShM26Wk9S	Get hash	malicious	Browse
	Ys7cAWlueZ	Get hash	malicious	Browse
	vhXv9WCcUP	Get hash	malicious	Browse
109.202.202.202	Jqj1JC6iTV	Get hash	malicious	Browse
	5r63A9I65E	Get hash	malicious	Browse
	okSlk77ukP	Get hash	malicious	Browse
	UlyGshHQH7	Get hash	malicious	Browse
	Mwm8dcpFLm	Get hash	malicious	Browse
	3J2pqO4CJg	Get hash	malicious	Browse
	boecvH9kPT	Get hash	malicious	Browse
	HF12iXIw1s	Get hash	malicious	Browse
	jShM26Wk9S	Get hash	malicious	Browse
	Ys7cAWlueZ	Get hash	malicious	Browse
	vhXv9WCcUP	Get hash	malicious	Browse
	W8yV7WFCIU	Get hash	malicious	Browse
	d7K2OhcXWg	Get hash	malicious	Browse
	fIdlkDg4Qp	Get hash	malicious	Browse
	Z61xEj8L2W	Get hash	malicious	Browse
	ldlUEV6DUs	Get hash	malicious	Browse
	brew6iolUh	Get hash	malicious	Browse
	35XtKQI4s6	Get hash	malicious	Browse
	RSidfQIt8z	Get hash	malicious	Browse
	QdHQRBrY5d	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PAVLOVMEDIAUS	arm	Get hash	malicious	Browse	153.33.164.91
	mslAh6wHM1	Get hash	malicious	Browse	153.33.164.77
	OX7P0jzNP3	Get hash	malicious	Browse	173.230.98.66
	arm7	Get hash	malicious	Browse	68.180.10.90
	z0r0.x86	Get hash	malicious	Browse	68.180.10.70
	MLEdqapxkp	Get hash	malicious	Browse	68.180.10.31
	c0az1l4js3001lsk4xd9n.arm7	Get hash	malicious	Browse	68.180.22.75
	1a2COTxMvU	Get hash	malicious	Browse	173.230.62.47
	x86-20211110-0150	Get hash	malicious	Browse	153.33.164.97
	IYcCOLfGT7	Get hash	malicious	Browse	68.180.10.95
	sora.x86	Get hash	malicious	Browse	173.230.62.72
	hoho.arm	Get hash	malicious	Browse	68.234.199.87
	jew.arm5	Get hash	malicious	Browse	68.180.106.197
	test	Get hash	malicious	Browse	68.180.106.223
	20F1Zm7jIv	Get hash	malicious	Browse	68.180.22.78
	RIkJg4Hr71	Get hash	malicious	Browse	68.234.175.56
	ZvUMlvUmXk.exe	Get hash	malicious	Browse	96.63.223.221
	x86	Get hash	malicious	Browse	173.230.62.52
	JTK6FuIRrg	Get hash	malicious	Browse	66.253.217.185
	pandora.x86	Get hash	malicious	Browse	173.230.86.58
KRSK-ASRU	mF0Mqdkjfz	Get hash	malicious	Browse	188.235.231.172
	arm-20211007-1618	Get hash	malicious	Browse	188.235.231.155
	eIVmKpMZ0u	Get hash	malicious	Browse	188.235.231.179
CHINANET-BACKBONENo31Jin-rongStreetCN	61KiF94nKN	Get hash	malicious	Browse	115.234.54.210
	GuSrMsLH0y	Get hash	malicious	Browse	117.61.24.133
	eBEMdu87IG	Get hash	malicious	Browse	123.102.255.173
	e8cvIYg1a3	Get hash	malicious	Browse	183.148.55.33
	wCEe6Y5TGI	Get hash	malicious	Browse	114.103.95.193
	Xp9AXIBaBp	Get hash	malicious	Browse	220.171.47.13
	arm7	Get hash	malicious	Browse	36.45.183.121
	x86	Get hash	malicious	Browse	36.17.108.251
	Z61xEj8L2W	Get hash	malicious	Browse	218.23.219.155
	6HqEN5iAMB	Get hash	malicious	Browse	183.13.94.217
	rELGr0VELq	Get hash	malicious	Browse	113.242.217.208
	sora.x86	Get hash	malicious	Browse	222.245.195.52
	SnSN0iXPsF	Get hash	malicious	Browse	106.111.168.25
	NNoG9EuSVV	Get hash	malicious	Browse	223.147.25.146
	oNQGFI5lP0	Get hash	malicious	Browse	125.73.86.187
	ThhBCrYJCm	Get hash	malicious	Browse	113.75.249.118
	R5UqytMpoF	Get hash	malicious	Browse	222.209.131.142
	sora.x86	Get hash	malicious	Browse	183.144.166.164
	sora.arm7	Get hash	malicious	Browse	182.102.24.7
	sora.arm	Get hash	malicious	Browse	139.189.127.207

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

/tmp/qemu-open.cnetFQ (deleted) Download File
Process:	/tmp/7r4phwK4EY
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.709552666863289
Encrypted:	false
SSDEEP:	6:iekrEcvwAsE5KlwSd4pzKaV6Lpms/a/1VCxGF:ur+m5MwSdIKaV6L1adVRF
MD5:	2E667F43AE18CD1FE3C108641708A82C
SHA1:	12B90DE2DA0FBCFE66F3D6130905E56C8D6A68D3
SHA-256:	6F721492E7A337C5B498A8F55F5EB7AC745AFF716D0B5B08EFF2C1B6B250F983
SHA-512:	D2A0EE2509154EC1098994F38BE172F98F4150399C534A04D5C675D7C05630802225019F19344CC9070C576BC465A4FEB382AC7712DE6BF25E9244B54A9DB830
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Iface.Destination.Gateway .Flags.RefCnt.Use.Metric.Mask..MTU.Window.IRTT .ens160.00000000.c0a80201.0003.0.0.0.00000000.0.0.0.ens160.c0a80200.00000000.0001.0.0.0.ffffff00.0.0.0.

