Edit tour

Linux Analysis Report
m-p.s-l.Sakura.elf

Overview

General Information

Sample name:m-p.s-l.Sakura.elf
Analysis ID:1625160
MD5:c1751a3301865f176d8008f3a71293cd
SHA1:b8d93a127dafd2dc296dc704691ecaf5d8097984
SHA256:ab55c918dfb95bee50423287b52909ee59e5791b820b08c22d7be6bcd6a59db1
Tags:elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai
Score:100
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Gafgyt
Yara detected Mirai
Contains symbols with names commonly found in malware
Opens /proc/net/* files useful for finding connected devices and routers
Detected TCP or UDP traffic on non-standard ports
Executes the "rm" command used to delete files or directories
Sample contains strings that are user agent strings indicative of HTTP manipulation
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1625160
Start date and time:2025-02-26 20:49:48 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 57s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:m-p.s-l.Sakura.elf
Detection:MAL
Classification:mal100.spre.troj.linELF@0/0@2/0
  • VT rate limit hit for: 185.224.0.148:606
Command:/tmp/m-p.s-l.Sakura.elf
PID:5509
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 5476, Parent: 3632)
  • rm (PID: 5476, Parent: 3632, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.rhgTkvJk5R /tmp/tmp.Bh7e0qF7Q5 /tmp/tmp.xJ4SZyXcDC
  • dash New Fork (PID: 5477, Parent: 3632)
  • cat (PID: 5477, Parent: 3632, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.rhgTkvJk5R
  • dash New Fork (PID: 5478, Parent: 3632)
  • head (PID: 5478, Parent: 3632, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5479, Parent: 3632)
  • tr (PID: 5479, Parent: 3632, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5480, Parent: 3632)
  • cut (PID: 5480, Parent: 3632, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5482, Parent: 3632)
  • cat (PID: 5482, Parent: 3632, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.rhgTkvJk5R
  • dash New Fork (PID: 5483, Parent: 3632)
  • head (PID: 5483, Parent: 3632, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5484, Parent: 3632)
  • tr (PID: 5484, Parent: 3632, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5485, Parent: 3632)
  • cut (PID: 5485, Parent: 3632, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5489, Parent: 3632)
  • rm (PID: 5489, Parent: 3632, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.rhgTkvJk5R /tmp/tmp.Bh7e0qF7Q5 /tmp/tmp.xJ4SZyXcDC
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Bashlite, GafgytBashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
m-p.s-l.Sakura.elfJoeSecurity_GafgytYara detected GafgytJoe Security
    m-p.s-l.Sakura.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      m-p.s-l.Sakura.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x19ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      SourceRuleDescriptionAuthorStrings
      5509.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5509.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x19ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        5511.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5511.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x19ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19b94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19ba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19be4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19bf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x19c70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          Process Memory Space: m-p.s-l.Sakura.elf PID: 5509JoeSecurity_Mirai_8Yara detected MiraiJoe Security
            Click to see the 3 entries
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-02-26T20:50:30.156794+010028465261A Network Trojan was detected192.168.2.1458168185.224.0.148606TCP
            2025-02-26T20:50:51.527590+010028465261A Network Trojan was detected192.168.2.1458170185.224.0.148606TCP
            2025-02-26T20:51:12.901738+010028465261A Network Trojan was detected192.168.2.1458172185.224.0.148606TCP
            2025-02-26T20:51:34.261142+010028465261A Network Trojan was detected192.168.2.1458174185.224.0.148606TCP
            2025-02-26T20:51:55.666769+010028465261A Network Trojan was detected192.168.2.1458176185.224.0.148606TCP
            2025-02-26T20:52:17.045082+010028465261A Network Trojan was detected192.168.2.1458178185.224.0.148606TCP
            2025-02-26T20:52:38.400815+010028465261A Network Trojan was detected192.168.2.1458180185.224.0.148606TCP
            2025-02-26T20:52:59.780924+010028465261A Network Trojan was detected192.168.2.1458182185.224.0.148606TCP
            2025-02-26T20:53:21.151161+010028465261A Network Trojan was detected192.168.2.1458184185.224.0.148606TCP
            2025-02-26T20:53:42.528699+010028465261A Network Trojan was detected192.168.2.1458186185.224.0.148606TCP
            2025-02-26T20:54:03.903681+010028465261A Network Trojan was detected192.168.2.1458188185.224.0.148606TCP

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: m-p.s-l.Sakura.elfAvira: detected
            Source: m-p.s-l.Sakura.elfMalware Configuration Extractor: Gafgyt {"C2 url": "185.224.0.148:606"}
            Source: m-p.s-l.Sakura.elfVirustotal: Detection: 57%Perma Link
            Source: m-p.s-l.Sakura.elfReversingLabs: Detection: 52%
            Source: unknownHTTPS traffic detected: 34.243.160.129:443 -> 192.168.2.14:42470 version: TLS 1.2

            Spreading

            barindex
            Source: /tmp/m-p.s-l.Sakura.elf (PID: 5509)Opens: /proc/net/routeJump to behavior

            Networking

            barindex
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58186 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58180 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58168 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58178 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58170 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58174 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58172 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58176 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58188 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58184 -> 185.224.0.148:606
            Source: Network trafficSuricata IDS: 2846526 - Severity 1 - ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin : 192.168.2.14:58182 -> 185.224.0.148:606
            Source: global trafficTCP traffic: 192.168.2.14:58168 -> 185.224.0.148:606
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: unknownTCP traffic detected without corresponding DNS query: 185.224.0.148
            Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 42470
            Source: unknownNetwork traffic detected: HTTP traffic on port 42470 -> 443
            Source: unknownHTTPS traffic detected: 34.243.160.129:443 -> 192.168.2.14:42470 version: TLS 1.2

            System Summary

            barindex
            Source: m-p.s-l.Sakura.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5509.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: 5511.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5509, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5511, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
            Source: ELF static info symbol of initial sampleName: vseattack
            Source: m-p.s-l.Sakura.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5509.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: 5511.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5509, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5511, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
            Source: classification engineClassification label: mal100.spre.troj.linELF@0/0@2/0
            Source: /usr/bin/dash (PID: 5476)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.rhgTkvJk5R /tmp/tmp.Bh7e0qF7Q5 /tmp/tmp.xJ4SZyXcDCJump to behavior
            Source: /usr/bin/dash (PID: 5489)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.rhgTkvJk5R /tmp/tmp.Bh7e0qF7Q5 /tmp/tmp.xJ4SZyXcDCJump to behavior
            Source: /tmp/m-p.s-l.Sakura.elf (PID: 5509)Queries kernel information via 'uname': Jump to behavior
            Source: m-p.s-l.Sakura.elf, 5509.1.000055dac4d29000.000055dac4db0000.rw-.sdmp, m-p.s-l.Sakura.elf, 5511.1.000055dac4d29000.000055dac4db0000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
            Source: m-p.s-l.Sakura.elf, 5509.1.00007ffceec6d000.00007ffceec8e000.rw-.sdmp, m-p.s-l.Sakura.elf, 5511.1.00007ffceec6d000.00007ffceec8e000.rw-.sdmpBinary or memory string: 'x86_64/usr/bin/qemu-mipsel/tmp/m-p.s-l.Sakura.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/m-p.s-l.Sakura.elf
            Source: m-p.s-l.Sakura.elf, 5509.1.000055dac4d29000.000055dac4db0000.rw-.sdmp, m-p.s-l.Sakura.elf, 5511.1.000055dac4d29000.000055dac4db0000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
            Source: m-p.s-l.Sakura.elf, 5509.1.00007ffceec6d000.00007ffceec8e000.rw-.sdmp, m-p.s-l.Sakura.elf, 5511.1.00007ffceec6d000.00007ffceec8e000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: m-p.s-l.Sakura.elf, type: SAMPLE
            Source: Yara matchFile source: m-p.s-l.Sakura.elf, type: SAMPLE
            Source: Yara matchFile source: 5509.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5511.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5509, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5511, type: MEMORYSTR
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
            Source: Initial sampleUser agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: m-p.s-l.Sakura.elf, type: SAMPLE
            Source: Yara matchFile source: m-p.s-l.Sakura.elf, type: SAMPLE
            Source: Yara matchFile source: 5509.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: 5511.1.00007f0ea0400000.00007f0ea041d000.r-x.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5509, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: m-p.s-l.Sakura.elf PID: 5511, type: MEMORYSTR
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
            File Deletion
            OS Credential Dumping11
            Security Software Discovery
            Remote ServicesData from Local System1
            Data Obfuscation
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
            Remote System Discovery
            Remote Desktop ProtocolData from Removable Media1
            Encrypted Channel
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
            Non-Standard Port
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
            Non-Application Layer Protocol
            Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsInternet Connection DiscoverySSHKeylogging2
            Application Layer Protocol
            Scheduled TransferData Encrypted for Impact
            {
              "C2 url": "185.224.0.148:606"
            }
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Number of created Files
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1625160 Sample: m-p.s-l.Sakura.elf Startdate: 26/02/2025 Architecture: LINUX Score: 100 21 185.224.0.148, 58168, 58170, 58172 ELEKTROHATTR Turkey 2->21 23 34.243.160.129, 42470, 443 AMAZON-02US United States 2->23 25 daisy.ubuntu.com 2->25 27 Suricata IDS alerts for network traffic 2->27 29 Found malware configuration 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 5 other signatures 2->33 8 dash rm m-p.s-l.Sakura.elf 2->8         started        11 dash rm 2->11         started        13 dash cat 2->13         started        15 7 other processes 2->15 signatures3 process4 signatures5 35 Opens /proc/net/* files useful for finding connected devices and routers 8->35 17 m-p.s-l.Sakura.elf 8->17         started        process6 process7 19 m-p.s-l.Sakura.elf 17->19         started       

