Edit tour

Linux Analysis Report
sshd.elf

Overview

General Information

Sample name:sshd.elf
Analysis ID:1617652
MD5:f219af8c0dc8fd3385c6a1ae73fe0fc6
SHA1:f800743d4d7cf76a9568da4adb96ade12b6ec9f4
SHA256:dd8d57df26725ee577a5fb8f90945bff74fafa27d1a73e5bf46237bd7175fe59
Tags:elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score:100
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Gafgyt
Yara detected Mirai
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Sample and/or dropped files contains symbols with suspicious names
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1617652
Start date and time:2025-02-18 06:32:14 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 1s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:sshd.elf
Detection:MAL
Classification:mal100.spre.troj.linELF@0/0@2/0
  • VT rate limit hit for: 84.200.154.119:4567
Command:/tmp/sshd.elf
PID:5454
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
BUILD HERAV1
buf: BUILD HERAV1 HERAV1

BUILD HERAV1
buf: BUILD HERAV1 HERAV1

buf: PING

buf: PING
Standard Error:
  • system is lnxubuntu20
  • sshd.elf (PID: 5454, Parent: 5377, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/sshd.elf
    • sshd.elf New Fork (PID: 5456, Parent: 5454)
      • sshd.elf New Fork (PID: 5458, Parent: 5456)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
sshd.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    sshd.elfJoeSecurity_Mirai_3Yara detected MiraiJoe Security
      sshd.elfLinux_Trojan_Gafgyt_fb14e81funknownunknown
      • 0x17fbc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
      SourceRuleDescriptionAuthorStrings
      5454.1.00007fb088400000.00007fb08841a000.r-x.sdmpJoeSecurity_Mirai_3Yara detected MiraiJoe Security
        5454.1.00007fb088400000.00007fb08841a000.r-x.sdmpLinux_Trojan_Gafgyt_fb14e81funknownunknown
        • 0x17fbc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
        5456.1.00007fb088400000.00007fb08841a000.r-x.sdmpJoeSecurity_Mirai_3Yara detected MiraiJoe Security
          5456.1.00007fb088400000.00007fb08841a000.r-x.sdmpLinux_Trojan_Gafgyt_fb14e81funknownunknown
          • 0x17fbc:$a: 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00
          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2025-02-18T06:33:02.624612+010028471801A Network Trojan was detected192.168.2.133584084.200.154.1194567TCP
          2025-02-18T06:33:24.259291+010028471801A Network Trojan was detected192.168.2.133584284.200.154.1194567TCP
          2025-02-18T06:35:24.297205+010028471801A Network Trojan was detected192.168.2.133584484.200.154.1194567TCP

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: sshd.elfAvira: detected
          Source: sshd.elfMalware Configuration Extractor: Gafgyt {"C2 url": "84.200.154.119:4567"}
          Source: sshd.elfReversingLabs: Detection: 67%
          Source: sshd.elfVirustotal: Detection: 60%Perma Link

          Spreading

          barindex
          Source: /tmp/sshd.elf (PID: 5454)Opens: /proc/net/routeJump to behavior

          Networking

          barindex
          Source: Network trafficSuricata IDS: 2847180 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.13:35842 -> 84.200.154.119:4567
          Source: Network trafficSuricata IDS: 2847180 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.13:35840 -> 84.200.154.119:4567
          Source: Network trafficSuricata IDS: 2847180 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Activity : 192.168.2.13:35844 -> 84.200.154.119:4567
          Source: global trafficTCP traffic: 192.168.2.13:35840 -> 84.200.154.119:4567
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: unknownTCP traffic detected without corresponding DNS query: 84.200.154.119
          Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
          Source: sshd.elfString found in binary or memory: http://84.200.154.119/bins.sh;

          System Summary

          barindex
          Source: sshd.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
          Source: 5454.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
          Source: 5456.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_fb14e81f Author: unknown
          Source: sshd.elfELF static info symbol of initial sample: passwords
          Source: sshd.elfELF static info symbol of initial sample: usernames
          Source: sshd.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
          Source: 5454.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
          Source: 5456.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_fb14e81f severity = 100, os = linux, arch_context = x86, creation_date = 2022-01-05, scan_context = file, memory, reference = 0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52, id = fb14e81f-be2a-4428-9877-958e394a7ae2, last_modified = 2022-01-26
          Source: classification engineClassification label: mal100.spre.troj.linELF@0/0@2/0
          Source: sshd.elfELF static info symbol of initial sample: libc/string/mips/memcpy.S
          Source: sshd.elfELF static info symbol of initial sample: libc/string/mips/memset.S
          Source: sshd.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
          Source: sshd.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
          Source: sshd.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
          Source: sshd.elfELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S
          Source: /tmp/sshd.elf (PID: 5454)Queries kernel information via 'uname': Jump to behavior
          Source: sshd.elf, 5454.1.0000562c7419f000.0000562c74226000.rw-.sdmp, sshd.elf, 5456.1.0000562c7419f000.0000562c74226000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
          Source: sshd.elf, 5454.1.0000562c7419f000.0000562c74226000.rw-.sdmp, sshd.elf, 5456.1.0000562c7419f000.0000562c74226000.rw-.sdmpBinary or memory string: t,V!/etc/qemu-binfmt/mipsel
          Source: sshd.elf, 5454.1.00007ffed2fa6000.00007ffed2fc7000.rw-.sdmp, sshd.elf, 5456.1.00007ffed2fa6000.00007ffed2fc7000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/sshd.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sshd.elf
          Source: sshd.elf, 5454.1.00007ffed2fa6000.00007ffed2fc7000.rw-.sdmp, sshd.elf, 5456.1.00007ffed2fa6000.00007ffed2fc7000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: sshd.elf, type: SAMPLE
          Source: Yara matchFile source: sshd.elf, type: SAMPLE
          Source: Yara matchFile source: 5454.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5456.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORY
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
          Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
          Source: Initial sampleUser agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
          Source: Initial sampleUser agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
          Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
          Source: Initial sampleUser agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: sshd.elf, type: SAMPLE
          Source: Yara matchFile source: sshd.elf, type: SAMPLE
          Source: Yara matchFile source: 5454.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORY
          Source: Yara matchFile source: 5456.1.00007fb088400000.00007fb08841a000.r-x.sdmp, type: MEMORY
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
          Masquerading
          OS Credential Dumping11
          Security Software Discovery
          Remote ServicesData from Local System1
          Data Obfuscation
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
          Remote System Discovery
          Remote Desktop ProtocolData from Removable Media1
          Non-Standard Port
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
          Non-Application Layer Protocol
          Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
          Application Layer Protocol
          Traffic DuplicationData Destruction
          {
            "C2 url": "84.200.154.119:4567"
          }
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1617652 Sample: sshd.elf Startdate: 18/02/2025 Architecture: LINUX Score: 100 15 84.200.154.119, 35840, 35842, 35844 ACCELERATED-ITDE Germany 2->15 17 daisy.ubuntu.com 2->17 19 Suricata IDS alerts for network traffic 2->19 21 Found malware configuration 2->21 23 Malicious sample detected (through community Yara rule) 2->23 25 4 other signatures 2->25 8 sshd.elf 2->8         started        signatures3 process4 signatures5 27 Opens /proc/net/* files useful for finding connected devices and routers 8->27 11 sshd.elf 8->11         started        process6 process7 13 sshd.elf 11->13         started       

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          SourceDetectionScannerLabelLink
          sshd.elf68%ReversingLabsLinux.Trojan.Gafgyt
          sshd.elf61%VirustotalBrowse
          sshd.elf100%AviraLINUX/Gafgyt.opnc
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches

          Download Network PCAP: filteredfull

          NameIPActiveMaliciousAntivirus DetectionReputation
          daisy.ubuntu.com
          162.213.35.24
          truefalse
            high
            NameMaliciousAntivirus DetectionReputation
            84.200.154.119:4567true
              unknown
              NameSourceMaliciousAntivirus DetectionReputation
              http://84.200.154.119/bins.sh;sshd.elffalse
                high
                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs
                IPDomainCountryFlagASNASN NameMalicious
                84.200.154.119
                unknownGermany
                31400ACCELERATED-ITDEtrue
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                84.200.154.119sh.elfGet hashmaliciousGafgyt, MiraiBrowse
                  ftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                    pftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                      bash.elfGet hashmaliciousGafgyt, MiraiBrowse
                        openssh.elfGet hashmaliciousGafgyt, MiraiBrowse
                          ntpd.elfGet hashmaliciousGafgyt, MiraiBrowse
                            na.elfGet hashmaliciousGafgyt, MiraiBrowse
                              wget.elfGet hashmaliciousGafgyt, MiraiBrowse
                                cron.elfGet hashmaliciousGafgyt, MiraiBrowse
                                  sh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    daisy.ubuntu.comtftp.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.25
                                    pftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 162.213.35.24
                                    openssh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 162.213.35.24
                                    boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.24
                                    boatnet.spc.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.24
                                    boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.25
                                    boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.25
                                    boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                    • 162.213.35.24
                                    na.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 162.213.35.24
                                    arm5.elfGet hashmaliciousUnknownBrowse
                                    • 162.213.35.25
                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    ACCELERATED-ITDEsh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    ftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    pftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    bash.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    openssh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    ntpd.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    na.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    wget.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    cron.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    sh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    • 84.200.154.119
                                    No context
                                    No context
                                    No created / dropped files found
                                    File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                                    Entropy (8bit):5.279161615164051
                                    TrID:
                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                    File name:sshd.elf
                                    File size:185'714 bytes
                                    MD5:f219af8c0dc8fd3385c6a1ae73fe0fc6
                                    SHA1:f800743d4d7cf76a9568da4adb96ade12b6ec9f4
                                    SHA256:dd8d57df26725ee577a5fb8f90945bff74fafa27d1a73e5bf46237bd7175fe59
                                    SHA512:97571589bbf75de9f5188ae8b9c90981d077e44a5bef3f22e01d3fd9154f76f3865ee2871f68dedbad7463d464a0eb2ee6bef6118c89f605de700c8bde43f348
                                    SSDEEP:1536:rMm6eTXdOjOMvWCv6yCmZm0PF+3ArrUcVind94hnzFmlQDFmzVu6nm7:r7Ojp6ESurSnqnzFmlsFmzVu6nm7
                                    TLSH:08043602162B5E73D6ED8E3B469242345D8C5C294698FB37B138D64AE3A7C8F4BD7E40
                                    File Content Preview:.ELF......................@.4...........4. ...(........p......@...@...........................@...@.T...T...............T...T.E.T.E.D... %..........Q.td..................................................F....<...'!......'.......................<...'!... ..