Static File Info

General
File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.070330618067625
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	7r4phwK4EY
File size:	129856
MD5:	55a143ca8c7d1e9f511d313ff6009f43
SHA1:	1e9d9222e1c61471a213f7e2e6ee4aec9a3423f4
SHA256:	32d108e9f2885bb81fbcec251a4c01c0530b48a5c10eb25820807f8c3330e1aa
SHA512:	b3d0f9c8b71b8aaea41f1f0fe29ea06cbd11d558db251f09d39eb46c33e7eff904e3239f25f4c1b7cd5fefa6b31f8f516798cfb1ee8afb041c08bdd300ada294
SSDEEP:	3072:wsrp9xV+GZTZepNPhj+e3fSqPUL7ymm/QMurB1nKGNb:SMQplVUamm/QMurB1nKGNb
File Content Preview:	.ELF...........................4.........4. ...(.......................................................@..h.........dt.Q................................@..(....@.QW................#.....a ..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	107016
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100b0	0xb0	0x14594	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x24644	0x14644	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x24658	0x14658	0x4680	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x28cd8	0x18cd8	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x38cdc	0x18cdc	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x38ce4	0x18ce4	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x38cec	0x18cec	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x38cf0	0x18cf0	0x42c	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x39120	0x1911c	0x6468	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1911c	0xb2e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x19c4a	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x19c6a	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x19c89	0x16e	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x19df7	0xfb	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x19ef2	0x7c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x19f70	0x28	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x19f98	0x10b	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1a0a3	0x6e	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1a111	0x18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a129	0xdc	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1a5c8	0x30b0	0x10	0x0		23	287	4
.strtab	STRTAB	0x0	0x1d678	0x24c8	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x18cdc	0x18cdc	3.7760	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x18cdc	0x38cdc	0x38cdc	0x440	0x68ac	1.9519	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x24644	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x24658	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x28cd8	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x38cdc	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x38ce4	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x38cec	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x38cf0	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x39120	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
.rem	.symtab	0x1a6c0	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x1a6a0	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x1a6b4	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x1a680	32	FUNC	<unknown>	DEFAULT	2
C.151.5681	.symtab	0x26af0	40	OBJECT	<unknown>	DEFAULT	4
KHcommSOCK	.symtab	0x39140	4	OBJECT	<unknown>	DEFAULT	10
KHserverHACKER	.symtab	0x38da0	4	OBJECT	<unknown>	DEFAULT	9
LOCAL_ADDR	.symtab	0x3f3c8	4	OBJECT	<unknown>	DEFAULT	10
Q	.symtab	0x39160	16384	OBJECT	<unknown>	DEFAULT	10
UserAgents	.symtab	0x38d10	144	OBJECT	<unknown>	DEFAULT	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x38ce0	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x38cdc	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x38db4	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x27568	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x39114	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x289d8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x38dbc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x27868	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x38ce8	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x38ce4	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x28cd8	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x28cd8	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x38db4	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x27568	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x39114	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x289d8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x38dbc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x27868	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x38db8	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x39118	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x38dc0	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x1ade8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1e724	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x206c8	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x1aac8	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x20094	132	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x2016c	104	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1e744	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1a7d8	64	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x223d8	316	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x1fbb0	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x1fbb0	24	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x22530	60	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1a860	68	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1ec94	76	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x1a8a4	72	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x3f39c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x1fe08	152	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x20488	76	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1fd88	128	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x22608	324	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x22e1c	420	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x22ca4	100	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x22fc0	192	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x2274c	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1a618	52	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1bfe8	60	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x22764	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x22788	272	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1c024	176	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1a8ec	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x204d4	64	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1a914	64	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x20514	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname	.symtab	0x1e958	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1e994	768	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1a954	64	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1a9d4	72	FUNC	<unknown>	HIDDEN	2