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            m-p.s-l.Sakura.elf57%VirustotalBrowse
            m-p.s-l.Sakura.elf53%ReversingLabsLinux.Backdoor.Gafgyt
            m-p.s-l.Sakura.elf100%AviraEXP/ELF.Mirai.Z.A
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches

            Download Network PCAP: filteredfull

            NameIPActiveMaliciousAntivirus DetectionReputation
            daisy.ubuntu.com
            162.213.35.24
            truefalse
              high
              NameMaliciousAntivirus DetectionReputation
              185.224.0.148:606true
                unknown
                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs
                IPDomainCountryFlagASNASN NameMalicious
                34.243.160.129
                unknownUnited States
                16509AMAZON-02USfalse
                185.224.0.148
                unknownTurkey
                204938ELEKTROHATTRtrue
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                34.243.160.129m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                  zbotx86.elfGet hashmaliciousTsunamiBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      Space.i686.elfGet hashmaliciousUnknownBrowse
                        armv4l.elfGet hashmaliciousUnknownBrowse
                          main_arm7.elfGet hashmaliciousMiraiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              Ayedz.x86.elfGet hashmaliciousMirai, GafgytBrowse
                                ppc.elfGet hashmaliciousMirai, MoobotBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    185.224.0.148a-r.m-7.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                      x-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                        i-5.8-6.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                          a-r.m-5.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                            a-r.m-6.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              m-i.p-s.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                daisy.ubuntu.comx-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 162.213.35.24
                                                i-5.8-6.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 162.213.35.24
                                                a-r.m-5.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 162.213.35.25
                                                m-i.p-s.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 162.213.35.24
                                                sh4.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                • 162.213.35.25
                                                m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                • 162.213.35.25
                                                arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                • 162.213.35.24
                                                arm5.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                • 162.213.35.25
                                                .i.elfGet hashmaliciousUnknownBrowse
                                                • 162.213.35.25
                                                x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                • 162.213.35.25
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                ELEKTROHATTRa-r.m-7.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.148
                                                x-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.148
                                                i-5.8-6.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.148
                                                a-r.m-5.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.148
                                                a-r.m-6.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.148
                                                m-i.p-s.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.148
                                                skid.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.18
                                                skid.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.18
                                                na.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.18
                                                skid.sparc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                • 185.224.0.18
                                                AMAZON-02UShttps://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fwsartori.simvoly.com%2f%3fpreview%3d%5f%5fPREVIEW%5fONLY&umid=af1074be-5255-48f7-8a50-79659e233aff&rct=1740559700&auth=a5e81ac1e55c7622d906aef65ac356304f36468c-8a56bf00521c8b1e2c236471280232e1ca52e6f0Get hashmaliciousHTMLPhisherBrowse
                                                • 108.138.26.118
                                                m68k.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                • 34.243.160.129
                                                PO71025.exeGet hashmaliciousRDPWrap Tool, AveMaria, PrivateLoader, UACMeBrowse
                                                • 18.244.18.95
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 54.171.230.55
                                                zbotx86.elfGet hashmaliciousTsunamiBrowse
                                                • 34.243.160.129
                                                https://form.questionscout.com/67b5bc1a1a5964e3bafd5939Get hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                • 18.245.33.6
                                                REMITTANCE DETAILS....xlsxGet hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                • 18.245.33.131
                                                REMITTANCE DETAILS....xlsxGet hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                • 18.245.33.131
                                                https://cexpr.es/c?n=9333330072979347Get hashmaliciousPhisherBrowse
                                                • 99.86.4.119
                                                https://www.dropbox.com/scl/fi/cya4f8tuy3xt9nqu1lgkc/You-have-received-a-new-document.paper?rlkey=hhkjelxu8vk69ysraacvkprk5&st=p3fqq8q7&dl=0Get hashmaliciousUnknownBrowse
                                                • 143.204.215.83
                                                No context
                                                No context
                                                No created / dropped files found
                                                File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
                                                Entropy (8bit):5.334469474501974
                                                TrID:
                                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                File name:m-p.s-l.Sakura.elf
                                                File size:152'382 bytes
                                                MD5:c1751a3301865f176d8008f3a71293cd
                                                SHA1:b8d93a127dafd2dc296dc704691ecaf5d8097984
                                                SHA256:ab55c918dfb95bee50423287b52909ee59e5791b820b08c22d7be6bcd6a59db1
                                                SHA512:cca7fadbb7becf74f3f9b95ae5aa1df527a20fc8ebc7ee343b4639264ec581ce207a9a5ff0eccc4deb3e40494f44cb233f89764158fb7528b95a8dfcea6262ca
                                                SSDEEP:1536:rryejez5tMXrpyrTpHToBA9i4ANqm/VBymv4YmPQ:rrVrsrTd7kPwmNBymgYmPQ
                                                TLSH:0EE3A51BAB615EB7D80ECE33019A892111CED19653D9BF6BB2B4CA1CF74B94E08D3D44
                                                File Content Preview:.ELF......................@.4...........4. ...(........p......@...@...........................@...@...........................B...B......z..............T...T.B.T.B.................Q.td................................................pCC....<.B.'!......'...