                                    ELF header

                                    Class:ELF32
                                    Data:2's complement, little endian
                                    Version:1 (current)
                                    Machine:MIPS R3000
                                    Version Number:0x1
                                    Type:EXEC (Executable file)
                                    OS/ABI:UNIX - System V
                                    ABI Version:0
                                    Entry Point Address:0x4002a0
                                    Flags:0x1007
                                    ELF Header Size:52
                                    Program Header Offset:52
                                    Program Header Size:32
                                    Number of Program Headers:4
                                    Section Header Offset:164764
                                    Section Header Size:40
                                    Number of Section Headers:20
                                    Header String Table Index:17
                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                    NULL0x00x00x00x00x0000
                                    .reginfoMIPS_REGINFO0x4000b40xb40x180x180x2A004
                                    .initPROGBITS0x4000cc0xcc0x8c0x00x6AX004
                                    .textPROGBITS0x4001600x1600x16ab00x00x6AX0016
                                    .finiPROGBITS0x416c100x16c100x5c0x00x6AX004
                                    .rodataPROGBITS0x416c700x16c700x2ce00x00x2A0016
                                    .eh_framePROGBITS0x4199500x199500x40x00x2A004
                                    .ctorsPROGBITS0x4599540x199540x80x00x3WA004
                                    .dtorsPROGBITS0x45995c0x1995c0x80x00x3WA004
                                    .jcrPROGBITS0x4599640x199640x40x00x3WA004
                                    .dataPROGBITS0x4599700x199700xbc500x00x3WA0016
                                    .gotPROGBITS0x4655c00x255c00x4d80x40x10000003WAp0016
                                    .sbssNOBITS0x465a980x25a980x1c0x00x10000003WAp004
                                    .bssNOBITS0x465ac00x25a980x63b40x00x3WA0016
                                    .commentPROGBITS0x00x25a980xb520x00x0001
                                    .mdebug.abi32PROGBITS0xb520x265ea0x00x00x0001
                                    .pdrPROGBITS0x00x265ec0x1d200x00x0004
                                    .shstrtabSTRTAB0x00x2830c0x8d0x00x0001
                                    .symtabSYMTAB0x00x286bc0x2d200x100x0193004
                                    .strtabSTRTAB0x00x2b3dc0x21960x00x0001
                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                    <unknown>0xb40x4000b40x4000b40x180x180.98340x4R 0x4.reginfo
                                    LOAD0x00x4000000x4000000x199540x199545.18700x5R E0x10000.reginfo .init .text .fini .rodata .eh_frame
                                    LOAD0x199540x4599540x4599540xc1440x125204.01090x6RW 0x10000.ctors .dtors .jcr .data .got .sbss .bss
                                    GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                    NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                    .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    .symtab0x4000b40SECTION<unknown>DEFAULT1
                                    .symtab0x4000cc0SECTION<unknown>DEFAULT2
                                    .symtab0x4001600SECTION<unknown>DEFAULT3
                                    .symtab0x416c100SECTION<unknown>DEFAULT4
                                    .symtab0x416c700SECTION<unknown>DEFAULT5
                                    .symtab0x4199500SECTION<unknown>DEFAULT6
                                    .symtab0x4599540SECTION<unknown>DEFAULT7
                                    .symtab0x45995c0SECTION<unknown>DEFAULT8
                                    .symtab0x4599640SECTION<unknown>DEFAULT9
                                    .symtab0x4599700SECTION<unknown>DEFAULT10
                                    .symtab0x4655c00SECTION<unknown>DEFAULT11
                                    .symtab0x465a980SECTION<unknown>DEFAULT12
                                    .symtab0x465ac00SECTION<unknown>DEFAULT13
                                    .symtab0x00SECTION<unknown>DEFAULT14
                                    .symtab0xb520SECTION<unknown>DEFAULT15
                                    .symtab0x00SECTION<unknown>DEFAULT16
                                    .symtab0x00SECTION<unknown>DEFAULT17
                                    .symtab0x00SECTION<unknown>DEFAULT18
                                    .symtab0x00SECTION<unknown>DEFAULT19
                                    Q.symtab0x465af816384OBJECT<unknown>DEFAULT13
                                    StartTheLelz.symtab0x40440c9056FUNC<unknown>DEFAULT3
                                    _GLOBAL_OFFSET_TABLE_.symtab0x4655c00OBJECT<unknown>DEFAULT11
                                    _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                    _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __CTOR_END__.symtab0x4599580OBJECT<unknown>DEFAULT7
                                    __CTOR_LIST__.symtab0x4599540OBJECT<unknown>DEFAULT7
                                    __C_ctype_b.symtab0x4651e04OBJECT<unknown>DEFAULT10
                                    __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __C_ctype_b_data.symtab0x4181a0768OBJECT<unknown>DEFAULT5
                                    __C_ctype_tolower.symtab0x4655b04OBJECT<unknown>DEFAULT10
                                    __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __C_ctype_tolower_data.symtab0x419650768OBJECT<unknown>DEFAULT5
                                    __C_ctype_toupper.symtab0x4651f04OBJECT<unknown>DEFAULT10
                                    __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __C_ctype_toupper_data.symtab0x4184a0768OBJECT<unknown>DEFAULT5
                                    __DTOR_END__.symtab0x4599600OBJECT<unknown>DEFAULT8
                                    __DTOR_LIST__.symtab0x45995c0OBJECT<unknown>DEFAULT8
                                    __EH_FRAME_BEGIN__.symtab0x4199500OBJECT<unknown>DEFAULT6
                                    __FRAME_END__.symtab0x4199500OBJECT<unknown>DEFAULT6
                                    __GI___C_ctype_b.symtab0x4651e04OBJECT<unknown>HIDDEN10
                                    __GI___C_ctype_b_data.symtab0x4181a0768OBJECT<unknown>HIDDEN5
                                    __GI___C_ctype_tolower.symtab0x4655b04OBJECT<unknown>HIDDEN10
                                    __GI___C_ctype_tolower_data.symtab0x419650768OBJECT<unknown>HIDDEN5
                                    __GI___C_ctype_toupper.symtab0x4651f04OBJECT<unknown>HIDDEN10
                                    __GI___C_ctype_toupper_data.symtab0x4184a0768OBJECT<unknown>HIDDEN5
                                    __GI___ctype_b.symtab0x4651e44OBJECT<unknown>HIDDEN10
                                    __GI___ctype_tolower.symtab0x4655b44OBJECT<unknown>HIDDEN10
                                    __GI___ctype_toupper.symtab0x4651f44OBJECT<unknown>HIDDEN10
                                    __GI___errno_location.symtab0x40c65024FUNC<unknown>HIDDEN3
                                    __GI___fgetc_unlocked.symtab0x4164f0388FUNC<unknown>HIDDEN3
                                    __GI___glibc_strerror_r.symtab0x40e6e068FUNC<unknown>HIDDEN3
                                    __GI___h_errno_location.symtab0x4116b024FUNC<unknown>HIDDEN3
                                    __GI___libc_fcntl.symtab0x40bd30136FUNC<unknown>HIDDEN3
                                    __GI___libc_fcntl64.symtab0x40bdc0104FUNC<unknown>HIDDEN3
                                    __GI___libc_open.symtab0x40c1e0124FUNC<unknown>HIDDEN3
                                    __GI___uClibc_fini.symtab0x410c90196FUNC<unknown>HIDDEN3
                                    __GI___uClibc_init.symtab0x410dec140FUNC<unknown>HIDDEN3
                                    __GI___xpg_strerror_r.symtab0x40e730392FUNC<unknown>HIDDEN3
                                    __GI__exit.symtab0x40be3080FUNC<unknown>HIDDEN3
                                    __GI_abort.symtab0x413d70428FUNC<unknown>HIDDEN3
                                    __GI_atoi.symtab0x41060028FUNC<unknown>HIDDEN3
                                    __GI_atol.symtab0x41060028FUNC<unknown>HIDDEN3
                                    __GI_brk.symtab0x413f50112FUNC<unknown>HIDDEN3
                                    __GI_chdir.symtab0x40be8088FUNC<unknown>HIDDEN3
                                    __GI_close.symtab0x40bee084FUNC<unknown>HIDDEN3
                                    __GI_connect.symtab0x40f08084FUNC<unknown>HIDDEN3
                                    __GI_dup2.symtab0x40bf4084FUNC<unknown>HIDDEN3
                                    __GI_errno.symtab0x46bd704OBJECT<unknown>HIDDEN13
                                    __GI_execl.symtab0x410980204FUNC<unknown>HIDDEN3
                                    __GI_execve.symtab0x41138084FUNC<unknown>HIDDEN3
                                    __GI_exit.symtab0x410890236FUNC<unknown>HIDDEN3
                                    __GI_fclose.symtab0x414020512FUNC<unknown>HIDDEN3
                                    __GI_fcntl.symtab0x40bd30136FUNC<unknown>HIDDEN3
                                    __GI_fcntl64.symtab0x40bdc0104FUNC<unknown>HIDDEN3
                                    __GI_fflush_unlocked.symtab0x414bb0628FUNC<unknown>HIDDEN3
                                    __GI_fgetc_unlocked.symtab0x4164f0388FUNC<unknown>HIDDEN3
                                    __GI_fgets.symtab0x414940216FUNC<unknown>HIDDEN3
                                    __GI_fgets_unlocked.symtab0x414e30268FUNC<unknown>HIDDEN3
                                    __GI_fopen.symtab0x41422028FUNC<unknown>HIDDEN3
                                    __GI_fork.symtab0x40bfa084FUNC<unknown>HIDDEN3
                                    __GI_fputs_unlocked.symtab0x40de90128FUNC<unknown>HIDDEN3
                                    __GI_fseek.symtab0x41424068FUNC<unknown>HIDDEN3
                                    __GI_fseeko64.symtab0x414290388FUNC<unknown>HIDDEN3
                                    __GI_fwrite_unlocked.symtab0x40df10280FUNC<unknown>HIDDEN3
                                    __GI_getc_unlocked.symtab0x4164f0388FUNC<unknown>HIDDEN3
                                    __GI_getdtablesize.symtab0x40c00072FUNC<unknown>HIDDEN3
                                    __GI_getegid.symtab0x4113e088FUNC<unknown>HIDDEN3
                                    __GI_geteuid.symtab0x41144088FUNC<unknown>HIDDEN3
                                    __GI_getgid.symtab0x4114a084FUNC<unknown>HIDDEN3
                                    __GI_gethostbyname.symtab0x40eba0116FUNC<unknown>HIDDEN3
                                    __GI_gethostbyname_r.symtab0x40ec201108FUNC<unknown>HIDDEN3
                                    __GI_getpid.symtab0x40c05084FUNC<unknown>HIDDEN3
                                    __GI_getrlimit.symtab0x40c0b084FUNC<unknown>HIDDEN3
                                    __GI_getsockname.symtab0x40f0e084FUNC<unknown>HIDDEN3
                                    __GI_getuid.symtab0x41150084FUNC<unknown>HIDDEN3
                                    __GI_h_errno.symtab0x46bd744OBJECT<unknown>HIDDEN13
                                    __GI_inet_addr.symtab0x40eb5072FUNC<unknown>HIDDEN3
                                    __GI_inet_aton.symtab0x412df0280FUNC<unknown>HIDDEN3
                                    __GI_inet_ntoa.symtab0x40eb2c32FUNC<unknown>HIDDEN3
                                    __GI_inet_ntoa_r.symtab0x40ea70188FUNC<unknown>HIDDEN3
                                    __GI_inet_ntop.symtab0x415750852FUNC<unknown>HIDDEN3