__GI_getsockname	.symtab	0x1ece0	76	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x20554	64	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x3f3a0	4	OBJECT	<unknown>	HIDDEN	10
__GI_inet_addr	.symtab	0x1e930	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x21800	220	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x23764	684	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x233a0	544	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x1facc	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1aa1c	100	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1e878	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1aa80	72	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x240dc	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x214ec	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1c700	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1c11c	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x21604	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x21624	272	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1d7a8	416	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x20594	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1aac8	120	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x1ab58	68	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x225bc	76	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x240c4	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1f6cc	80	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x1f94c	156	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x23080	204	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1abf0	76	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1ed80	32	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x1eda0	88	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x205dc	84	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1ac3c	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1edf8	32	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1ee18	88	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1ee70	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1f828	292	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x22338	160	FUNC	<unknown>	HIDDEN	2
__GI_sigaddset	.symtab	0x1eee8	56	FUNC	<unknown>	HIDDEN	2
__GI_sigemptyset	.symtab	0x1ef20	32	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1ef40	188	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1ac90	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x1fea0	428	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1ee9c	76	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1ae2c	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x1f9e8	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x242b8	92	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1d9bc	524	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1dd1c	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1dd1c	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1e00c	804	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x2329c	56	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1e398	120	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x2314c	224	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1e410	248	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1e508	252	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x217b0	80	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1dbc8	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x2322c	112	FUNC	<unknown>	HIDDEN	2
__GI_strstr	.symtab	0x1e604	288	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1e860	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x21734	124	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x1fbc8	20	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1e898	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1ad1c	72	FUNC	<unknown>	HIDDEN	2
__GI_times	.symtab	0x20630	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x2414c	36	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1adc4	36	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x1a64c	52	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1ae60	156	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x20678	80	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1ad64	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x206d4	72	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x20738	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x2071c	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1ad78	76	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x38cec	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x38cec	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x3f390	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x390c4	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x1ef40	188	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x3911c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x20128	68	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x38db8	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x39118	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x38dc0	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x3f3c4	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x38cf8	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x23c98	240	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x243b8	196	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x23b2c	208	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x218dc	1852	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x245fc	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x38cf0	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x24314	164	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x23a10	284	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x23bfc	120	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x3f388	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x1ade8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x3f380	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__get_hosts_byname_r	.symtab	0x22300	56	FUNC	<unknown>	HIDDEN	2
__glibc_strerror_r	.symtab	0x1e724	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x206c8	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x1f42c	160	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1f4cc	156	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1f5b0	268	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1f568	48	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1f598	24	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__length_dotted	.symtab	0x2447c	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x23c74	36	FUNC	<unknown>	HIDDEN	2
__libc_close	.symtab	0x1a860	68	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1ec94	76	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x1ab40	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1a618	52	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x1a954	64	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x240dc	112	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x20594	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1aac8	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x225bc	76	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1abf0	76	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1ed80	32	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x1eda0	88	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1ac3c	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1edf8	32	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1ee18	88	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x22338	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x3f384	4	OBJECT	<unknown>	DEFAULT	10
__libc_waitpid	.symtab	0x1ad64	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1ad78	76	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x38f00	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x3f368	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x3f544	24	OBJECT	<unknown>	DEFAULT	10
__muldi3	.symtab	0x1a544	212	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x3f56c	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x3f578	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x23d88	56	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x22018	744	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x3f38c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x38cdc	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x20118	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x20120	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x240c4	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x23dc0	772	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x390e4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x3f394	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x3f55c	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x3f57c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x1f024	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1f050	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1effc	