                                                ELF header

                                                Class:ELF32
                                                Data:2's complement, little endian
                                                Version:1 (current)
                                                Machine:MIPS R3000
                                                Version Number:0x1
                                                Type:EXEC (Executable file)
                                                OS/ABI:UNIX - System V
                                                ABI Version:0
                                                Entry Point Address:0x4002d0
                                                Flags:0x1007
                                                ELF Header Size:52
                                                Program Header Offset:52
                                                Program Header Size:32
                                                Number of Program Headers:5
                                                Section Header Offset:128492
                                                Section Header Size:40
                                                Number of Section Headers:23
                                                Header String Table Index:20
                                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                NULL0x00x00x00x00x0000
                                                .reginfoMIPS_REGINFO0x4000d40xd40x180x180x2A004
                                                .initPROGBITS0x4000ec0xec0x8c0x00x6AX004
                                                .textPROGBITS0x4001800x1800x191f00x00x6AX0016
                                                .finiPROGBITS0x4193700x193700x5c0x00x6AX004
                                                .rodataPROGBITS0x4193d00x193d00x2c400x00x2A0016
                                                .eh_framePROGBITS0x42c0100x1c0100x440x00x3WA004
                                                .tbssNOBITS0x42c0540x1c0540x80x00x403WAT004
                                                .ctorsPROGBITS0x42c0540x1c0540x80x00x3WA004
                                                .dtorsPROGBITS0x42c05c0x1c05c0x80x00x3WA004
                                                .jcrPROGBITS0x42c0640x1c0640x40x00x3WA004
                                                .data.rel.roPROGBITS0x42c0680x1c0680x200x00x3WA004
                                                .dataPROGBITS0x42c0900x1c0900x2f00x00x3WA0016
                                                .gotPROGBITS0x42c3800x1c3800x5100x40x10000003WAp0016
                                                .sdataPROGBITS0x42c8900x1c8900x40x00x10000003WAp004
                                                .sbssNOBITS0x42c8940x1c8940x4c0x00x10000003WAp004
                                                .bssNOBITS0x42c8e00x1c8940x71480x00x3WA0016
                                                .commentPROGBITS0x00x1c8940xbd00x00x0001
                                                .mdebug.abi32PROGBITS0xbd00x1d4640x00x00x0001
                                                .pdrPROGBITS0x00x1d4640x20e00x00x0004
                                                .shstrtabSTRTAB0x00x1f5440xa70x00x0001
                                                .symtabSYMTAB0x00x1f9840x32d00x100x0223274
                                                .strtabSTRTAB0x00x22c540x26ea0x00x0001
                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                <unknown>0xd40x4000d40x4000d40x180x180.90000x4R 0x4.reginfo
                                                LOAD0x00x4000000x4000000x1c0100x1c0105.29860x5R E0x10000.reginfo .init .text .fini .rodata
                                                LOAD0x1c0100x42c0100x42c0100x8840x7a184.58140x6RW 0x10000.eh_frame .tbss .ctors .dtors .jcr .data.rel.ro .data .got .sdata .sbss .bss
                                                TLS0x1c0540x42c0540x42c0540x00x80.00000x4R 0x4.tbss
                                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                                .symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                .symtab0x4000d40SECTION<unknown>DEFAULT1
                                                .symtab0x4000ec0SECTION<unknown>DEFAULT2
                                                .symtab0x4001800SECTION<unknown>DEFAULT3
                                                .symtab0x4193700SECTION<unknown>DEFAULT4
                                                .symtab0x4193d00SECTION<unknown>DEFAULT5
                                                .symtab0x42c0100SECTION<unknown>DEFAULT6
                                                .symtab0x42c0540SECTION<unknown>DEFAULT7
                                                .symtab0x42c0540SECTION<unknown>DEFAULT8
                                                .symtab0x42c05c0SECTION<unknown>DEFAULT9
                                                .symtab0x42c0640SECTION<unknown>DEFAULT10
                                                .symtab0x42c0680SECTION<unknown>DEFAULT11
                                                .symtab0x42c0900SECTION<unknown>DEFAULT12
                                                .symtab0x42c3800SECTION<unknown>DEFAULT13
                                                .symtab0x42c8900SECTION<unknown>DEFAULT14
                                                .symtab0x42c8940SECTION<unknown>DEFAULT15
                                                .symtab0x42c8e00SECTION<unknown>DEFAULT16
                                                .symtab0x00SECTION<unknown>DEFAULT17
                                                .symtab0xbd00SECTION<unknown>DEFAULT18
                                                .symtab0x00SECTION<unknown>DEFAULT19
                                                C.1.5091.symtab0x41ae7024OBJECT<unknown>DEFAULT5
                                                C.108.5618.symtab0x42c0688OBJECT<unknown>DEFAULT11
                                                C.141.5930.symtab0x42c07024OBJECT<unknown>DEFAULT11
                                                C.3.5380.symtab0x41ae4c12OBJECT<unknown>DEFAULT5
                                                C.3.6092.symtab0x41af8012OBJECT<unknown>DEFAULT5
                                                C.3.6114.symtab0x41aeb812OBJECT<unknown>DEFAULT5
                                                C.3.6172.symtab0x41ae9012OBJECT<unknown>DEFAULT5
                                                C.4.6115.symtab0x41aeac12OBJECT<unknown>DEFAULT5
                                                C.5.6123.symtab0x41aea012OBJECT<unknown>DEFAULT5
                                                C.6.5518.symtab0x41ae4012OBJECT<unknown>DEFAULT5
                                                FRAMESZ.symtab0x200NOTYPE<unknown>DEFAULTSHN_ABS
                                                GPOFF.symtab0x180NOTYPE<unknown>DEFAULTSHN_ABS
                                                LOCALSZ.symtab0x30NOTYPE<unknown>DEFAULTSHN_ABS
                                                Q.symtab0x42c91816384OBJECT<unknown>DEFAULT16
                                                RAOFF.symtab0x1c0NOTYPE<unknown>DEFAULTSHN_ABS
                                                Sakura_Bot.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                SendSTD.symtab0x404784524FUNC<unknown>DEFAULT3
                                                SendSTDHEX.symtab0x4038ec548FUNC<unknown>DEFAULT3
                                                SendSTD_HEX.symtab0x404ba8596FUNC<unknown>DEFAULT3
                                                SendUDP.symtab0x4029381704FUNC<unknown>DEFAULT3
                                                V0OFF.symtab0x140NOTYPE<unknown>DEFAULTSHN_ABS
                                                _Exit.symtab0x40a1d076FUNC<unknown>DEFAULT3
                                                _GLOBAL_OFFSET_TABLE_.symtab0x42c3800OBJECT<unknown>DEFAULT13
                                                _Jv_RegisterClasses.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                _READ.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _WRITE.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __CTOR_END__.symtab0x42c0580OBJECT<unknown>DEFAULT8
                                                __CTOR_LIST__.symtab0x42c0540OBJECT<unknown>DEFAULT8
                                                __C_ctype_b.symtab0x42c0e04OBJECT<unknown>DEFAULT12
                                                __C_ctype_b.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __C_ctype_b_data.symtab0x41a3f0768OBJECT<unknown>DEFAULT5
                                                __C_ctype_tolower.symtab0x42c3704OBJECT<unknown>DEFAULT12
                                                __C_ctype_tolower.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __C_ctype_tolower_data.symtab0x41bd10768OBJECT<unknown>DEFAULT5
                                                __C_ctype_toupper.symtab0x42c0f04OBJECT<unknown>DEFAULT12
                                                __C_ctype_toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __C_ctype_toupper_data.symtab0x41a6f0768OBJECT<unknown>DEFAULT5
                                                __DTOR_END__.symtab0x42c0600OBJECT<unknown>DEFAULT9
                                                __DTOR_LIST__.symtab0x42c05c0OBJECT<unknown>DEFAULT9
                                                __EH_FRAME_BEGIN__.symtab0x42c0100OBJECT<unknown>DEFAULT6
                                                __FRAME_END__.symtab0x42c0500OBJECT<unknown>DEFAULT6
                                                __GI___C_ctype_b.symtab0x42c0e04OBJECT<unknown>HIDDEN12
                                                __GI___C_ctype_tolower.symtab0x42c3704OBJECT<unknown>HIDDEN12
                                                __GI___C_ctype_toupper.symtab0x42c0f04OBJECT<unknown>HIDDEN12
                                                __GI___close.symtab0x40e2dc176FUNC<unknown>HIDDEN3
                                                __GI___close_nocancel.symtab0x40e2b440FUNC<unknown>HIDDEN3
                                                __GI___ctype_b.symtab0x42c0e44OBJECT<unknown>HIDDEN12
                                                __GI___ctype_tolower.symtab0x42c3744OBJECT<unknown>HIDDEN12
                                                __GI___ctype_toupper.symtab0x42c0f44OBJECT<unknown>HIDDEN12
                                                __GI___errno_location.symtab0x40a61028FUNC<unknown>HIDDEN3
                                                __GI___fcntl_nocancel.symtab0x40a050108FUNC<unknown>HIDDEN3
                                                __GI___fgetc_unlocked.symtab0x4114a0388FUNC<unknown>HIDDEN3
                                                __GI___glibc_strerror_r.symtab0x41759068FUNC<unknown>HIDDEN3
                                                __GI___libc_close.symtab0x40e2dc176FUNC<unknown>HIDDEN3
                                                __GI___libc_fcntl.symtab0x40a0bc268FUNC<unknown>HIDDEN3
                                                __GI___libc_open.symtab0x40e3cc192FUNC<unknown>HIDDEN3
                                                __GI___libc_read.symtab0x40e5cc192FUNC<unknown>HIDDEN3
                                                __GI___libc_waitpid.symtab0x40e6cc192FUNC<unknown>HIDDEN3
                                                __GI___libc_write.symtab0x40e4cc192FUNC<unknown>HIDDEN3
                                                __GI___open.symtab0x40e3cc192FUNC<unknown>HIDDEN3
                                                __GI___open_nocancel.symtab0x40e3a440FUNC<unknown>HIDDEN3
                                                __GI___read.symtab0x40e5cc192FUNC<unknown>HIDDEN3
                                                __GI___read_nocancel.symtab0x40e5a440FUNC<unknown>HIDDEN3
                                                __GI___register_atfork.symtab0x40dd40452FUNC<unknown>HIDDEN3
                                                __GI___sigaddset.symtab0x40b53844FUNC<unknown>HIDDEN3
                                                __GI___sigdelset.symtab0x40b56448FUNC<unknown>HIDDEN3