                                    __GI_inet_pton.symtab0x4152a0700FUNC<unknown>HIDDEN3
                                    __GI_initstate_r.symtab0x410270328FUNC<unknown>HIDDEN3
                                    __GI_ioctl.symtab0x40c110104FUNC<unknown>HIDDEN3
                                    __GI_isatty.symtab0x40e90060FUNC<unknown>HIDDEN3
                                    __GI_kill.symtab0x40c18088FUNC<unknown>HIDDEN3
                                    __GI_lseek64.symtab0x416400164FUNC<unknown>HIDDEN3
                                    __GI_memchr.symtab0x412740264FUNC<unknown>HIDDEN3
                                    __GI_memcpy.symtab0x40e030308FUNC<unknown>HIDDEN3
                                    __GI_memmove.symtab0x412850816FUNC<unknown>HIDDEN3
                                    __GI_mempcpy.symtab0x412b8076FUNC<unknown>HIDDEN3
                                    __GI_memrchr.symtab0x412bd0272FUNC<unknown>HIDDEN3
                                    __GI_memset.symtab0x40e170144FUNC<unknown>HIDDEN3
                                    __GI_nanosleep.symtab0x41156084FUNC<unknown>HIDDEN3
                                    __GI_open.symtab0x40c1e0124FUNC<unknown>HIDDEN3
                                    __GI_pipe.symtab0x40bcf064FUNC<unknown>HIDDEN3
                                    __GI_poll.symtab0x413fc084FUNC<unknown>HIDDEN3
                                    __GI_printf.symtab0x40c67092FUNC<unknown>HIDDEN3
                                    __GI_raise.symtab0x4163b076FUNC<unknown>HIDDEN3
                                    __GI_random.symtab0x40fc40164FUNC<unknown>HIDDEN3
                                    __GI_random_r.symtab0x41004c176FUNC<unknown>HIDDEN3
                                    __GI_rawmemchr.symtab0x414f40200FUNC<unknown>HIDDEN3
                                    __GI_read.symtab0x40c30084FUNC<unknown>HIDDEN3
                                    __GI_recv.symtab0x40f1c084FUNC<unknown>HIDDEN3
                                    __GI_sbrk.symtab0x4115c0144FUNC<unknown>HIDDEN3
                                    __GI_select.symtab0x40c360120FUNC<unknown>HIDDEN3
                                    __GI_send.symtab0x40f22084FUNC<unknown>HIDDEN3
                                    __GI_sendto.symtab0x40f280128FUNC<unknown>HIDDEN3
                                    __GI_setsid.symtab0x40c3e084FUNC<unknown>HIDDEN3
                                    __GI_setsockopt.symtab0x40f300120FUNC<unknown>HIDDEN3
                                    __GI_setstate_r.symtab0x40ff10316FUNC<unknown>HIDDEN3
                                    __GI_sigaction.symtab0x411230232FUNC<unknown>HIDDEN3
                                    __GI_sigaddset.symtab0x40f3e0104FUNC<unknown>HIDDEN3
                                    __GI_sigemptyset.symtab0x40f45060FUNC<unknown>HIDDEN3
                                    __GI_signal.symtab0x40f490252FUNC<unknown>HIDDEN3
                                    __GI_sigprocmask.symtab0x40c440148FUNC<unknown>HIDDEN3
                                    __GI_sleep.symtab0x410a50564FUNC<unknown>HIDDEN3
                                    __GI_socket.symtab0x40f38084FUNC<unknown>HIDDEN3
                                    __GI_sprintf.symtab0x40c6d080FUNC<unknown>HIDDEN3
                                    __GI_srandom_r.symtab0x4100fc372FUNC<unknown>HIDDEN3
                                    __GI_strcasecmp.symtab0x416680108FUNC<unknown>HIDDEN3
                                    __GI_strchr.symtab0x40e200256FUNC<unknown>HIDDEN3
                                    __GI_strcmp.symtab0x40e30044FUNC<unknown>HIDDEN3
                                    __GI_strcoll.symtab0x40e30044FUNC<unknown>HIDDEN3
                                    __GI_strcpy.symtab0x40e33036FUNC<unknown>HIDDEN3
                                    __GI_strdup.symtab0x415120144FUNC<unknown>HIDDEN3
                                    __GI_strlen.symtab0x40e360184FUNC<unknown>HIDDEN3
                                    __GI_strncat.symtab0x415010180FUNC<unknown>HIDDEN3
                                    __GI_strncpy.symtab0x40e420188FUNC<unknown>HIDDEN3
                                    __GI_strnlen.symtab0x40e4e0256FUNC<unknown>HIDDEN3
                                    __GI_strpbrk.symtab0x412db064FUNC<unknown>HIDDEN3
                                    __GI_strspn.symtab0x4150d076FUNC<unknown>HIDDEN3
                                    __GI_strstr.symtab0x40e5e0256FUNC<unknown>HIDDEN3
                                    __GI_strtok.symtab0x40e8e032FUNC<unknown>HIDDEN3
                                    __GI_strtok_r.symtab0x412ce0204FUNC<unknown>HIDDEN3
                                    __GI_strtol.symtab0x41062028FUNC<unknown>HIDDEN3
                                    __GI_tcgetattr.symtab0x40e940176FUNC<unknown>HIDDEN3
                                    __GI_time.symtab0x40c4e084FUNC<unknown>HIDDEN3
                                    __GI_tolower.symtab0x4164b060FUNC<unknown>HIDDEN3
                                    __GI_toupper.symtab0x40c61060FUNC<unknown>HIDDEN3
                                    __GI_vfork.symtab0x40c54028FUNC<unknown>HIDDEN3
                                    __GI_vfprintf.symtab0x40caa0260FUNC<unknown>HIDDEN3
                                    __GI_vsnprintf.symtab0x40c720260FUNC<unknown>HIDDEN3
                                    __GI_wait4.symtab0x41165088FUNC<unknown>HIDDEN3
                                    __GI_waitpid.symtab0x40c56028FUNC<unknown>HIDDEN3
                                    __GI_wcrtomb.symtab0x4116d0112FUNC<unknown>HIDDEN3
                                    __GI_wcsnrtombs.symtab0x411780228FUNC<unknown>HIDDEN3
                                    __GI_wcsrtombs.symtab0x41174064FUNC<unknown>HIDDEN3
                                    __GI_write.symtab0x40c58084FUNC<unknown>HIDDEN3
                                    __JCR_END__.symtab0x4599640OBJECT<unknown>DEFAULT9
                                    __JCR_LIST__.symtab0x4599640OBJECT<unknown>DEFAULT9
                                    __app_fini.symtab0x46bd5c4OBJECT<unknown>HIDDEN13
                                    __atexit_lock.symtab0x46553024OBJECT<unknown>DEFAULT10
                                    __bsd_signal.symtab0x40f490252FUNC<unknown>HIDDEN3
                                    __bss_start.symtab0x465a980NOTYPE<unknown>DEFAULTSHN_ABS
                                    __check_one_fd.symtab0x410d64136FUNC<unknown>DEFAULT3
                                    __ctype_b.symtab0x4651e44OBJECT<unknown>DEFAULT10
                                    __ctype_tolower.symtab0x4655b44OBJECT<unknown>DEFAULT10
                                    __ctype_toupper.symtab0x4651f44OBJECT<unknown>DEFAULT10
                                    __curbrk.symtab0x46bdb04OBJECT<unknown>HIDDEN13
                                    __data_start.symtab0x4599900OBJECT<unknown>DEFAULT10
                                    __decode_answer.symtab0x415db0340FUNC<unknown>HIDDEN3
                                    __decode_dotted.symtab0x416810340FUNC<unknown>HIDDEN3
                                    __decode_header.symtab0x415bc0228FUNC<unknown>HIDDEN3
                                    __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __dns_lookup.symtab0x412f102568FUNC<unknown>HIDDEN3
                                    __do_global_ctors_aux.symtab0x416ba00FUNC<unknown>DEFAULT3
                                    __do_global_dtors_aux.symtab0x4001600FUNC<unknown>DEFAULT3
                                    __dso_handle.symtab0x4599700OBJECT<unknown>HIDDEN10
                                    __encode_dotted.symtab0x4166f0280FUNC<unknown>HIDDEN3
                                    __encode_header.symtab0x415ab0272FUNC<unknown>HIDDEN3
                                    __encode_question.symtab0x415cb0172FUNC<unknown>HIDDEN3
                                    __environ.symtab0x46bd544OBJECT<unknown>DEFAULT13
                                    __errno_location.symtab0x40c65024FUNC<unknown>DEFAULT3
                                    __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __exit_cleanup.symtab0x46bd404OBJECT<unknown>HIDDEN13
                                    __fgetc_unlocked.symtab0x4164f0388FUNC<unknown>DEFAULT3
                                    __fini_array_end.symtab0x4599540NOTYPE<unknown>HIDDENSHN_ABS
                                    __fini_array_start.symtab0x4599540NOTYPE<unknown>HIDDENSHN_ABS
                                    __get_hosts_byname_r.symtab0x413d00104FUNC<unknown>HIDDEN3
                                    __glibc_strerror_r.symtab0x40e6e068FUNC<unknown>DEFAULT3
                                    __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __h_errno_location.symtab0x4116b024FUNC<unknown>DEFAULT3
                                    __h_errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __heap_alloc.symtab0x40f9a0188FUNC<unknown>DEFAULT3
                                    __heap_free.symtab0x40faa8364FUNC<unknown>DEFAULT3
                                    __heap_link_free_area.symtab0x40fa6044FUNC<unknown>DEFAULT3
                                    __heap_link_free_area_after.symtab0x40fa8c28FUNC<unknown>DEFAULT3
                                    __init_array_end.symtab0x4599540NOTYPE<unknown>HIDDENSHN_ABS
                                    __init_array_start.symtab0x4599540NOTYPE<unknown>HIDDENSHN_ABS
                                    __length_dotted.symtab0x41697072FUNC<unknown>HIDDEN3
                                    __length_question.symtab0x415d6072FUNC<unknown>HIDDEN3
                                    __libc_close.symtab0x40bee084FUNC<unknown>DEFAULT3
                                    __libc_connect.symtab0x40f08084FUNC<unknown>DEFAULT3
                                    __libc_creat.symtab0x40c25c28FUNC<unknown>DEFAULT3
                                    __libc_fcntl.symtab0x40bd30136FUNC<unknown>DEFAULT3
                                    __libc_fcntl64.symtab0x40bdc0104FUNC<unknown>DEFAULT3
                                    __libc_fork.symtab0x40bfa084FUNC<unknown>DEFAULT3
                                    __libc_getpid.symtab0x40c05084FUNC<unknown>DEFAULT3
                                    __libc_lseek64.symtab0x416400164FUNC<unknown>DEFAULT3
                                    __libc_nanosleep.symtab0x41156084FUNC<unknown>DEFAULT3
                                    __libc_open.symtab0x40c1e0124FUNC<unknown>DEFAULT3
                                    __libc_poll.symtab0x413fc084FUNC<unknown>DEFAULT3
                                    __libc_read.symtab0x40c30084FUNC<unknown>DEFAULT3
                                    __libc_recv.symtab0x40f1c084FUNC<unknown>DEFAULT3
                                    __libc_select.symtab0x40c360120FUNC<unknown>DEFAULT3
                                    __libc_send.symtab0x40f22084FUNC<unknown>DEFAULT3
                                    __libc_sendto.symtab0x40f280128FUNC<unknown>DEFAULT3
                                    __libc_sigaction.symtab0x411230232FUNC<unknown>DEFAULT3
                                    __libc_stack_end.symtab0x46bd504OBJECT<unknown>DEFAULT13
                                    __libc_system.symtab0x4103c0568FUNC<unknown>DEFAULT3
                                    __libc_waitpid.symtab0x40c56028FUNC<unknown>DEFAULT3
                                    __libc_write.symtab0x40c58084FUNC<unknown>DEFAULT3
                                    __malloc_heap.symtab0x4654604OBJECT<unknown>DEFAULT10
                                    __malloc_heap_lock.symtab0x46bd2024OBJECT<unknown>DEFAULT13
                                    __malloc_sbrk_lock.symtab0x46be4024OBJECT<unknown>DEFAULT13
                                    __nameserver.symtab0x46be6812OBJECT<unknown>HIDDEN13
                                    __nameservers.symtab0x465aa44OBJECT<unknown>HIDDEN12