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x20440	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x38dd0	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x244c4	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x207f4	196	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x22898	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x208b8	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1af5c	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3860	.symtab	0x27b68	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x2452c	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x22c70	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x24564	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x209f8	252	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1b028	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x38dd4	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x2256c	80	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x20094	132	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x2016c	104	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x201d4	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x214ec	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x390dc	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x1a64c	52	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1e744	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x1b060	60	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x22514	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x3f580	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x3f584	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x3911c	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x3f588	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x3f39c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x1a7d8	64	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x24644	8	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x3d180	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1b09c	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x20cf8	1908	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x3f3a0	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x10094	8	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x20af4	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1b798	164	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1baa0	1352	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1b83c	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1b878	480	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1ba58	72	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x20120	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x20120	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x3f4c4	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x101a4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x22994	732	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1aefc	96	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x38dd8	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x38ddc	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x22d08	276	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x3d17c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x38df4	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x3d178	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x38e10	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x1af78	176	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x38e0c	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x1fbdc	428	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x20b84	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x27cc8	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x20bc0	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1b11c	1660	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x223d8	316	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
access	.symtab	0x1a818	72	FUNC	<unknown>	DEFAULT	2
access.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
acnc	.symtab	0x148cc	236	FUNC	<unknown>	DEFAULT	2
add_entry	.symtab	0x19374	140	FUNC	<unknown>	DEFAULT	2
atoi	.symtab	0x1fbb0	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x1fbb0	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
axis_bp	.symtab	0x38d0c	4	OBJECT	<unknown>	DEFAULT	9
bcopy	.symtab	0x1c110	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x3f3c0	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2818	.symtab	0x3f398	4	OBJECT	<unknown>	DEFAULT	10
brk	.symtab	0x22530	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1ef40	188	FUNC	<unknown>	DEFAULT	2
buf.4861	.symtab	0x3f188	460	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x1d774	52	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x38da8	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x24638	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1012c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x10198	0	FUNC	<unknown>	DEFAULT	2
calloc	.symtab	0x1f1bc	112	FUNC	<unknown>	DEFAULT	2
calloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
checksum_generic	.symtab	0x101dc	224	FUNC	<unknown>	DEFAULT	2
checksum_tcp_udp	.symtab	0x102bc	468	FUNC	<unknown>	DEFAULT	2
checksum_tcpudp	.symtab	0x10490	468	FUNC	<unknown>	DEFAULT	2
clock	.symtab	0x1adf4	56	FUNC	<unknown>	DEFAULT	2
clock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1a860	68	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2248	.symtab	0x39120	1	OBJECT	<unknown>	DEFAULT	10
connect	.symtab	0x1ec94	76	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
connectTimeout	.symtab	0x12400	672	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x1ab40	24	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x128b0	312	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x38cf8	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dup2	.symtab	0x1a8a4	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
environ	.symtab	0x3f388	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x3f39c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x27c38	126	OBJECT	<unknown>	DEFAULT	4
execl	.symtab	0x1fe08	152	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x20488	76	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x1fd88	128	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x288d0	72	OBJECT	<unknown>	DEFAULT	4
fclose	.symtab	0x22608	324	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1a6ec	136	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x1a774	100	FUNC	<unknown>	DEFAULT	2
fdgets	.symtab	0x11c54	224	FUNC	<unknown>	DEFAULT	2
fdopen_pids	.symtab	0x3d160	4	OBJECT	<unknown>	DEFAULT	10
fdpclose	.symtab	0x11a84	464	FUNC	<unknown>	DEFAULT	2
fdpopen	.symtab	0x1174c	824	FUNC	<unknown>	DEFAULT	2
fflush_unlocked	.symtab	0x22e1c	420	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x22ca4	100	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x22fc0	192	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
findRandIP	.symtab	0x12850	96	FUNC	<unknown>	DEFAULT	2
fmt	.symtab	0x288b8	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x2274c	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1a618	52	FUNC	<unknown>	DEFAULT	2
fputs_unlocked	.symtab	0x1bfe8	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10138	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1f22c	232	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseek	.symtab	0x22764	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x22764	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x22788	272	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1c024	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getBuild	.symtab	0x175a8	16	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x11fc4	100	FUNC	<unknown>	DEFAULT	2
getOurIP	.symtab	0x17234	884	FUNC	<unknown>	DEFAULT	2
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x24170	328	FUNC	<unknown>	DEFAULT	2
getdtablesize	.symtab	0x1a8ec	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x204d4	64	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x1a914	64	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x20514	64	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname	.symtab	0x1e958	60	FUNC	<unknown>	DEFAULT	2