                                                __GI___sigismember.symtab0x40b51040FUNC<unknown>HIDDEN3
                                                __GI___uClibc_fini.symtab0x40e940204FUNC<unknown>HIDDEN3
                                                __GI___uClibc_init.symtab0x40ea94120FUNC<unknown>HIDDEN3
                                                __GI___waitpid.symtab0x40e6cc192FUNC<unknown>HIDDEN3
                                                __GI___write.symtab0x40e4cc192FUNC<unknown>HIDDEN3
                                                __GI___write_nocancel.symtab0x40e4a440FUNC<unknown>HIDDEN3
                                                __GI___xpg_strerror_r.symtab0x4175e0380FUNC<unknown>HIDDEN3
                                                __GI__exit.symtab0x40a1d076FUNC<unknown>HIDDEN3
                                                __GI_abort.symtab0x40c720408FUNC<unknown>HIDDEN3
                                                __GI_atoi.symtab0x40d04028FUNC<unknown>HIDDEN3
                                                __GI_brk.symtab0x412e2080FUNC<unknown>HIDDEN3
                                                __GI_chdir.symtab0x40a26056FUNC<unknown>HIDDEN3
                                                __GI_close.symtab0x40e2dc176FUNC<unknown>HIDDEN3
                                                __GI_closedir.symtab0x40f4b0292FUNC<unknown>HIDDEN3
                                                __GI_config_close.symtab0x40fea4132FUNC<unknown>HIDDEN3
                                                __GI_config_open.symtab0x40ff28116FUNC<unknown>HIDDEN3
                                                __GI_config_read.symtab0x40f9e01220FUNC<unknown>HIDDEN3
                                                __GI_connect.symtab0x40ae0c220FUNC<unknown>HIDDEN3
                                                __GI_exit.symtab0x40d270240FUNC<unknown>HIDDEN3
                                                __GI_fclose.symtab0x40ffa0804FUNC<unknown>HIDDEN3
                                                __GI_fcntl.symtab0x40a0bc268FUNC<unknown>HIDDEN3
                                                __GI_fflush_unlocked.symtab0x4110e8940FUNC<unknown>HIDDEN3
                                                __GI_fgetc.symtab0x410ba0372FUNC<unknown>HIDDEN3
                                                __GI_fgetc_unlocked.symtab0x4114a0388FUNC<unknown>HIDDEN3
                                                __GI_fgets.symtab0x410d20320FUNC<unknown>HIDDEN3
                                                __GI_fgets_unlocked.symtab0x411630276FUNC<unknown>HIDDEN3
                                                __GI_fopen.symtab0x4102d028FUNC<unknown>HIDDEN3
                                                __GI_fork.symtab0x40d910988FUNC<unknown>HIDDEN3
                                                __GI_fputs_unlocked.symtab0x417300124FUNC<unknown>HIDDEN3
                                                __GI_fseek.symtab0x418f4068FUNC<unknown>HIDDEN3
                                                __GI_fseeko64.symtab0x418f90500FUNC<unknown>HIDDEN3
                                                __GI_fstat.symtab0x412ef0136FUNC<unknown>HIDDEN3
                                                __GI_fwrite_unlocked.symtab0x417380268FUNC<unknown>HIDDEN3
                                                __GI_getc_unlocked.symtab0x4114a0388FUNC<unknown>HIDDEN3
                                                __GI_getdtablesize.symtab0x40f10072FUNC<unknown>HIDDEN3
                                                __GI_getegid.symtab0x40f15016FUNC<unknown>HIDDEN3
                                                __GI_geteuid.symtab0x40f16016FUNC<unknown>HIDDEN3
                                                __GI_getgid.symtab0x40f17016FUNC<unknown>HIDDEN3
                                                __GI_gethostbyname.symtab0x40ad4028FUNC<unknown>HIDDEN3
                                                __GI_gethostbyname2.symtab0x40ad60104FUNC<unknown>HIDDEN3
                                                __GI_gethostbyname2_r.symtab0x412030948FUNC<unknown>HIDDEN3
                                                __GI_gethostbyname_r.symtab0x415580968FUNC<unknown>HIDDEN3
                                                __GI_gethostname.symtab0x4159b0192FUNC<unknown>HIDDEN3
                                                __GI_getpagesize.symtab0x40f18048FUNC<unknown>HIDDEN3
                                                __GI_getpid.symtab0x40df1084FUNC<unknown>HIDDEN3
                                                __GI_getrlimit.symtab0x40f1b060FUNC<unknown>HIDDEN3
                                                __GI_getsockname.symtab0x40aef060FUNC<unknown>HIDDEN3
                                                __GI_getuid.symtab0x40f1f016FUNC<unknown>HIDDEN3
                                                __GI_htonl.symtab0x40ab9840FUNC<unknown>HIDDEN3
                                                __GI_htons.symtab0x40ab8024FUNC<unknown>HIDDEN3
                                                __GI_inet_addr.symtab0x40acf072FUNC<unknown>HIDDEN3
                                                __GI_inet_aton.symtab0x411f10284FUNC<unknown>HIDDEN3
                                                __GI_inet_ntoa.symtab0x40accc32FUNC<unknown>HIDDEN3
                                                __GI_inet_ntoa_r.symtab0x40ac00204FUNC<unknown>HIDDEN3
                                                __GI_inet_ntop.symtab0x413ddc852FUNC<unknown>HIDDEN3
                                                __GI_inet_pton.symtab0x413968696FUNC<unknown>HIDDEN3
                                                __GI_initstate_r.symtab0x40cdfc300FUNC<unknown>HIDDEN3
                                                __GI_ioctl.symtab0x40a2a0248FUNC<unknown>HIDDEN3
                                                __GI_isatty.symtab0x411e2060FUNC<unknown>HIDDEN3
                                                __GI_isspace.symtab0x40a5a044FUNC<unknown>HIDDEN3
                                                __GI_kill.symtab0x40a3a056FUNC<unknown>HIDDEN3
                                                __GI_lseek64.symtab0x415c60136FUNC<unknown>HIDDEN3
                                                __GI_memchr.symtab0x418b70260FUNC<unknown>HIDDEN3
                                                __GI_memcpy.symtab0x40a630308FUNC<unknown>HIDDEN3
                                                __GI_memmove.symtab0x411750824FUNC<unknown>HIDDEN3
                                                __GI_mempcpy.symtab0x4136b076FUNC<unknown>HIDDEN3
                                                __GI_memrchr.symtab0x418c80260FUNC<unknown>HIDDEN3
                                                __GI_memset.symtab0x40a770144FUNC<unknown>HIDDEN3
                                                __GI_mmap.symtab0x40ef80112FUNC<unknown>HIDDEN3
                                                __GI_mremap.symtab0x412f8096FUNC<unknown>HIDDEN3
                                                __GI_munmap.symtab0x40f20060FUNC<unknown>HIDDEN3
                                                __GI_nanosleep.symtab0x40f27c200FUNC<unknown>HIDDEN3
                                                __GI_ntohl.symtab0x40abd840FUNC<unknown>HIDDEN3
                                                __GI_ntohs.symtab0x40abc024FUNC<unknown>HIDDEN3
                                                __GI_open.symtab0x40e3cc192FUNC<unknown>HIDDEN3
                                                __GI_opendir.symtab0x40f6f4240FUNC<unknown>HIDDEN3
                                                __GI_poll.symtab0x415aac220FUNC<unknown>HIDDEN3
                                                __GI_raise.symtab0x40df70264FUNC<unknown>HIDDEN3
                                                __GI_random.symtab0x40c8e0164FUNC<unknown>HIDDEN3
                                                __GI_random_r.symtab0x40cbc0172FUNC<unknown>HIDDEN3
                                                __GI_rawmemchr.symtab0x413700192FUNC<unknown>HIDDEN3
                                                __GI_read.symtab0x40e5cc192FUNC<unknown>HIDDEN3
                                                __GI_readdir64.symtab0x40f8d0272FUNC<unknown>HIDDEN3
                                                __GI_recv.symtab0x40afcc240FUNC<unknown>HIDDEN3
                                                __GI_sbrk.symtab0x40f350164FUNC<unknown>HIDDEN3
                                                __GI_select.symtab0x40a440260FUNC<unknown>HIDDEN3
                                                __GI_send.symtab0x40b0fc240FUNC<unknown>HIDDEN3
                                                __GI_sendto.symtab0x40b260280FUNC<unknown>HIDDEN3
                                                __GI_setsid.symtab0x40a55060FUNC<unknown>HIDDEN3
                                                __GI_setsockopt.symtab0x40b38096FUNC<unknown>HIDDEN3
                                                __GI_setstate_r.symtab0x40cf28272FUNC<unknown>HIDDEN3
                                                __GI_sigaction.symtab0x40eff028FUNC<unknown>HIDDEN3
                                                __GI_signal.symtab0x40b420228FUNC<unknown>HIDDEN3
                                                __GI_sigprocmask.symtab0x40f400176FUNC<unknown>HIDDEN3
                                                __GI_sleep.symtab0x40e080404FUNC<unknown>HIDDEN3
                                                __GI_socket.symtab0x40b3e060FUNC<unknown>HIDDEN3
                                                __GI_sprintf.symtab0x415cf080FUNC<unknown>HIDDEN3
                                                __GI_srandom_r.symtab0x40cc6c400FUNC<unknown>HIDDEN3
                                                __GI_stat.symtab0x415b90136FUNC<unknown>HIDDEN3
                                                __GI_strcasecmp.symtab0x418d90108FUNC<unknown>HIDDEN3
                                                __GI_strchr.symtab0x40a800248FUNC<unknown>HIDDEN3
                                                __GI_strchrnul.symtab0x411a90248FUNC<unknown>HIDDEN3
                                                __GI_strcmp.symtab0x40a90044FUNC<unknown>HIDDEN3
                                                __GI_strcoll.symtab0x40a90044FUNC<unknown>HIDDEN3
                                                __GI_strcpy.symtab0x40a93036FUNC<unknown>HIDDEN3
                                                __GI_strcspn.symtab0x411b90144FUNC<unknown>HIDDEN3
                                                __GI_strdup.symtab0x417760140FUNC<unknown>HIDDEN3
                                                __GI_strlen.symtab0x40a960184FUNC<unknown>HIDDEN3
                                                __GI_strncpy.symtab0x4137c0188FUNC<unknown>HIDDEN3
                                                __GI_strnlen.symtab0x417490248FUNC<unknown>HIDDEN3
                                                __GI_strpbrk.symtab0x411de064FUNC<unknown>HIDDEN3
                                                __GI_strrchr.symtab0x411c20160FUNC<unknown>HIDDEN3
                                                __GI_strspn.symtab0x411cc072FUNC<unknown>HIDDEN3
                                                __GI_strstr.symtab0x40aa20256FUNC<unknown>HIDDEN3
                                                __GI_strtok.symtab0x40ab6032FUNC<unknown>HIDDEN3
                                                __GI_strtok_r.symtab0x411d10208FUNC<unknown>HIDDEN3
                                                __GI_strtol.symtab0x40d06028FUNC<unknown>HIDDEN3
                                                __GI_sysconf.symtab0x40d55c792FUNC<unknown>HIDDEN3
                                                __GI_tcgetattr.symtab0x411e60176FUNC<unknown>HIDDEN3
                                                __GI_time.symtab0x40a59016FUNC<unknown>HIDDEN3
                                                __GI_toupper.symtab0x40a5d060FUNC<unknown>HIDDEN3
                                                __GI_uname.symtab0x415c2060FUNC<unknown>HIDDEN3
                                                __GI_vsnprintf.symtab0x415d40248FUNC<unknown>HIDDEN3
                                                __GI_waitpid.symtab0x40e6cc192FUNC<unknown>HIDDEN3
                                                __GI_wcrtomb.symtab0x417da0108FUNC<unknown>HIDDEN3
                                                __GI_wcsnrtombs.symtab0x417e50192FUNC<unknown>HIDDEN3