                                    __open_etc_hosts.symtab0x415f10108FUNC<unknown>HIDDEN3
                                    __open_nameservers.symtab0x413920984FUNC<unknown>HIDDEN3
                                    __pagesize.symtab0x46bd584OBJECT<unknown>DEFAULT13
                                    __preinit_array_end.symtab0x4599540NOTYPE<unknown>HIDDENSHN_ABS
                                    __preinit_array_start.symtab0x4599540NOTYPE<unknown>HIDDENSHN_ABS
                                    __pthread_initialize_minimal.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __pthread_mutex_init.symtab0x410d548FUNC<unknown>DEFAULT3
                                    __pthread_mutex_lock.symtab0x410d548FUNC<unknown>DEFAULT3
                                    __pthread_mutex_trylock.symtab0x410d548FUNC<unknown>DEFAULT3
                                    __pthread_mutex_unlock.symtab0x410d548FUNC<unknown>DEFAULT3
                                    __pthread_return_0.symtab0x410d548FUNC<unknown>DEFAULT3
                                    __pthread_return_void.symtab0x410d5c8FUNC<unknown>DEFAULT3
                                    __raise.symtab0x4163b076FUNC<unknown>HIDDEN3
                                    __read_etc_hosts_r.symtab0x415f7c1076FUNC<unknown>HIDDEN3
                                    __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                    __resolv_lock.symtab0x46557024OBJECT<unknown>DEFAULT10
                                    __rtld_fini.symtab0x46bd604OBJECT<unknown>HIDDEN13
                                    __searchdomain.symtab0x46be5816OBJECT<unknown>HIDDEN13
                                    __searchdomains.symtab0x465aa84OBJECT<unknown>HIDDEN12
                                    __sigaddset.symtab0x40f5b844FUNC<unknown>DEFAULT3
                                    __sigdelset.symtab0x40f5e448FUNC<unknown>DEFAULT3
                                    __sigismember.symtab0x40f59040FUNC<unknown>DEFAULT3
                                    __start.symtab0x4002a0100FUNC<unknown>DEFAULT3
                                    __stdin.symtab0x46524c4OBJECT<unknown>DEFAULT10
                                    __stdio_READ.symtab0x4169c0140FUNC<unknown>HIDDEN3
                                    __stdio_WRITE.symtab0x411870280FUNC<unknown>HIDDEN3
                                    __stdio_adjust_position.symtab0x414420320FUNC<unknown>HIDDEN3
                                    __stdio_fwrite.symtab0x411990472FUNC<unknown>HIDDEN3
                                    __stdio_init_mutex.symtab0x40c8e832FUNC<unknown>HIDDEN3
                                    __stdio_mutex_initializer.3833.symtab0x4187a024OBJECT<unknown>DEFAULT5
                                    __stdio_rfill.symtab0x416a5088FUNC<unknown>HIDDEN3
                                    __stdio_seek.symtab0x4148d0112FUNC<unknown>HIDDEN3
                                    __stdio_trans2r_o.symtab0x416ab0228FUNC<unknown>HIDDEN3
                                    __stdio_trans2w_o.symtab0x411b70308FUNC<unknown>HIDDEN3
                                    __stdio_wcommit.symtab0x40ca30100FUNC<unknown>HIDDEN3
                                    __stdout.symtab0x4652504OBJECT<unknown>DEFAULT10
                                    __syscall_error.symtab0x4111e072FUNC<unknown>HIDDEN3
                                    __syscall_error.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __syscall_fcntl64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __syscall_rt_sigaction.symtab0x41132084FUNC<unknown>HIDDEN3
                                    __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __uClibc_fini.symtab0x410c90196FUNC<unknown>DEFAULT3
                                    __uClibc_init.symtab0x410dec140FUNC<unknown>DEFAULT3
                                    __uClibc_main.symtab0x410e78864FUNC<unknown>DEFAULT3
                                    __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    __uclibc_progname.symtab0x4655504OBJECT<unknown>HIDDEN10
                                    __vfork.symtab0x40c54028FUNC<unknown>HIDDEN3
                                    __xpg_strerror_r.symtab0x40e730392FUNC<unknown>DEFAULT3
                                    __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _charpad.symtab0x40cbb0128FUNC<unknown>DEFAULT3
                                    _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _dl_aux_init.symtab0x413f2044FUNC<unknown>DEFAULT3
                                    _dl_phdr.symtab0x465aac4OBJECT<unknown>DEFAULT12
                                    _dl_phnum.symtab0x465ab04OBJECT<unknown>DEFAULT12
                                    _edata.symtab0x465a980NOTYPE<unknown>DEFAULTSHN_ABS
                                    _end.symtab0x46be740NOTYPE<unknown>DEFAULTSHN_ABS
                                    _errno.symtab0x46bd704OBJECT<unknown>DEFAULT13
                                    _exit.symtab0x40be3080FUNC<unknown>DEFAULT3
                                    _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _fbss.symtab0x465a980NOTYPE<unknown>DEFAULTSHN_ABS
                                    _fdata.symtab0x4599700NOTYPE<unknown>DEFAULT10
                                    _fini.symtab0x416c1028FUNC<unknown>DEFAULT4
                                    _fixed_buffers.symtab0x469b188192OBJECT<unknown>DEFAULT13
                                    _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _fp_out_narrow.symtab0x40cc30228FUNC<unknown>DEFAULT3
                                    _fpmaxtostr.symtab0x411ef02120FUNC<unknown>HIDDEN3
                                    _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _ftext.symtab0x4001600NOTYPE<unknown>DEFAULT3
                                    _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _gp.symtab0x46d5b00NOTYPE<unknown>DEFAULTSHN_ABS
                                    _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                    _h_errno.symtab0x46bd744OBJECT<unknown>DEFAULT13
                                    _init.symtab0x4000cc28FUNC<unknown>DEFAULT2
                                    _load_inttype.symtab0x411cb0136FUNC<unknown>HIDDEN3
                                    _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _ppfs_init.symtab0x40d4c0220FUNC<unknown>HIDDEN3
                                    _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _ppfs_parsespec.symtab0x40d89c1512FUNC<unknown>HIDDEN3
                                    _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _ppfs_prepargs.symtab0x40d5a0100FUNC<unknown>HIDDEN3
                                    _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _ppfs_setargs.symtab0x40d610544FUNC<unknown>HIDDEN3
                                    _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _promoted_size.symtab0x40d830108FUNC<unknown>DEFAULT3
                                    _pthread_cleanup_pop_restore.symtab0x410d5c8FUNC<unknown>DEFAULT3
                                    _pthread_cleanup_push_defer.symtab0x410d5c8FUNC<unknown>DEFAULT3
                                    _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _sigintr.symtab0x46bdc0128OBJECT<unknown>HIDDEN13
                                    _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _stdio_fopen.symtab0x414560880FUNC<unknown>HIDDEN3
                                    _stdio_init.symtab0x40c830184FUNC<unknown>HIDDEN3
                                    _stdio_openlist.symtab0x4652544OBJECT<unknown>DEFAULT10
                                    _stdio_openlist_add_lock.symtab0x46520024OBJECT<unknown>DEFAULT10
                                    _stdio_openlist_dec_use.symtab0x414a20400FUNC<unknown>DEFAULT3
                                    _stdio_openlist_del_count.symtab0x469b144OBJECT<unknown>DEFAULT13
                                    _stdio_openlist_del_lock.symtab0x46521824OBJECT<unknown>DEFAULT10
                                    _stdio_openlist_use_count.symtab0x469b104OBJECT<unknown>DEFAULT13
                                    _stdio_streams.symtab0x465258240OBJECT<unknown>DEFAULT10
                                    _stdio_term.symtab0x40c908284FUNC<unknown>HIDDEN3
                                    _stdio_user_locking.symtab0x4652304OBJECT<unknown>DEFAULT10
                                    _stdlib_strto_l.symtab0x410640592FUNC<unknown>HIDDEN3
                                    _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _store_inttype.symtab0x411d4068FUNC<unknown>HIDDEN3
                                    _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _string_syserrmsgs.symtab0x4189102934OBJECT<unknown>HIDDEN5
                                    _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _uintmaxtostr.symtab0x411d90340FUNC<unknown>HIDDEN3
                                    _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _vfprintf_internal.symtab0x40cd141960FUNC<unknown>HIDDEN3
                                    _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    abort.symtab0x413d70428FUNC<unknown>DEFAULT3
                                    abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    atoi.symtab0x41060028FUNC<unknown>DEFAULT3
                                    atol.symtab0x41060028FUNC<unknown>DEFAULT3
                                    atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    bcopy.symtab0x40e8c032FUNC<unknown>DEFAULT3
                                    bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    been_there_done_that.symtab0x46bda04OBJECT<unknown>DEFAULT13
                                    been_there_done_that.2792.symtab0x46bd644OBJECT<unknown>DEFAULT13
                                    bot.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    brk.symtab0x413f50112FUNC<unknown>DEFAULT3
                                    brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    bsd_signal.symtab0x40f490252FUNC<unknown>DEFAULT3
                                    buf.2613.symtab0x46bb3016OBJECT<unknown>DEFAULT13
                                    buf.4833.symtab0x46bb40460OBJECT<unknown>DEFAULT13
                                    c.symtab0x4599a44OBJECT<unknown>DEFAULT10
                                    chdir.symtab0x40be8088FUNC<unknown>DEFAULT3
                                    chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    close.symtab0x40bee084FUNC<unknown>DEFAULT3
                                    close.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    commServer.symtab0x4599b44OBJECT<unknown>DEFAULT10
                                    completed.2296.symtab0x465ac01OBJECT<unknown>DEFAULT13
                                    connect.symtab0x40f08084FUNC<unknown>DEFAULT3
                                    connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    connectTimeout.symtab0x402b10828FUNC<unknown>DEFAULT3
                                    creat.symtab0x40c25c28FUNC<unknown>DEFAULT3
                                    crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    csum.symtab0x403f34460FUNC<unknown>DEFAULT3
                                    currentServer.symtab0x4599a04OBJECT<unknown>DEFAULT10
                                    data_start.symtab0x4599900OBJECT<unknown>DEFAULT10
                                    decodea.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    dup2.symtab0x40bf4084FUNC<unknown>DEFAULT3
                                    dup2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    environ.symtab0x46bd544OBJECT<unknown>DEFAULT13
                                    errno.symtab0x46bd704OBJECT<unknown>DEFAULT13
                                    errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    estridx.symtab0x418880126OBJECT<unknown>DEFAULT5
                                    execl.symtab0x410980204FUNC<unknown>DEFAULT3