gethostbyname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x1e994	768	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1a954	64	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1a994	64	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1a9d4	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockname	.symtab	0x1ece0	76	FUNC	<unknown>	DEFAULT	2
getsockname.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1ed2c	84	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x20554	64	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h.4860	.symtab	0x3f354	20	OBJECT	<unknown>	DEFAULT	10
h_errno	.symtab	0x3f3a0	4	OBJECT	<unknown>	DEFAULT	10
hacks	.symtab	0x38cfc	4	OBJECT	<unknown>	DEFAULT	9
hacks2	.symtab	0x38d00	4	OBJECT	<unknown>	DEFAULT	9
hacks3	.symtab	0x38d04	4	OBJECT	<unknown>	DEFAULT	9
hacks4	.symtab	0x38d08	4	OBJECT	<unknown>	DEFAULT	9
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
hextable	.symtab	0x2539c	1024	OBJECT	<unknown>	DEFAULT	4
htonl	.symtab	0x1e91c	8	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1e924	12	FUNC	<unknown>	DEFAULT	2
httphex	.symtab	0x14b04	1044	FUNC	<unknown>	DEFAULT	2
i.4436	.symtab	0x38dac	4	OBJECT	<unknown>	DEFAULT	9
index	.symtab	0x1d9bc	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1e930	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x21800	220	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntop	.symtab	0x23764	684	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x235c0	420	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x233a0	544	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x232d4	204	FUNC	<unknown>	DEFAULT	2
initConnection	.symtab	0x16f80	692	FUNC	<unknown>	DEFAULT	2
init_rand	.symtab	0x107ec	228	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x38f08	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x1f77c	96	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x1facc	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1aa1c	100	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1e878	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
kill	.symtab	0x1aa80	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killer_status	.symtab	0x39150	4	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/fork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/rem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/udiv.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/umul.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/urem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
listFork	.symtab	0x126a0	432	FUNC	<unknown>	DEFAULT	2
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x240dc	112	FUNC	<unknown>	DEFAULT	2
macAddress	.symtab	0x39158	6	OBJECT	<unknown>	DEFAULT	10
main	.symtab	0x175b8	2892	FUNC	<unknown>	DEFAULT	2
main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
makeIPPacket	.symtab	0x12adc	220	FUNC	<unknown>	DEFAULT	2
makeRandomStr	.symtab	0x12090	128	FUNC	<unknown>	DEFAULT	2
makevsepacket	.symtab	0x14080	244	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1f07c	320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memchr	.symtab	0x214ec	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1c700	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1c11c	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x21604	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x21624	272	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1d7a8	416	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x39010	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x3f3a4	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x390fc	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x20594	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
next_start.1092	.symtab	0x3f180	4	OBJECT	<unknown>	DEFAULT	10
ngPid	.symtab	0x3f3d0	4	OBJECT	<unknown>	DEFAULT	10
ntohl	.symtab	0x1e908	8	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1e910	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
numpids	.symtab	0x39148	8	OBJECT	<unknown>	DEFAULT	10
object.2329	.symtab	0x39124	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x1aac8	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ourIP	.symtab	0x3f3cc	4	OBJECT	<unknown>	DEFAULT	10
p.2246	.symtab	0x38cf4	0	OBJECT	<unknown>	DEFAULT	9
parseHex	.symtab	0x11d34	136	FUNC	<unknown>	DEFAULT	2
pids	.symtab	0x3f3d8	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x1ab58	68	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x225bc	76	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prctl	.symtab	0x1ab9c	84	FUNC	<unknown>	DEFAULT	2
prctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
prefix.4072	.symtab	0x27b90	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x11140	1144	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x10d00	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10f28	536	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x10d6c	444	FUNC	<unknown>	DEFAULT	2
processCmd	.symtab	0x14f18	8296	FUNC	<unknown>	DEFAULT	2
qual_chars.4078	.symtab	0x27ba8	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x240c4	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1f6bc	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand__str	.symtab	0x18290	256	FUNC	<unknown>	DEFAULT	2
rand_alpha_str	.symtab	0x18390	188	FUNC	<unknown>	DEFAULT	2
rand_alphastr	.symtab	0x10bbc	324	FUNC	<unknown>	DEFAULT	2
rand_cmwc	.symtab	0x10a58	356	FUNC	<unknown>	DEFAULT	2
rand_init	.symtab	0x18104	160	FUNC	<unknown>	DEFAULT	2
rand_next	.symtab	0x181a4	236	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1f6cc	80	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x28840	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x1f94c	156	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randtbl	.symtab	0x39044	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x23080	204	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x1abf0	76	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realloc	.symtab	0x1f314	280	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recv	.symtab	0x1ed80	32	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvLine	.symtab	0x12110	752	FUNC	<unknown>	DEFAULT	2
recvfrom	.symtab	0x1eda0	88	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
resolv_domain_to_hostname	.symtab	0x1844c	292	FUNC	<unknown>	DEFAULT	2
resolv_entries_free	.symtab	0x18fe4	88	FUNC	<unknown>	DEFAULT	2
resolv_lookup	.symtab	0x18674	2416	FUNC	<unknown>	DEFAULT	2
resolv_skip_name	.symtab	0x18570	260	FUNC	<unknown>	DEFAULT	2
rindex	.symtab	0x1dbc8	192	FUNC	<unknown>	DEFAULT	2
rtcp	.symtab	0x13998	1292	FUNC	<unknown>	DEFAULT	2
sbrk	.symtab	0x205dc	84	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x3f3d4	4	OBJECT	<unknown>	DEFAULT	10
select	.symtab	0x1ac3c	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1edf8	32	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendSTD	.symtab	0x13ea4	476	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1ee18	88	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1ee70	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1f71c	96	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1f828	292	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x22338	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigaddset	.symtab	0x1eee8	56	FUNC	<unknown>	DEFAULT	2
sigaddset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigempty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigemptyset	.symtab	0x1ef20	32	FUNC	<unknown>	DEFAULT	2
signal	.symtab	0x1ef40	188	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x1ac90	140	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x1fea0	428	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket	.symtab	0x1ee9c	76	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x149b8	332	FUNC	<unknown>	DEFAULT	2