                                                __GI_wcsrtombs.symtab0x417e1064FUNC<unknown>HIDDEN3
                                                __GI_write.symtab0x40e4cc192FUNC<unknown>HIDDEN3
                                                __JCR_END__.symtab0x42c0640OBJECT<unknown>DEFAULT10
                                                __JCR_LIST__.symtab0x42c0640OBJECT<unknown>DEFAULT10
                                                __app_fini.symtab0x43108c4OBJECT<unknown>HIDDEN16
                                                __atexit_lock.symtab0x42c20024OBJECT<unknown>DEFAULT12
                                                __bss_start.symtab0x42c8940NOTYPE<unknown>DEFAULTSHN_ABS
                                                __check_one_fd.symtab0x40ea0c136FUNC<unknown>DEFAULT3
                                                __close.symtab0x40e2dc176FUNC<unknown>DEFAULT3
                                                __close_nameservers.symtab0x415430220FUNC<unknown>HIDDEN3
                                                __close_nocancel.symtab0x40e2b440FUNC<unknown>DEFAULT3
                                                __ctype_b.symtab0x42c0e44OBJECT<unknown>DEFAULT12
                                                __ctype_tolower.symtab0x42c3744OBJECT<unknown>DEFAULT12
                                                __ctype_toupper.symtab0x42c0f44OBJECT<unknown>DEFAULT12
                                                __curbrk.symtab0x4336004OBJECT<unknown>HIDDEN16
                                                __data_start.symtab0x42c0a00OBJECT<unknown>DEFAULT12
                                                __decode_dotted.symtab0x414130400FUNC<unknown>HIDDEN3
                                                __decode_header.symtab0x417910228FUNC<unknown>HIDDEN3
                                                __deregister_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                                __dns_lookup.symtab0x4142c02608FUNC<unknown>HIDDEN3
                                                __do_global_ctors_aux.symtab0x4193000FUNC<unknown>DEFAULT3
                                                __do_global_dtors_aux.symtab0x4001800FUNC<unknown>DEFAULT3
                                                __dso_handle.symtab0x42c8900OBJECT<unknown>HIDDEN14
                                                __encode_dotted.symtab0x418e00316FUNC<unknown>HIDDEN3
                                                __encode_header.symtab0x4177f0276FUNC<unknown>HIDDEN3
                                                __encode_question.symtab0x417a00172FUNC<unknown>HIDDEN3
                                                __environ.symtab0x4310844OBJECT<unknown>DEFAULT16
                                                __errno_location.symtab0x40a61028FUNC<unknown>DEFAULT3
                                                __errno_location.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __exit_cleanup.symtab0x430b204OBJECT<unknown>HIDDEN16
                                                __fcntl_nocancel.symtab0x40a050108FUNC<unknown>DEFAULT3
                                                __fgetc_unlocked.symtab0x4114a0388FUNC<unknown>DEFAULT3
                                                __fini_array_end.symtab0x42c0540NOTYPE<unknown>HIDDEN7
                                                __fini_array_start.symtab0x42c0540NOTYPE<unknown>HIDDEN7
                                                __fork.symtab0x40d910988FUNC<unknown>DEFAULT3
                                                __fork_generation_pointer.symtab0x42c89c4OBJECT<unknown>HIDDEN15
                                                __fork_handlers.symtab0x42c8a04OBJECT<unknown>HIDDEN15
                                                __fork_lock.symtab0x430b304OBJECT<unknown>HIDDEN16
                                                __get_hosts_byname_r.symtab0x415510104FUNC<unknown>HIDDEN3
                                                __getdents64.symtab0x4131c0436FUNC<unknown>HIDDEN3
                                                __getpagesize.symtab0x40f18048FUNC<unknown>DEFAULT3
                                                __getpid.symtab0x40df1084FUNC<unknown>DEFAULT3
                                                __glibc_strerror_r.symtab0x41759068FUNC<unknown>DEFAULT3
                                                __glibc_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __h_errno_location.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                                __init_array_end.symtab0x42c0540NOTYPE<unknown>HIDDEN7
                                                __init_array_start.symtab0x42c0540NOTYPE<unknown>HIDDEN7
                                                __libc_close.symtab0x40e2dc176FUNC<unknown>DEFAULT3
                                                __libc_connect.symtab0x40ae0c220FUNC<unknown>DEFAULT3
                                                __libc_disable_asynccancel.symtab0x40e790136FUNC<unknown>HIDDEN3
                                                __libc_enable_asynccancel.symtab0x40e818220FUNC<unknown>HIDDEN3
                                                __libc_errno.symtab0x04TLS<unknown>HIDDEN7
                                                __libc_fcntl.symtab0x40a0bc268FUNC<unknown>DEFAULT3
                                                __libc_fork.symtab0x40d910988FUNC<unknown>DEFAULT3
                                                __libc_h_errno.symtab0x44TLS<unknown>HIDDEN7
                                                __libc_nanosleep.symtab0x40f27c200FUNC<unknown>DEFAULT3
                                                __libc_open.symtab0x40e3cc192FUNC<unknown>DEFAULT3
                                                __libc_read.symtab0x40e5cc192FUNC<unknown>DEFAULT3
                                                __libc_recv.symtab0x40afcc240FUNC<unknown>DEFAULT3
                                                __libc_select.symtab0x40a440260FUNC<unknown>DEFAULT3
                                                __libc_send.symtab0x40b0fc240FUNC<unknown>DEFAULT3
                                                __libc_sendto.symtab0x40b260280FUNC<unknown>DEFAULT3
                                                __libc_setup_tls.symtab0x412aa8660FUNC<unknown>DEFAULT3
                                                __libc_sigaction.symtab0x40eff028FUNC<unknown>DEFAULT3
                                                __libc_stack_end.symtab0x4310804OBJECT<unknown>DEFAULT16
                                                __libc_waitpid.symtab0x40e6cc192FUNC<unknown>DEFAULT3
                                                __libc_write.symtab0x40e4cc192FUNC<unknown>DEFAULT3
                                                __linkin_atfork.symtab0x40dcf080FUNC<unknown>HIDDEN3
                                                __lll_lock_wait_private.symtab0x40e220120FUNC<unknown>HIDDEN3
                                                __local_nameserver.symtab0x41af7016OBJECT<unknown>HIDDEN5
                                                __malloc_consolidate.symtab0x40c224520FUNC<unknown>HIDDEN3
                                                __malloc_largebin_index.symtab0x40b5a0140FUNC<unknown>DEFAULT3
                                                __malloc_lock.symtab0x42c10024OBJECT<unknown>DEFAULT12
                                                __malloc_state.symtab0x433660888OBJECT<unknown>DEFAULT16
                                                __malloc_trim.symtab0x40c100292FUNC<unknown>DEFAULT3
                                                __nameserver.symtab0x42c8d44OBJECT<unknown>HIDDEN15
                                                __nameservers.symtab0x42c8d84OBJECT<unknown>HIDDEN15
                                                __nptl_deallocate_tsd.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                                __nptl_nthreads.symtab0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __open.symtab0x40e3cc192FUNC<unknown>DEFAULT3
                                                __open_etc_hosts.symtab0x417ab032FUNC<unknown>HIDDEN3
                                                __open_nameservers.symtab0x414dc01636FUNC<unknown>HIDDEN3
                                                __open_nocancel.symtab0x40e3a440FUNC<unknown>DEFAULT3
                                                __pagesize.symtab0x4310884OBJECT<unknown>DEFAULT16
                                                __preinit_array_end.symtab0x42c0540NOTYPE<unknown>HIDDEN7
                                                __preinit_array_start.symtab0x42c0540NOTYPE<unknown>HIDDEN7
                                                __progname.symtab0x42c2244OBJECT<unknown>DEFAULT12
                                                __progname_full.symtab0x42c2284OBJECT<unknown>DEFAULT12
                                                __pthread_initialize_minimal.symtab0x412d3c28FUNC<unknown>DEFAULT3
                                                __pthread_mutex_init.symtab0x40e9088FUNC<unknown>DEFAULT3
                                                __pthread_mutex_lock.symtab0x40e9008FUNC<unknown>DEFAULT3
                                                __pthread_mutex_trylock.symtab0x40e9008FUNC<unknown>DEFAULT3
                                                __pthread_mutex_unlock.symtab0x40e9008FUNC<unknown>DEFAULT3
                                                __pthread_return_0.symtab0x40e9008FUNC<unknown>DEFAULT3
                                                __pthread_unwind.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                                __read.symtab0x40e5cc192FUNC<unknown>DEFAULT3
                                                __read_etc_hosts_r.symtab0x417ad0720FUNC<unknown>HIDDEN3
                                                __read_nocancel.symtab0x40e5a440FUNC<unknown>DEFAULT3
                                                __register_atfork.symtab0x40dd40452FUNC<unknown>DEFAULT3
                                                __register_frame_info.symtab0x00FUNC<unknown>DEFAULTSHN_UNDEF
                                                __res_sync.symtab0x42c8cc4OBJECT<unknown>HIDDEN15
                                                __resolv_attempts.symtab0x42c3511OBJECT<unknown>HIDDEN12
                                                __resolv_lock.symtab0x43362024OBJECT<unknown>DEFAULT16
                                                __resolv_timeout.symtab0x42c3501OBJECT<unknown>HIDDEN12
                                                __rtld_fini.symtab0x4310904OBJECT<unknown>HIDDEN16
                                                __searchdomain.symtab0x42c8d04OBJECT<unknown>HIDDEN15
                                                __searchdomains.symtab0x42c8dc4OBJECT<unknown>HIDDEN15
                                                __sigaddset.symtab0x40b53844FUNC<unknown>DEFAULT3
                                                __sigdelset.symtab0x40b56448FUNC<unknown>DEFAULT3
                                                __sigismember.symtab0x40b51040FUNC<unknown>DEFAULT3
                                                __sigjmp_save.symtab0x41595096FUNC<unknown>HIDDEN3
                                                __sigsetjmp.symtab0x40f03036FUNC<unknown>DEFAULT3
                                                __sigsetjmp_aux.symtab0x412e70128FUNC<unknown>DEFAULT3
                                                __start.symtab0x4002d0100FUNC<unknown>DEFAULT3
                                                __stdin.symtab0x42c24c4OBJECT<unknown>DEFAULT12
                                                __stdio_READ.symtab0x413380144FUNC<unknown>HIDDEN3
                                                __stdio_WRITE.symtab0x413410344FUNC<unknown>HIDDEN3
                                                __stdio_adjust_position.symtab0x419190256FUNC<unknown>HIDDEN3
                                                __stdio_fwrite.symtab0x417f10472FUNC<unknown>HIDDEN3
                                                __stdio_rfill.symtab0x41357088FUNC<unknown>HIDDEN3
                                                __stdio_seek.symtab0x419290112FUNC<unknown>HIDDEN3
                                                __stdio_trans2r_o.symtab0x4135d0220FUNC<unknown>HIDDEN3