                                    execl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    execve.symtab0x41138084FUNC<unknown>DEFAULT3
                                    execve.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    exit.symtab0x410890236FUNC<unknown>DEFAULT3
                                    exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    exp10_table.symtab0x41953872OBJECT<unknown>DEFAULT5
                                    fclose.symtab0x414020512FUNC<unknown>DEFAULT3
                                    fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fcntl.symtab0x40bd30136FUNC<unknown>DEFAULT3
                                    fcntl64.symtab0x40bdc0104FUNC<unknown>DEFAULT3
                                    fdgets.symtab0x401c7c292FUNC<unknown>DEFAULT3
                                    fdopen_pids.symtab0x469af84OBJECT<unknown>DEFAULT13
                                    fdpclose.symtab0x401a00636FUNC<unknown>DEFAULT3
                                    fdpopen.symtab0x40158c1140FUNC<unknown>DEFAULT3
                                    fflush_unlocked.symtab0x414bb0628FUNC<unknown>DEFAULT3
                                    fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fgetc_unlocked.symtab0x4164f0388FUNC<unknown>DEFAULT3
                                    fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fgets.symtab0x414940216FUNC<unknown>DEFAULT3
                                    fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fgets_unlocked.symtab0x414e30268FUNC<unknown>DEFAULT3
                                    fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fmt.symtab0x41952020OBJECT<unknown>DEFAULT5
                                    fopen.symtab0x41422028FUNC<unknown>DEFAULT3
                                    fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fork.symtab0x40bfa084FUNC<unknown>DEFAULT3
                                    fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fputs_unlocked.symtab0x40de90128FUNC<unknown>DEFAULT3
                                    fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    frame_dummy.symtab0x40021c0FUNC<unknown>DEFAULT3
                                    free.symtab0x40f810396FUNC<unknown>DEFAULT3
                                    free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fseek.symtab0x41424068FUNC<unknown>DEFAULT3
                                    fseeko.symtab0x41424068FUNC<unknown>DEFAULT3
                                    fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fseeko64.symtab0x414290388FUNC<unknown>DEFAULT3
                                    fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    fwrite_unlocked.symtab0x40df10280FUNC<unknown>DEFAULT3
                                    fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getBogos.symtab0x402224772FUNC<unknown>DEFAULT3
                                    getBuild.symtab0x40add856FUNC<unknown>DEFAULT3
                                    getCores.symtab0x402528316FUNC<unknown>DEFAULT3
                                    getHost.symtab0x4020e0160FUNC<unknown>DEFAULT3
                                    getOurIP.symtab0x40aa58896FUNC<unknown>DEFAULT3
                                    getRandomIP.symtab0x403e88172FUNC<unknown>DEFAULT3
                                    getRandomPublicIP.symtab0x4038781552FUNC<unknown>DEFAULT3
                                    get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getc_unlocked.symtab0x4164f0388FUNC<unknown>DEFAULT3
                                    getdtablesize.symtab0x40c00072FUNC<unknown>DEFAULT3
                                    getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getegid.symtab0x4113e088FUNC<unknown>DEFAULT3
                                    getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    geteuid.symtab0x41144088FUNC<unknown>DEFAULT3
                                    geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getgid.symtab0x4114a084FUNC<unknown>DEFAULT3
                                    getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    gethostbyname.symtab0x40eba0116FUNC<unknown>DEFAULT3
                                    gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    gethostbyname_r.symtab0x40ec201108FUNC<unknown>DEFAULT3
                                    gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getpid.symtab0x40c05084FUNC<unknown>DEFAULT3
                                    getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getrlimit.symtab0x40c0b084FUNC<unknown>DEFAULT3
                                    getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getsockname.symtab0x40f0e084FUNC<unknown>DEFAULT3
                                    getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getsockopt.symtab0x40f140120FUNC<unknown>DEFAULT3
                                    getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    getuid.symtab0x41150084FUNC<unknown>DEFAULT3
                                    getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    gotIP.symtab0x465ae44OBJECT<unknown>DEFAULT13
                                    h.4832.symtab0x46bd0c20OBJECT<unknown>DEFAULT13
                                    h_errno.symtab0x46bd744OBJECT<unknown>DEFAULT13
                                    heap_alloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    heap_free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    hextable.symtab0x417a581024OBJECT<unknown>DEFAULT5
                                    hlt.symtab0x4002fc0NOTYPE<unknown>DEFAULT3
                                    htonl.symtab0x40ea3040FUNC<unknown>DEFAULT3
                                    htons.symtab0x40ea5824FUNC<unknown>DEFAULT3
                                    i.4136.symtab0x4599a84OBJECT<unknown>DEFAULT10
                                    index.symtab0x40e200256FUNC<unknown>DEFAULT3
                                    inet_addr.symtab0x40eb5072FUNC<unknown>DEFAULT3
                                    inet_aton.symtab0x412df0280FUNC<unknown>DEFAULT3
                                    inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    inet_ntoa.symtab0x40eb2c32FUNC<unknown>DEFAULT3
                                    inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    inet_ntoa_r.symtab0x40ea70188FUNC<unknown>DEFAULT3
                                    inet_ntop.symtab0x415750852FUNC<unknown>DEFAULT3
                                    inet_ntop4.symtab0x41555c500FUNC<unknown>DEFAULT3
                                    inet_pton.symtab0x4152a0700FUNC<unknown>DEFAULT3
                                    inet_pton4.symtab0x4151b0240FUNC<unknown>DEFAULT3
                                    infectline.symtab0x4599b04OBJECT<unknown>DEFAULT10
                                    initConnection.symtab0x40a808592FUNC<unknown>DEFAULT3
                                    init_rand.symtab0x400310300FUNC<unknown>DEFAULT3
                                    initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    initial_fa.symtab0x465350264OBJECT<unknown>DEFAULT10
                                    initstate.symtab0x40fd94208FUNC<unknown>DEFAULT3
                                    initstate_r.symtab0x410270328FUNC<unknown>DEFAULT3
                                    ioctl.symtab0x40c110104FUNC<unknown>DEFAULT3
                                    ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    ipState.symtab0x469afc5OBJECT<unknown>DEFAULT13
                                    isatty.symtab0x40e90060FUNC<unknown>DEFAULT3
                                    isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    isspace.symtab0x40c5e044FUNC<unknown>DEFAULT3
                                    isspace.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    kill.symtab0x40c18088FUNC<unknown>DEFAULT3
                                    kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    lengthd.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    lengthq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    libc/string/mips/memcpy.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    libc/string/mips/memset.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    libc/sysdeps/linux/mips/crt1.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    libc/sysdeps/linux/mips/crti.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    libc/sysdeps/linux/mips/crtn.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    libc/sysdeps/linux/mips/pipe.S.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    listFork.symtab0x402e4c632FUNC<unknown>DEFAULT3
                                    llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    lseek64.symtab0x416400164FUNC<unknown>DEFAULT3
                                    macAddress.symtab0x465af06OBJECT<unknown>DEFAULT13
                                    main.symtab0x40ae103800FUNC<unknown>DEFAULT3
                                    mainCommSock.symtab0x465ae04OBJECT<unknown>DEFAULT13
                                    makeIPPacket.symtab0x404264296FUNC<unknown>DEFAULT3
                                    makeRandomStr.symtab0x402664268FUNC<unknown>DEFAULT3
                                    malloc.symtab0x40f620492FUNC<unknown>DEFAULT3
                                    malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    matchPrompt.symtab0x4032fc536FUNC<unknown>DEFAULT3
                                    memchr.symtab0x412740264FUNC<unknown>DEFAULT3
                                    memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    memcpy.symtab0x40e030308FUNC<unknown>DEFAULT3
                                    memmove.symtab0x412850816FUNC<unknown>DEFAULT3
                                    memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    mempcpy.symtab0x412b8076FUNC<unknown>DEFAULT3
                                    mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    memrchr.symtab0x412bd0272FUNC<unknown>DEFAULT3
                                    memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    memset.symtab0x40e170144FUNC<unknown>DEFAULT3
                                    mylock.symtab0x46547024OBJECT<unknown>DEFAULT10
                                    mylock.symtab0x46bd8024OBJECT<unknown>DEFAULT13
                                    mylock.symtab0x46559024OBJECT<unknown>DEFAULT10
                                    nanosleep.symtab0x41156084FUNC<unknown>DEFAULT3
                                    nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    negotiate.symtab0x4030c4568FUNC<unknown>DEFAULT3
                                    next_start.1065.symtab0x46bb204OBJECT<unknown>DEFAULT13
                                    ntohl.symtab0x40e9f040FUNC<unknown>DEFAULT3
                                    ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    ntohs.symtab0x40ea1824FUNC<unknown>DEFAULT3
                                    ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    numpids.symtab0x465ae88OBJECT<unknown>DEFAULT13
                                    object.2349.symtab0x465ac424OBJECT<unknown>DEFAULT13
                                    open.symtab0x40c1e0124FUNC<unknown>DEFAULT3
                                    open.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    ourIP.symtab0x465a984OBJECT<unknown>DEFAULT12
                                    p.2294.symtab0x4599800OBJECT<unknown>DEFAULT10
                                    parseHex.symtab0x401da0176FUNC<unknown>DEFAULT3
                                    passwords.symtab0x46519c64OBJECT<unknown>DEFAULT10
                                    pids.symtab0x465aa04OBJECT<unknown>DEFAULT12
                                    pipe.symtab0x40bcf064FUNC<unknown>DEFAULT3
                                    poll.symtab0x413fc084FUNC<unknown>DEFAULT3