sockprintf	.symtab	0x1165c	240	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4077	.symtab	0x27bbc	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4071	.symtab	0x27ba0	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4074	.symtab	0x27bf0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4073	.symtab	0x27c08	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4076	.symtab	0x27bcc	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4075	.symtab	0x27be0	9	OBJECT	<unknown>	DEFAULT	4
sprintf	.symtab	0x1ae2c	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x1f7dc	76	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x1f7dc	76	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x1f9e8	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x390e0	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x3f3bc	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x38dcc	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x38dc4	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x38dc8	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x242b8	92	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x1d9bc	524	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x1dd1c	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1dd1c	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1e00c	804	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x2329c	56	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1e744	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1e398	120	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x2314c	224	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1e410	248	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1e508	252	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x217b0	80	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x1dbc8	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x2322c	112	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strstr	.symtab	0x1e604	288	FUNC	<unknown>	DEFAULT	2
strstr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1e860	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x21734	124	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x1fbc8	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x11608	84	FUNC	<unknown>	DEFAULT	2
table	.symtab	0x3f3dc	232	OBJECT	<unknown>	DEFAULT	10
table.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
table_init	.symtab	0x1903c	568	FUNC	<unknown>	DEFAULT	2
table_key	.symtab	0x38db0	4	OBJECT	<unknown>	DEFAULT	9
table_lock_val	.symtab	0x192c0	76	FUNC	<unknown>	DEFAULT	2
table_retrieve_val	.symtab	0x1930c	104	FUNC	<unknown>	DEFAULT	2
table_unlock_val	.symtab	0x19274	76	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1e898	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcpFl00d	.symtab	0x132bc	1756	FUNC	<unknown>	DEFAULT	2
tcpcsum	.symtab	0x129e8	244	FUNC	<unknown>	DEFAULT	2
time	.symtab	0x1ad1c	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
times	.symtab	0x20630	72	FUNC	<unknown>	DEFAULT	2
times.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toggle_obf	.symtab	0x19400	384	FUNC	<unknown>	DEFAULT	2
tolower	.symtab	0x2414c	36	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
toupper	.symtab	0x1adc4	36	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
trim	.symtab	0x108d0	392	FUNC	<unknown>	DEFAULT	2
type_codes	.symtab	0x27c10	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x27c28	12	OBJECT	<unknown>	DEFAULT	4
udpfl00d	.symtab	0x12bb8	1796	FUNC	<unknown>	DEFAULT	2
unknown.1115	.symtab	0x27cb8	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x39028	28	OBJECT	<unknown>	DEFAULT	9
uppercase	.symtab	0x12028	104	FUNC	<unknown>	DEFAULT	2
userID	.symtab	0x38da4	4	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x2004c	72	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
util_atoi	.symtab	0x19994	832	FUNC	<unknown>	DEFAULT	2
util_fdgets	.symtab	0x1a258	252	FUNC	<unknown>	DEFAULT	2
util_isalpha	.symtab	0x1a3b8	148	FUNC	<unknown>	DEFAULT	2
util_isdigit	.symtab	0x1a4e0	100	FUNC	<unknown>	DEFAULT	2
util_isspace	.symtab	0x1a44c	148	FUNC	<unknown>	DEFAULT	2
util_isupper	.symtab	0x1a354	100	FUNC	<unknown>	DEFAULT	2
util_itoa	.symtab	0x19cd4	472	FUNC	<unknown>	DEFAULT	2
util_local_addr	.symtab	0x1a170	232	FUNC	<unknown>	DEFAULT	2
util_memcpy	.symtab	0x198c4	120	FUNC	<unknown>	DEFAULT	2
util_memsearch	.symtab	0x19eac	260	FUNC	<unknown>	DEFAULT	2
util_strcat	.symtab	0x19838	140	FUNC	<unknown>	DEFAULT	2
util_strcmp	.symtab	0x196f8	240	FUNC	<unknown>	DEFAULT	2
util_strcpy	.symtab	0x197e8	80	FUNC	<unknown>	DEFAULT	2
util_stristr	.symtab	0x19fb0	448	FUNC	<unknown>	DEFAULT	2
util_strlen	.symtab	0x19580	112	FUNC	<unknown>	DEFAULT	2
util_strncmp	.symtab	0x195f0	264	FUNC	<unknown>	DEFAULT	2
util_zero	.symtab	0x1993c	88	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x1a64c	52	FUNC	<unknown>	DEFAULT	2
vseattack	.symtab	0x14174	1880	FUNC	<unknown>	DEFAULT	2
vsnprintf	.symtab	0x1ae60	156	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
w	.symtab	0x3d174	4	OBJECT	<unknown>	DEFAULT	10
wait4	.symtab	0x20678	80	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1ad64	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
watchdog_maintain	.symtab	0x10664	392	FUNC	<unknown>	DEFAULT	2
watchdog_pid	.symtab	0x39144	4	OBJECT	<unknown>	DEFAULT	10
wcrtomb	.symtab	0x206d4	72	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x20738	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x2071c	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wildString	.symtab	0x11dbc	520	FUNC	<unknown>	DEFAULT	2
write	.symtab	0x1ad78	76	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
x	.symtab	0x3d168	4	OBJECT	<unknown>	DEFAULT	10
xdigits.3071	.symtab	0x28990	17	OBJECT	<unknown>	DEFAULT	4
y	.symtab	0x3d16c	4	OBJECT	<unknown>	DEFAULT	10
z	.symtab	0x3d170	4	OBJECT	<unknown>	DEFAULT	10
zprintf	.symtab	0x115b8	80	FUNC	<unknown>	DEFAULT	2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2021 22:58:22.504533052 CET	23	40192	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:22.504589081 CET	23	40192	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:22.504617929 CET	23	40192	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:22.504636049 CET	40192	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:22.504688025 CET	40192	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:22.504694939 CET	40192	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:22.639035940 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:22.756706953 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:58:22.756831884 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:22.866075993 CET	23	40234	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:22.866123915 CET	23	40234	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:22.866149902 CET	23	40234	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:22.866183043 CET	40234	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:22.866199017 CET	40234	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:22.866203070 CET	40234	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:23.325565100 CET	42836	443	192.168.2.23	91.189.91.43
Dec 4, 2021 22:58:23.645467043 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:23.763175011 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:58:23.764560938 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:23.764579058 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:23.881855011 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:58:24.093436003 CET	42516	80	192.168.2.23	109.202.202.202
Dec 4, 2021 22:58:25.064558983 CET	23	39588	218.23.170.240	192.168.2.23
Dec 4, 2021 22:58:25.064605951 CET	23	39588	218.23.170.240	192.168.2.23
Dec 4, 2021 22:58:25.064728022 CET	23	39588	218.23.170.240	192.168.2.23
Dec 4, 2021 22:58:25.064800978 CET	39588	23	192.168.2.23	218.23.170.240
Dec 4, 2021 22:58:25.064829111 CET	39588	23	192.168.2.23	218.23.170.240
Dec 4, 2021 22:58:25.064831972 CET	39588	23	192.168.2.23	218.23.170.240
Dec 4, 2021 22:58:26.641210079 CET	23	39822	218.23.170.240	192.168.2.23
Dec 4, 2021 22:58:26.641257048 CET	23	39822	218.23.170.240	192.168.2.23
Dec 4, 2021 22:58:26.641285896 CET	23	39822	218.23.170.240	192.168.2.23
Dec 4, 2021 22:58:26.641580105 CET	39822	23	192.168.2.23	218.23.170.240
Dec 4, 2021 22:58:26.641632080 CET	39822	23	192.168.2.23	218.23.170.240