                                                __stdio_trans2w_o.symtab0x4180f0304FUNC<unknown>HIDDEN3
                                                __stdio_wcommit.symtab0x4109e0100FUNC<unknown>HIDDEN3
                                                __stdout.symtab0x42c2504OBJECT<unknown>DEFAULT12
                                                __sys_connect.symtab0x40add060FUNC<unknown>DEFAULT3
                                                __sys_recv.symtab0x40af9060FUNC<unknown>DEFAULT3
                                                __sys_send.symtab0x40b0c060FUNC<unknown>DEFAULT3
                                                __sys_sendto.symtab0x40b1f0112FUNC<unknown>DEFAULT3
                                                __syscall_error.symtab0x40f06092FUNC<unknown>DEFAULT3
                                                __syscall_fcntl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __syscall_nanosleep.symtab0x40f24060FUNC<unknown>DEFAULT3
                                                __syscall_poll.symtab0x415a7060FUNC<unknown>DEFAULT3
                                                __syscall_rt_sigaction.symtab0x40f0c060FUNC<unknown>DEFAULT3
                                                __syscall_rt_sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __syscall_select.symtab0x40a3e096FUNC<unknown>DEFAULT3
                                                __tls_get_addr.symtab0x412a8832FUNC<unknown>DEFAULT3
                                                __uClibc_fini.symtab0x40e940204FUNC<unknown>DEFAULT3
                                                __uClibc_init.symtab0x40ea94120FUNC<unknown>DEFAULT3
                                                __uClibc_main.symtab0x40eb0c1132FUNC<unknown>DEFAULT3
                                                __uClibc_main.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __uclibc_progname.symtab0x42c2204OBJECT<unknown>HIDDEN12
                                                __waitpid.symtab0x40e6cc192FUNC<unknown>DEFAULT3
                                                __waitpid_nocancel.symtab0x40e6a440FUNC<unknown>DEFAULT3
                                                __write.symtab0x40e4cc192FUNC<unknown>DEFAULT3
                                                __write_nocancel.symtab0x40e4a440FUNC<unknown>DEFAULT3
                                                __xpg_strerror_r.symtab0x4175e0380FUNC<unknown>DEFAULT3
                                                __xpg_strerror_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                __xstat32_conv.symtab0x4130d8220FUNC<unknown>HIDDEN3
                                                __xstat64_conv.symtab0x412fe0248FUNC<unknown>HIDDEN3
                                                _adjust_pos.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _bss_custom_printf_spec.symtab0x43364010OBJECT<unknown>DEFAULT16
                                                _charpad.symtab0x415e40156FUNC<unknown>DEFAULT3
                                                _cs_funcs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _custom_printf_arginfo.symtab0x4339d840OBJECT<unknown>HIDDEN16
                                                _custom_printf_handler.symtab0x433a0040OBJECT<unknown>HIDDEN16
                                                _custom_printf_spec.symtab0x42c3604OBJECT<unknown>HIDDEN12
                                                _dl_aux_init.symtab0x412d6040FUNC<unknown>DEFAULT3
                                                _dl_init_static_tls.symtab0x42c3304OBJECT<unknown>DEFAULT12
                                                _dl_nothread_init_static_tls.symtab0x412d88148FUNC<unknown>HIDDEN3
                                                _dl_phdr.symtab0x42c8c44OBJECT<unknown>DEFAULT15
                                                _dl_phnum.symtab0x42c8c84OBJECT<unknown>DEFAULT15
                                                _dl_tls_dtv_gaps.symtab0x42c8b81OBJECT<unknown>DEFAULT15
                                                _dl_tls_dtv_slotinfo_list.symtab0x42c8b44OBJECT<unknown>DEFAULT15
                                                _dl_tls_generation.symtab0x42c8bc4OBJECT<unknown>DEFAULT15
                                                _dl_tls_max_dtv_idx.symtab0x42c8ac4OBJECT<unknown>DEFAULT15
                                                _dl_tls_setup.symtab0x412a24100FUNC<unknown>DEFAULT3
                                                _dl_tls_static_align.symtab0x42c8a84OBJECT<unknown>DEFAULT15
                                                _dl_tls_static_nelem.symtab0x42c8c04OBJECT<unknown>DEFAULT15
                                                _dl_tls_static_size.symtab0x42c8b04OBJECT<unknown>DEFAULT15
                                                _dl_tls_static_used.symtab0x42c8a44OBJECT<unknown>DEFAULT15
                                                _edata.symtab0x42c8940NOTYPE<unknown>DEFAULTSHN_ABS
                                                _end.symtab0x433a280NOTYPE<unknown>DEFAULTSHN_ABS
                                                _exit.symtab0x40a1d076FUNC<unknown>DEFAULT3
                                                _exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _fbss.symtab0x42c8940NOTYPE<unknown>DEFAULTSHN_ABS
                                                _fdata.symtab0x42c0900NOTYPE<unknown>DEFAULT12
                                                _fini.symtab0x41937028FUNC<unknown>DEFAULT4
                                                _fixed_buffers.symtab0x4310c08192OBJECT<unknown>DEFAULT16
                                                _fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _fp_out_narrow.symtab0x415edc232FUNC<unknown>DEFAULT3
                                                _fpmaxtostr.symtab0x4183002156FUNC<unknown>HIDDEN3
                                                _fpmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _ftext.symtab0x4001800NOTYPE<unknown>DEFAULT3
                                                _fwrite.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _gp.symtab0x4343700NOTYPE<unknown>DEFAULTSHN_ABS
                                                _gp_disp.symtab0x00OBJECT<unknown>DEFAULTSHN_UNDEF
                                                _init.symtab0x4000ec28FUNC<unknown>DEFAULT2
                                                _load_inttype.symtab0x418220136FUNC<unknown>HIDDEN3
                                                _load_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _ppfs_init.symtab0x416860248FUNC<unknown>HIDDEN3
                                                _ppfs_init.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _ppfs_parsespec.symtab0x416c6c1684FUNC<unknown>HIDDEN3
                                                _ppfs_parsespec.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _ppfs_prepargs.symtab0x416960100FUNC<unknown>HIDDEN3
                                                _ppfs_prepargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _ppfs_setargs.symtab0x4169d0548FUNC<unknown>HIDDEN3
                                                _ppfs_setargs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _promoted_size.symtab0x416c00108FUNC<unknown>DEFAULT3
                                                _pthread_cleanup_pop_restore.symtab0x40e91c36FUNC<unknown>DEFAULT3
                                                _pthread_cleanup_push_defer.symtab0x40e91012FUNC<unknown>DEFAULT3
                                                _rfill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _setjmp.symtab0x40f01028FUNC<unknown>DEFAULT3
                                                _sigintr.symtab0x43365016OBJECT<unknown>HIDDEN16
                                                _stdio.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _stdio_fopen.symtab0x4102f01168FUNC<unknown>HIDDEN3
                                                _stdio_init.symtab0x410780184FUNC<unknown>HIDDEN3
                                                _stdio_openlist.symtab0x42c2544OBJECT<unknown>DEFAULT12
                                                _stdio_openlist_add_lock.symtab0x4310a012OBJECT<unknown>DEFAULT16
                                                _stdio_openlist_dec_use.symtab0x410e60648FUNC<unknown>HIDDEN3
                                                _stdio_openlist_del_count.symtab0x4310bc4OBJECT<unknown>DEFAULT16
                                                _stdio_openlist_del_lock.symtab0x4310ac12OBJECT<unknown>DEFAULT16
                                                _stdio_openlist_use_count.symtab0x4310b84OBJECT<unknown>DEFAULT16
                                                _stdio_streams.symtab0x42c258204OBJECT<unknown>DEFAULT12
                                                _stdio_term.symtab0x410838416FUNC<unknown>HIDDEN3
                                                _stdio_user_locking.symtab0x42c2304OBJECT<unknown>DEFAULT12
                                                _stdlib_strto_l.symtab0x40d080488FUNC<unknown>HIDDEN3
                                                _stdlib_strto_l.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _store_inttype.symtab0x4182b068FUNC<unknown>HIDDEN3
                                                _store_inttype.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _string_syserrmsgs.symtab0x41b0e02934OBJECT<unknown>HIDDEN5
                                                _string_syserrmsgs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _trans2r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _trans2w.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _uintmaxtostr.symtab0x410a50332FUNC<unknown>HIDDEN3
                                                _uintmaxtostr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _vfprintf_internal.symtab0x415fc42204FUNC<unknown>HIDDEN3
                                                _vfprintf_internal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                _wcommit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                abort.symtab0x40c720408FUNC<unknown>DEFAULT3
                                                abort.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                access.symtab0x40a22060FUNC<unknown>DEFAULT3
                                                access.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                astd.symtab0x406648544FUNC<unknown>DEFAULT3
                                                atcp.symtab0x405d3c2316FUNC<unknown>DEFAULT3
                                                atoi.symtab0x40d04028FUNC<unknown>DEFAULT3
                                                atol.symtab0x40d04028FUNC<unknown>DEFAULT3
                                                atol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                audp.symtab0x4054c02172FUNC<unknown>DEFAULT3
                                                bcopy.symtab0x40ab2032FUNC<unknown>DEFAULT3
                                                bcopy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                been_there_done_that.symtab0x430b104OBJECT<unknown>DEFAULT16
                                                brk.symtab0x412e2080FUNC<unknown>DEFAULT3
                                                brk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                bsd_signal.symtab0x40b420228FUNC<unknown>DEFAULT3
                                                buf.4511.symtab0x43093016OBJECT<unknown>DEFAULT16
                                                buf.6560.symtab0x430940440OBJECT<unknown>DEFAULT16
                                                bzero.symtab0x40ab4028FUNC<unknown>DEFAULT3
                                                bzero.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                c.symtab0x42c0b44OBJECT<unknown>DEFAULT12
                                                calloc.symtab0x4123f0344FUNC<unknown>DEFAULT3
                                                calloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                chdir.symtab0x40a26056FUNC<unknown>DEFAULT3
                                                chdir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                close.symtab0x40e2dc176FUNC<unknown>DEFAULT3
                                                closedir.symtab0x40f4b0292FUNC<unknown>DEFAULT3