                                    poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    prctl.symtab0x40c280120FUNC<unknown>DEFAULT3
                                    prctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    prefix.4045.symtab0x4187d012OBJECT<unknown>DEFAULT5
                                    print.symtab0x400d6c1456FUNC<unknown>DEFAULT3
                                    printchar.symtab0x4007e0184FUNC<unknown>DEFAULT3
                                    printf.symtab0x40c67092FUNC<unknown>DEFAULT3
                                    printf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    printi.symtab0x400ad4664FUNC<unknown>DEFAULT3
                                    prints.symtab0x400898572FUNC<unknown>DEFAULT3
                                    processCmd.symtab0x408be47204FUNC<unknown>DEFAULT3
                                    qual_chars.4050.symtab0x4187f020OBJECT<unknown>DEFAULT5
                                    raise.symtab0x4163b076FUNC<unknown>DEFAULT3
                                    raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    rand.symtab0x40fc2028FUNC<unknown>DEFAULT3
                                    rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    rand_cmwc.symtab0x40043c472FUNC<unknown>DEFAULT3
                                    random.symtab0x40fc40164FUNC<unknown>DEFAULT3
                                    random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    random_poly_info.symtab0x41949040OBJECT<unknown>DEFAULT5
                                    random_r.symtab0x41004c176FUNC<unknown>DEFAULT3
                                    random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    randtbl.symtab0x465488128OBJECT<unknown>DEFAULT10
                                    rawmemchr.symtab0x414f40200FUNC<unknown>DEFAULT3
                                    rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    read.symtab0x40c30084FUNC<unknown>DEFAULT3
                                    read.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    readUntil.symtab0x403514868FUNC<unknown>DEFAULT3
                                    read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    recv.symtab0x40f1c084FUNC<unknown>DEFAULT3
                                    recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    recvLine.symtab0x402770928FUNC<unknown>DEFAULT3
                                    sbrk.symtab0x4115c0144FUNC<unknown>DEFAULT3
                                    sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    scanPid.symtab0x465a9c4OBJECT<unknown>DEFAULT12
                                    sclose.symtab0x40438c128FUNC<unknown>DEFAULT3
                                    select.symtab0x40c360120FUNC<unknown>DEFAULT3
                                    select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    send.symtab0x40f22084FUNC<unknown>DEFAULT3
                                    send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sendCNC.symtab0x407264372FUNC<unknown>DEFAULT3
                                    sendHOLD.symtab0x4084201988FUNC<unknown>DEFAULT3
                                    sendHTTP.symtab0x406fd8652FUNC<unknown>DEFAULT3
                                    sendJUNK.symtab0x407cec1844FUNC<unknown>DEFAULT3
                                    sendTCP.symtab0x4073d82324FUNC<unknown>DEFAULT3
                                    sendUDP.symtab0x40676c1712FUNC<unknown>DEFAULT3
                                    sendto.symtab0x40f280128FUNC<unknown>DEFAULT3
                                    sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    setsid.symtab0x40c3e084FUNC<unknown>DEFAULT3
                                    setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    setsockopt.symtab0x40f300120FUNC<unknown>DEFAULT3
                                    setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    setstate.symtab0x40fce4176FUNC<unknown>DEFAULT3
                                    setstate_r.symtab0x40ff10316FUNC<unknown>DEFAULT3
                                    sigaction.symtab0x411230232FUNC<unknown>DEFAULT3
                                    sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sigaddset.symtab0x40f3e0104FUNC<unknown>DEFAULT3
                                    sigaddset.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sigempty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sigemptyset.symtab0x40f45060FUNC<unknown>DEFAULT3
                                    signal.symtab0x40f490252FUNC<unknown>DEFAULT3
                                    signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sigprocmask.symtab0x40c440148FUNC<unknown>DEFAULT3
                                    sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    sleep.symtab0x410a50564FUNC<unknown>DEFAULT3
                                    sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    socket.symtab0x40f38084FUNC<unknown>DEFAULT3
                                    socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    socket_connect.symtab0x406e1c444FUNC<unknown>DEFAULT3
                                    sockprintf.symtab0x40140c384FUNC<unknown>DEFAULT3
                                    spec_and_mask.4049.symtab0x41880416OBJECT<unknown>DEFAULT5
                                    spec_base.4044.symtab0x4187dc7OBJECT<unknown>DEFAULT5
                                    spec_chars.4046.symtab0x41883021OBJECT<unknown>DEFAULT5
                                    spec_flags.4045.symtab0x4188488OBJECT<unknown>DEFAULT5
                                    spec_or_mask.4048.symtab0x41881416OBJECT<unknown>DEFAULT5
                                    spec_ranges.4047.symtab0x4188249OBJECT<unknown>DEFAULT5
                                    sprintf.symtab0x40c6d080FUNC<unknown>DEFAULT3
                                    sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    srand.symtab0x40fe64172FUNC<unknown>DEFAULT3
                                    srandom.symtab0x40fe64172FUNC<unknown>DEFAULT3
                                    srandom_r.symtab0x4100fc372FUNC<unknown>DEFAULT3
                                    static_id.symtab0x4655602OBJECT<unknown>DEFAULT10
                                    static_ns.symtab0x46bd984OBJECT<unknown>DEFAULT13
                                    stderr.symtab0x4652484OBJECT<unknown>DEFAULT10
                                    stdin.symtab0x4652404OBJECT<unknown>DEFAULT10
                                    stdout.symtab0x4652444OBJECT<unknown>DEFAULT10
                                    strcasecmp.symtab0x416680108FUNC<unknown>DEFAULT3
                                    strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strchr.symtab0x40e200256FUNC<unknown>DEFAULT3
                                    strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strcmp.symtab0x40e30044FUNC<unknown>DEFAULT3
                                    strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strcoll.symtab0x40e30044FUNC<unknown>DEFAULT3
                                    strcpy.symtab0x40e33036FUNC<unknown>DEFAULT3
                                    strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strdup.symtab0x415120144FUNC<unknown>DEFAULT3
                                    strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strerror_r.symtab0x40e730392FUNC<unknown>DEFAULT3
                                    strlen.symtab0x40e360184FUNC<unknown>DEFAULT3
                                    strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strncat.symtab0x415010180FUNC<unknown>DEFAULT3
                                    strncat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strncpy.symtab0x40e420188FUNC<unknown>DEFAULT3
                                    strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strnlen.symtab0x40e4e0256FUNC<unknown>DEFAULT3
                                    strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strpbrk.symtab0x412db064FUNC<unknown>DEFAULT3
                                    strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strspn.symtab0x4150d076FUNC<unknown>DEFAULT3
                                    strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strstr.symtab0x40e5e0256FUNC<unknown>DEFAULT3
                                    strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strtok.symtab0x40e8e032FUNC<unknown>DEFAULT3
                                    strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strtok_r.symtab0x412ce0204FUNC<unknown>DEFAULT3
                                    strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    strtol.symtab0x41062028FUNC<unknown>DEFAULT3
                                    strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    system.symtab0x4103c0568FUNC<unknown>DEFAULT3
                                    system.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    szprintf.symtab0x401394120FUNC<unknown>DEFAULT3
                                    tcgetattr.symtab0x40e940176FUNC<unknown>DEFAULT3
                                    tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    tcpcsum.symtab0x404100356FUNC<unknown>DEFAULT3
                                    time.symtab0x40c4e084FUNC<unknown>DEFAULT3
                                    time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    tolower.symtab0x4164b060FUNC<unknown>DEFAULT3
                                    tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    toupper.symtab0x40c61060FUNC<unknown>DEFAULT3
                                    toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    trim.symtab0x400614460FUNC<unknown>DEFAULT3
                                    type_codes.symtab0x41885024OBJECT<unknown>DEFAULT5
                                    type_sizes.symtab0x41886812OBJECT<unknown>DEFAULT5
                                    uastrings.symtab0x4599b847044OBJECT<unknown>DEFAULT10
                                    unknown.1088.symtab0x41890014OBJECT<unknown>DEFAULT5
                                    unsafe_state.symtab0x46551028OBJECT<unknown>DEFAULT10
                                    uppercase.symtab0x402180164FUNC<unknown>DEFAULT3
                                    usernames.symtab0x46517c32OBJECT<unknown>DEFAULT10
                                    vfork.symtab0x40c54028FUNC<unknown>DEFAULT3
                                    vfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    vfprintf.symtab0x40caa0260FUNC<unknown>DEFAULT3
                                    vfprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    vsnprintf.symtab0x40c720260FUNC<unknown>DEFAULT3
                                    vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    wait4.symtab0x41165088FUNC<unknown>DEFAULT3
                                    wait4.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    waitpid.symtab0x40c56028FUNC<unknown>DEFAULT3
                                    waitpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    wcrtomb.symtab0x4116d0112FUNC<unknown>DEFAULT3
                                    wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    wcsnrtombs.symtab0x411780228FUNC<unknown>DEFAULT3
                                    wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    wcsrtombs.symtab0x41174064FUNC<unknown>DEFAULT3
                                    wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    wildString.symtab0x401e50656FUNC<unknown>DEFAULT3
                                    write.symtab0x40c58084FUNC<unknown>DEFAULT3
                                    write.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                    xdigits.3043.symtab0x41960417OBJECT<unknown>DEFAULT5
                                    zprintf.symtab0x40131c120FUNC<unknown>DEFAULT3