Dec 4, 2021 22:58:26.641639948 CET	39822	23	192.168.2.23	218.23.170.240
Dec 4, 2021 22:58:27.560800076 CET	23	52476	68.180.106.147	192.168.2.23
Dec 4, 2021 22:58:27.561264038 CET	52476	23	192.168.2.23	68.180.106.147
Dec 4, 2021 22:58:27.563476086 CET	23	52476	68.180.106.147	192.168.2.23
Dec 4, 2021 22:58:27.563776016 CET	52476	23	192.168.2.23	68.180.106.147
Dec 4, 2021 22:58:27.778593063 CET	23	41056	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:27.778640032 CET	23	41056	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:27.778660059 CET	23	41056	39.153.251.53	192.168.2.23
Dec 4, 2021 22:58:27.778934002 CET	41056	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:27.778954029 CET	41056	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:27.778964043 CET	41056	23	192.168.2.23	39.153.251.53
Dec 4, 2021 22:58:31.112567902 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:58:31.112823009 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:31.229882002 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:58:31.230020046 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:58:31.640177965 CET	23	36410	170.39.121.65	192.168.2.23
Dec 4, 2021 22:58:31.640578985 CET	36410	23	192.168.2.23	170.39.121.65
Dec 4, 2021 22:58:31.642040014 CET	23	36410	170.39.121.65	192.168.2.23
Dec 4, 2021 22:58:31.642319918 CET	36410	23	192.168.2.23	170.39.121.65
Dec 4, 2021 22:58:31.740216970 CET	23	55524	123.22.50.195	192.168.2.23
Dec 4, 2021 22:58:31.740259886 CET	23	55524	123.22.50.195	192.168.2.23
Dec 4, 2021 22:58:31.740506887 CET	55524	23	192.168.2.23	123.22.50.195
Dec 4, 2021 22:58:31.740561008 CET	55524	23	192.168.2.23	123.22.50.195
Dec 4, 2021 22:58:35.018883944 CET	23	38856	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:35.018929958 CET	23	38856	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:35.018956900 CET	23	38856	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:35.019201994 CET	38856	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:35.019258022 CET	38856	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:35.019267082 CET	38856	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:36.821485043 CET	23	39224	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:36.821533918 CET	23	39224	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:36.821563005 CET	23	39224	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:36.821751118 CET	39224	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:36.821799040 CET	39224	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:36.821805954 CET	39224	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:38.429316998 CET	43928	443	192.168.2.23	91.189.91.42
Dec 4, 2021 22:58:40.516077042 CET	23	41304	14.231.93.121	192.168.2.23
Dec 4, 2021 22:58:40.516124964 CET	23	41304	14.231.93.121	192.168.2.23
Dec 4, 2021 22:58:40.516491890 CET	41304	23	192.168.2.23	14.231.93.121
Dec 4, 2021 22:58:40.516535044 CET	41304	23	192.168.2.23	14.231.93.121
Dec 4, 2021 22:58:45.123399019 CET	23	41526	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:45.123428106 CET	23	41526	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:45.123518944 CET	23	41526	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:45.123693943 CET	41526	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:45.123739004 CET	41526	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:45.123747110 CET	41526	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:45.979367971 CET	23	42180	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:45.979424953 CET	23	42180	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:45.979446888 CET	23	42180	211.138.12.155	192.168.2.23
Dec 4, 2021 22:58:45.979737997 CET	42180	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:45.979841948 CET	42180	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:45.979871988 CET	42180	23	192.168.2.23	211.138.12.155
Dec 4, 2021 22:58:50.392611980 CET	23	40730	207.170.200.34	192.168.2.23
Dec 4, 2021 22:58:50.392868996 CET	40730	23	192.168.2.23	207.170.200.34
Dec 4, 2021 22:58:50.716984034 CET	42836	443	192.168.2.23	91.189.91.43
Dec 4, 2021 22:58:51.070812941 CET	23	50422	204.29.87.251	192.168.2.23
Dec 4, 2021 22:58:51.070858955 CET	23	50420	204.29.87.251	192.168.2.23
Dec 4, 2021 22:58:51.071054935 CET	50422	23	192.168.2.23	204.29.87.251
Dec 4, 2021 22:58:51.071125031 CET	50420	23	192.168.2.23	204.29.87.251
Dec 4, 2021 22:58:51.398952961 CET	23	41008	207.170.200.34	192.168.2.23
Dec 4, 2021 22:58:51.399185896 CET	41008	23	192.168.2.23	207.170.200.34
Dec 4, 2021 22:58:51.595284939 CET	23	50428	204.29.87.251	192.168.2.23
Dec 4, 2021 22:58:51.595592022 CET	50428	23	192.168.2.23	204.29.87.251
Dec 4, 2021 22:58:53.036951065 CET	23	50426	204.29.87.251	192.168.2.23
Dec 4, 2021 22:58:53.037184954 CET	50426	23	192.168.2.23	204.29.87.251
Dec 4, 2021 22:58:53.251163960 CET	23	59062	149.62.33.230	192.168.2.23
Dec 4, 2021 22:58:53.251476049 CET	59062	23	192.168.2.23	149.62.33.230
Dec 4, 2021 22:58:53.252587080 CET	23	59056	149.62.33.230	192.168.2.23
Dec 4, 2021 22:58:53.252721071 CET	59056	23	192.168.2.23	149.62.33.230
Dec 4, 2021 22:58:53.256978035 CET	23	59064	149.62.33.230	192.168.2.23
Dec 4, 2021 22:58:53.257154942 CET	59064	23	192.168.2.23	149.62.33.230
Dec 4, 2021 22:58:54.813020945 CET	42516	80	192.168.2.23	109.202.202.202
Dec 4, 2021 22:58:58.099647045 CET	23	48930	37.112.203.140	192.168.2.23
Dec 4, 2021 22:58:58.099697113 CET	23	48906	37.112.203.140	192.168.2.23
Dec 4, 2021 22:58:58.099725962 CET	23	48914	37.112.203.140	192.168.2.23
Dec 4, 2021 22:58:58.100003004 CET	48906	23	192.168.2.23	37.112.203.140
Dec 4, 2021 22:58:58.100013018 CET	48930	23	192.168.2.23	37.112.203.140
Dec 4, 2021 22:58:58.100028038 CET	48914	23	192.168.2.23	37.112.203.140
Dec 4, 2021 22:59:07.577441931 CET	23	51548	177.101.125.251	192.168.2.23
Dec 4, 2021 22:59:07.577497005 CET	23	51528	177.101.125.251	192.168.2.23
Dec 4, 2021 22:59:07.577516079 CET	23	51530	177.101.125.251	192.168.2.23
Dec 4, 2021 22:59:07.577816963 CET	51528	23	192.168.2.23	177.101.125.251
Dec 4, 2021 22:59:07.577846050 CET	51548	23	192.168.2.23	177.101.125.251
Dec 4, 2021 22:59:07.577867031 CET	51530	23	192.168.2.23	177.101.125.251
Dec 4, 2021 22:59:14.057524920 CET	23	34430	41.60.254.245	192.168.2.23
Dec 4, 2021 22:59:14.057939053 CET	34430	23	192.168.2.23	41.60.254.245
Dec 4, 2021 22:59:14.708925009 CET	23	34446	41.60.254.245	192.168.2.23
Dec 4, 2021 22:59:14.709254026 CET	34446	23	192.168.2.23	41.60.254.245
Dec 4, 2021 22:59:14.938836098 CET	23	34456	41.60.254.245	192.168.2.23
Dec 4, 2021 22:59:14.939105034 CET	34456	23	192.168.2.23	41.60.254.245
Dec 4, 2021 22:59:19.388703108 CET	43928	443	192.168.2.23	91.189.91.42
Dec 4, 2021 22:59:20.838296890 CET	23	34974	151.247.234.89	192.168.2.23
Dec 4, 2021 22:59:20.838529110 CET	23	34992	151.247.234.89	192.168.2.23
Dec 4, 2021 22:59:20.838668108 CET	34992	23	192.168.2.23	151.247.234.89
Dec 4, 2021 22:59:20.838716984 CET	34974	23	192.168.2.23	151.247.234.89
Dec 4, 2021 22:59:20.843199015 CET	23	34990	151.247.234.89	192.168.2.23
Dec 4, 2021 22:59:20.843456030 CET	34990	23	192.168.2.23	151.247.234.89
Dec 4, 2021 22:59:31.115926981 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:59:31.116117954 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:59:31.233303070 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 22:59:31.233530998 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 22:59:37.363683939 CET	23	52744	192.24.49.93	192.168.2.23
Dec 4, 2021 22:59:37.364142895 CET	52744	23	192.168.2.23	192.24.49.93
Dec 4, 2021 23:00:31.119574070 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 23:00:31.119867086 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 23:00:31.236962080 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 23:00:31.237266064 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 23:01:31.123560905 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 23:01:31.123825073 CET	35716	888	192.168.2.23	96.8.118.142
Dec 4, 2021 23:01:31.241189003 CET	888	35716	96.8.118.142	192.168.2.23
Dec 4, 2021 23:01:31.241415977 CET	35716	888	192.168.2.23	96.8.118.142