                                                closedir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                closenameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                commServer.symtab0x42c0c04OBJECT<unknown>DEFAULT12
                                                completed.4786.symtab0x42c8e01OBJECT<unknown>DEFAULT16
                                                connect.symtab0x40ae0c220FUNC<unknown>DEFAULT3
                                                connect.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                connectTimeout.symtab0x401f14828FUNC<unknown>DEFAULT3
                                                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                crtstuff.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                csum.symtab0x4024e8460FUNC<unknown>DEFAULT3
                                                currentServer.symtab0x42c0b04OBJECT<unknown>DEFAULT12
                                                data_start.symtab0x42c0a00OBJECT<unknown>DEFAULT12
                                                decoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                decodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                dl-support.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                dnslookup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                encoded.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                encodeh.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                encodeq.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                environ.symtab0x4310844OBJECT<unknown>DEFAULT16
                                                errno.symtab0x04TLS<unknown>DEFAULT7
                                                errno.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                estridx.symtab0x41b050126OBJECT<unknown>DEFAULT5
                                                exit.symtab0x40d270240FUNC<unknown>DEFAULT3
                                                exit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                exp10_table.symtab0x41bc8872OBJECT<unknown>DEFAULT5
                                                fclose.symtab0x40ffa0804FUNC<unknown>DEFAULT3
                                                fclose.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fcntl.symtab0x40a0bc268FUNC<unknown>DEFAULT3
                                                fd_to_DIR.symtab0x40f5e0276FUNC<unknown>DEFAULT3
                                                fdgets.symtab0x4006f0292FUNC<unknown>DEFAULT3
                                                fdopendir.symtab0x40f7e4228FUNC<unknown>DEFAULT3
                                                fflush_unlocked.symtab0x4110e8940FUNC<unknown>DEFAULT3
                                                fflush_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fgetc.symtab0x410ba0372FUNC<unknown>DEFAULT3
                                                fgetc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fgetc_unlocked.symtab0x4114a0388FUNC<unknown>DEFAULT3
                                                fgetc_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fgets.symtab0x410d20320FUNC<unknown>DEFAULT3
                                                fgets.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fgets_unlocked.symtab0x411630276FUNC<unknown>DEFAULT3
                                                fgets_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fmt.symtab0x41bc7020OBJECT<unknown>DEFAULT5
                                                fopen.symtab0x4102d028FUNC<unknown>DEFAULT3
                                                fopen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fork.symtab0x40d910988FUNC<unknown>DEFAULT3
                                                fork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fork_handler_pool.symtab0x430b341348OBJECT<unknown>DEFAULT16
                                                fputs_unlocked.symtab0x417300124FUNC<unknown>DEFAULT3
                                                fputs_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                frame_dummy.symtab0x40023c0FUNC<unknown>DEFAULT3
                                                free.symtab0x40c42c660FUNC<unknown>DEFAULT3
                                                free.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fseek.symtab0x418f4068FUNC<unknown>DEFAULT3
                                                fseeko.symtab0x418f4068FUNC<unknown>DEFAULT3
                                                fseeko.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fseeko64.symtab0x418f90500FUNC<unknown>DEFAULT3
                                                fseeko64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                fstat.symtab0x412ef0136FUNC<unknown>DEFAULT3
                                                fstat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                ftcp.symtab0x402fe02316FUNC<unknown>DEFAULT3
                                                fwrite_unlocked.symtab0x417380268FUNC<unknown>DEFAULT3
                                                fwrite_unlocked.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getArch.symtab0x40686856FUNC<unknown>DEFAULT3
                                                getHost.symtab0x4019fc160FUNC<unknown>DEFAULT3
                                                getOurIP.symtab0x400814896FUNC<unknown>DEFAULT3
                                                getPortz.symtab0x4068a0380FUNC<unknown>DEFAULT3
                                                getRandomIP.symtab0x400644172FUNC<unknown>DEFAULT3
                                                get_hosts_byname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getc.symtab0x410ba0372FUNC<unknown>DEFAULT3
                                                getc_unlocked.symtab0x4114a0388FUNC<unknown>DEFAULT3
                                                getdents64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getdtablesize.symtab0x40f10072FUNC<unknown>DEFAULT3
                                                getdtablesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getegid.symtab0x40f15016FUNC<unknown>DEFAULT3
                                                getegid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                geteuid.symtab0x40f16016FUNC<unknown>DEFAULT3
                                                geteuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getgid.symtab0x40f17016FUNC<unknown>DEFAULT3
                                                getgid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                gethostbyname.symtab0x40ad4028FUNC<unknown>DEFAULT3
                                                gethostbyname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                gethostbyname2.symtab0x40ad60104FUNC<unknown>DEFAULT3
                                                gethostbyname2.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                gethostbyname2_r.symtab0x412030948FUNC<unknown>DEFAULT3
                                                gethostbyname2_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                gethostbyname_r.symtab0x415580968FUNC<unknown>DEFAULT3
                                                gethostbyname_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                gethostname.symtab0x4159b0192FUNC<unknown>DEFAULT3
                                                gethostname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getpagesize.symtab0x40f18048FUNC<unknown>DEFAULT3
                                                getpagesize.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getpid.symtab0x40df1084FUNC<unknown>DEFAULT3
                                                getpid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getrlimit.symtab0x40f1b060FUNC<unknown>DEFAULT3
                                                getrlimit.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getsockname.symtab0x40aef060FUNC<unknown>DEFAULT3
                                                getsockname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getsockopt.symtab0x40af3096FUNC<unknown>DEFAULT3
                                                getsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                getuid.symtab0x40f1f016FUNC<unknown>DEFAULT3
                                                getuid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                gotIP.symtab0x42c9044OBJECT<unknown>DEFAULT16
                                                h_errno.symtab0x44TLS<unknown>DEFAULT7
                                                hlt.symtab0x40032c0NOTYPE<unknown>DEFAULT3
                                                hoste.6559.symtab0x430af820OBJECT<unknown>DEFAULT16
                                                htonl.symtab0x40ab9840FUNC<unknown>DEFAULT3
                                                htons.symtab0x40ab8024FUNC<unknown>DEFAULT3
                                                i.4700.symtab0x42c0b84OBJECT<unknown>DEFAULT12
                                                index.symtab0x40a800248FUNC<unknown>DEFAULT3
                                                inet_addr.symtab0x40acf072FUNC<unknown>DEFAULT3
                                                inet_aton.symtab0x411f10284FUNC<unknown>DEFAULT3
                                                inet_aton.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                inet_makeaddr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                inet_ntoa.symtab0x40accc32FUNC<unknown>DEFAULT3
                                                inet_ntoa.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                inet_ntoa_r.symtab0x40ac00204FUNC<unknown>DEFAULT3
                                                inet_ntop.symtab0x413ddc852FUNC<unknown>DEFAULT3
                                                inet_ntop4.symtab0x413c20444FUNC<unknown>DEFAULT3
                                                inet_pton.symtab0x413968696FUNC<unknown>DEFAULT3
                                                inet_pton4.symtab0x413880232FUNC<unknown>DEFAULT3
                                                initConnection.symtab0x409220592FUNC<unknown>DEFAULT3
                                                init_rand.symtab0x400340300FUNC<unknown>DEFAULT3
                                                init_static_tls.symtab0x4129d084FUNC<unknown>DEFAULT3
                                                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                initfini.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                initstate.symtab0x40ca3c208FUNC<unknown>DEFAULT3
                                                initstate_r.symtab0x40cdfc300FUNC<unknown>DEFAULT3
                                                ioctl.symtab0x40a2a0248FUNC<unknown>DEFAULT3
                                                ioctl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                isatty.symtab0x411e2060FUNC<unknown>DEFAULT3
                                                isatty.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                isspace.symtab0x40a5a044FUNC<unknown>DEFAULT3
                                                isspace.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                kill.symtab0x40a3a056FUNC<unknown>DEFAULT3
                                                kill.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                last_id.6617.symtab0x42c3402OBJECT<unknown>DEFAULT12
                                                last_ns_num.6616.symtab0x4336104OBJECT<unknown>DEFAULT16
                                                libc-cancellation.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                libc-lowlevellock.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                libc-tls.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                listFork.symtab0x402250664FUNC<unknown>DEFAULT3
                                                llseek.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                lseek64.symtab0x415c60136FUNC<unknown>DEFAULT3