                                    Download Network PCAP: filteredfull

                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                    2025-02-18T06:33:02.624612+01002847180ETPRO MALWARE ELF/BASHLITE Variant CnC Activity1192.168.2.133584084.200.154.1194567TCP
                                    2025-02-18T06:33:24.259291+01002847180ETPRO MALWARE ELF/BASHLITE Variant CnC Activity1192.168.2.133584284.200.154.1194567TCP
                                    2025-02-18T06:35:24.297205+01002847180ETPRO MALWARE ELF/BASHLITE Variant CnC Activity1192.168.2.133584484.200.154.1194567TCP
                                    • Total Packets: 18
                                    • 4567 undefined
                                    • 53 (DNS)
                                    TimestampSource PortDest PortSource IPDest IP
                                    Feb 18, 2025 06:33:02.495363951 CET358404567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:02.500376940 CET45673584084.200.154.119192.168.2.13
                                    Feb 18, 2025 06:33:02.500443935 CET358404567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:02.624612093 CET358404567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:02.629484892 CET45673584084.200.154.119192.168.2.13
                                    Feb 18, 2025 06:33:24.194242001 CET45673584084.200.154.119192.168.2.13
                                    Feb 18, 2025 06:33:24.195183039 CET358404567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:24.197344065 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:24.199974060 CET45673584084.200.154.119192.168.2.13
                                    Feb 18, 2025 06:33:24.203999996 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:33:24.204073906 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:24.259290934 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:24.264347076 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:33:54.301964045 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:33:54.308240891 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:34:24.359860897 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:34:24.364789009 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:34:54.404067993 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:34:54.408915997 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:35:24.249531031 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:35:24.250256062 CET358424567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:35:24.252741098 CET358444567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:35:24.255254030 CET45673584284.200.154.119192.168.2.13
                                    Feb 18, 2025 06:35:24.257714033 CET45673584484.200.154.119192.168.2.13
                                    Feb 18, 2025 06:35:24.257793903 CET358444567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:35:24.297204971 CET358444567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:35:24.302093029 CET45673584484.200.154.119192.168.2.13
                                    Feb 18, 2025 06:35:54.338618994 CET358444567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:35:54.345088959 CET45673584484.200.154.119192.168.2.13
                                    Feb 18, 2025 06:36:24.383183956 CET358444567192.168.2.1384.200.154.119
                                    Feb 18, 2025 06:36:24.388011932 CET45673584484.200.154.119192.168.2.13
                                    TimestampSource PortDest PortSource IPDest IP
                                    Feb 18, 2025 06:35:46.997431040 CET3529553192.168.2.138.8.8.8
                                    Feb 18, 2025 06:35:46.997551918 CET3672953192.168.2.138.8.8.8
                                    Feb 18, 2025 06:35:47.004059076 CET53352958.8.8.8192.168.2.13
                                    Feb 18, 2025 06:35:47.004120111 CET53367298.8.8.8192.168.2.13
                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                    Feb 18, 2025 06:35:46.997431040 CET192.168.2.138.8.8.80x39c4Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                    Feb 18, 2025 06:35:46.997551918 CET192.168.2.138.8.8.80xce29Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                    Feb 18, 2025 06:35:47.004059076 CET8.8.8.8192.168.2.130x39c4No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                    Feb 18, 2025 06:35:47.004059076 CET8.8.8.8192.168.2.130x39c4No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                                    System Behavior

                                    Start time (UTC):05:33:01
                                    Start date (UTC):18/02/2025
                                    Path:/tmp/sshd.elf
                                    Arguments:/tmp/sshd.elf
                                    File size:5773336 bytes
                                    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                    Start time (UTC):05:33:01
                                    Start date (UTC):18/02/2025
                                    Path:/tmp/sshd.elf
                                    Arguments:-
                                    File size:5773336 bytes
                                    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                    Start time (UTC):05:33:01
                                    Start date (UTC):18/02/2025
                                    Path:/tmp/sshd.elf
                                    Arguments:-
                                    File size:5773336 bytes
                                    MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9