System Behavior

Analysis Process: 7r4phwK4EY PID: 5219 Parent PID: 5116

General

Start time:	22:58:21
Start date:	04/12/2021
Path:	/tmp/7r4phwK4EY
Arguments:	/tmp/7r4phwK4EY
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 7r4phwK4EY PID: 5222 Parent PID: 5219

General

Start time:	22:58:22
Start date:	04/12/2021
Path:	/tmp/7r4phwK4EY
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 7r4phwK4EY PID: 5223 Parent PID: 5219

General

Start time:	22:58:22
Start date:	04/12/2021
Path:	/tmp/7r4phwK4EY
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: 7r4phwK4EY PID: 5226 Parent PID: 5223

General

Start time:	22:58:22
Start date:	04/12/2021
Path:	/tmp/7r4phwK4EY
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report 7r4phwK4EY

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

Memory Dumps

Jbx Signature Overview

AV Detection:

Spreading:

Networking:

System Summary:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: 7r4phwK4EY PID: 5219 Parent PID: 5116

General

Chronological Activities

Analysis Process: 7r4phwK4EY PID: 5222 Parent PID: 5219

General

Chronological Activities

Analysis Process: 7r4phwK4EY PID: 5223 Parent PID: 5219

General

Chronological Activities

Analysis Process: 7r4phwK4EY PID: 5226 Parent PID: 5223

General