                                                macAddress.symtab0x42c9106OBJECT<unknown>DEFAULT16
                                                main.symtab0x4094703032FUNC<unknown>DEFAULT3
                                                mainCommSock.symtab0x42c9004OBJECT<unknown>DEFAULT16
                                                makeIPPacket.symtab0x402810296FUNC<unknown>DEFAULT3
                                                makeRandomStr.symtab0x401a9c268FUNC<unknown>DEFAULT3
                                                makevsepacket.symtab0x403ccc332FUNC<unknown>DEFAULT3
                                                malloc.symtab0x40b62c2764FUNC<unknown>DEFAULT3
                                                malloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                malloc_trim.symtab0x40c6c084FUNC<unknown>DEFAULT3
                                                memchr.symtab0x418b70260FUNC<unknown>DEFAULT3
                                                memchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                memcpy.symtab0x40a630308FUNC<unknown>DEFAULT3
                                                memmove.symtab0x411750824FUNC<unknown>DEFAULT3
                                                memmove.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                mempcpy.symtab0x4136b076FUNC<unknown>DEFAULT3
                                                mempcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                memrchr.symtab0x418c80260FUNC<unknown>DEFAULT3
                                                memrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                memset.symtab0x40a770144FUNC<unknown>DEFAULT3
                                                mmap.symtab0x40ef80112FUNC<unknown>DEFAULT3
                                                mmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                mremap.symtab0x412f8096FUNC<unknown>DEFAULT3
                                                mremap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                munmap.symtab0x40f20060FUNC<unknown>DEFAULT3
                                                munmap.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                mylock.symtab0x42c12024OBJECT<unknown>DEFAULT12
                                                mylock.symtab0x42c14024OBJECT<unknown>DEFAULT12
                                                nanosleep.symtab0x40f27c200FUNC<unknown>DEFAULT3
                                                nanosleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                next_start.1303.symtab0x4309204OBJECT<unknown>DEFAULT16
                                                nprocessors_onln.symtab0x40d360508FUNC<unknown>DEFAULT3
                                                ntohl.symtab0x40abd840FUNC<unknown>DEFAULT3
                                                ntohl.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                ntohs.symtab0x40abc024FUNC<unknown>DEFAULT3
                                                ntop.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                numpids.symtab0x42c9088OBJECT<unknown>DEFAULT16
                                                object.4798.symtab0x42c8e424OBJECT<unknown>DEFAULT16
                                                open.symtab0x40e3cc192FUNC<unknown>DEFAULT3
                                                opendir.symtab0x40f6f4240FUNC<unknown>DEFAULT3
                                                opendir.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                opennameservers.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                ourIP.symtab0x42c8944OBJECT<unknown>DEFAULT15
                                                p.4784.symtab0x42c0900OBJECT<unknown>DEFAULT12
                                                parse_config.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                pids.symtab0x42c8984OBJECT<unknown>DEFAULT15
                                                poll.symtab0x415aac220FUNC<unknown>DEFAULT3
                                                poll.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                prefix.6318.symtab0x41afa012OBJECT<unknown>DEFAULT5
                                                print.symtab0x4012f01460FUNC<unknown>DEFAULT3
                                                printchar.symtab0x400d60184FUNC<unknown>DEFAULT3
                                                printi.symtab0x401054668FUNC<unknown>DEFAULT3
                                                prints.symtab0x400e18572FUNC<unknown>DEFAULT3
                                                processCmd.symtab0x406a1c10244FUNC<unknown>DEFAULT3
                                                program_invocation_name.symtab0x42c2284OBJECT<unknown>DEFAULT12
                                                program_invocation_short_name.symtab0x42c2244OBJECT<unknown>DEFAULT12
                                                qual_chars.6326.symtab0x41afc020OBJECT<unknown>DEFAULT5
                                                raise.symtab0x40df70264FUNC<unknown>DEFAULT3
                                                raise.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                rand.symtab0x40c8c028FUNC<unknown>DEFAULT3
                                                rand.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                rand_cmwc.symtab0x40046c472FUNC<unknown>DEFAULT3
                                                random.symtab0x40c8e0164FUNC<unknown>DEFAULT3
                                                random.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                random_poly_info.symtab0x41a9f040OBJECT<unknown>DEFAULT5
                                                random_r.symtab0x40cbc0172FUNC<unknown>DEFAULT3
                                                random_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                randtbl.symtab0x42c158128OBJECT<unknown>DEFAULT12
                                                rawmemchr.symtab0x413700192FUNC<unknown>DEFAULT3
                                                rawmemchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                read.symtab0x40e5cc192FUNC<unknown>DEFAULT3
                                                read_etc_hosts_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                readdir64.symtab0x40f8d0272FUNC<unknown>DEFAULT3
                                                readdir64.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                realloc.symtab0x4125501152FUNC<unknown>DEFAULT3
                                                realloc.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                recv.symtab0x40afcc240FUNC<unknown>DEFAULT3
                                                recv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                recvLine.symtab0x401ba8876FUNC<unknown>DEFAULT3
                                                register-atfork.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                resolv_conf_mtime.6599.symtab0x4336384OBJECT<unknown>DEFAULT16
                                                rindex.symtab0x411c20160FUNC<unknown>DEFAULT3
                                                rtcp.symtab0x404dfc1732FUNC<unknown>DEFAULT3
                                                sbrk.symtab0x40f350164FUNC<unknown>DEFAULT3
                                                sbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                select.symtab0x40a440260FUNC<unknown>DEFAULT3
                                                select.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                send.symtab0x40b0fc240FUNC<unknown>DEFAULT3
                                                send.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                sendto.symtab0x40b260280FUNC<unknown>DEFAULT3
                                                sendto.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                setjmp_aux.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                setsid.symtab0x40a55060FUNC<unknown>DEFAULT3
                                                setsid.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                setsockopt.symtab0x40b38096FUNC<unknown>DEFAULT3
                                                setsockopt.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                setstate.symtab0x40c984184FUNC<unknown>DEFAULT3
                                                setstate_r.symtab0x40cf28272FUNC<unknown>DEFAULT3
                                                sigaction.symtab0x40eff028FUNC<unknown>DEFAULT3
                                                sigaction.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                sigjmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                signal.symtab0x40b420228FUNC<unknown>DEFAULT3
                                                signal.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                sigprocmask.symtab0x40f400176FUNC<unknown>DEFAULT3
                                                sigprocmask.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                sigsetops.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                skip_and_NUL_space.symtab0x414d58104FUNC<unknown>DEFAULT3
                                                skip_nospace.symtab0x414cf0104FUNC<unknown>DEFAULT3
                                                sleep.symtab0x40e080404FUNC<unknown>DEFAULT3
                                                sleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                socket.symtab0x40b3e060FUNC<unknown>DEFAULT3
                                                socket.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                socket_connect.symtab0x403b10444FUNC<unknown>DEFAULT3
                                                sockprintf.symtab0x4018a4344FUNC<unknown>DEFAULT3
                                                spec_and_mask.6325.symtab0x41afd416OBJECT<unknown>DEFAULT5
                                                spec_base.6317.symtab0x41afac7OBJECT<unknown>DEFAULT5
                                                spec_chars.6322.symtab0x41b03021OBJECT<unknown>DEFAULT5
                                                spec_flags.6321.symtab0x41b0488OBJECT<unknown>DEFAULT5
                                                spec_or_mask.6324.symtab0x41afe416OBJECT<unknown>DEFAULT5
                                                spec_ranges.6323.symtab0x41aff49OBJECT<unknown>DEFAULT5
                                                sprintf.symtab0x415cf080FUNC<unknown>DEFAULT3
                                                sprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                srand.symtab0x40cb0c172FUNC<unknown>DEFAULT3
                                                srandom.symtab0x40cb0c172FUNC<unknown>DEFAULT3
                                                srandom_r.symtab0x40cc6c400FUNC<unknown>DEFAULT3
                                                stat.symtab0x415b90136FUNC<unknown>DEFAULT3
                                                stat.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                static_dtv.symtab0x4330c0512OBJECT<unknown>DEFAULT16
                                                static_map.symtab0x4335c852OBJECT<unknown>DEFAULT16
                                                static_slotinfo.symtab0x4332c0776OBJECT<unknown>DEFAULT16
                                                stderr.symtab0x42c2484OBJECT<unknown>DEFAULT12
                                                stdhexflood.symtab0x404990536FUNC<unknown>DEFAULT3
                                                stdin.symtab0x42c2404OBJECT<unknown>DEFAULT12
                                                stdout.symtab0x42c2444OBJECT<unknown>DEFAULT12
                                                strcasecmp.symtab0x418d90108FUNC<unknown>DEFAULT3
                                                strcasecmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strchr.symtab0x40a800248FUNC<unknown>DEFAULT3
                                                strchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strchrnul.symtab0x411a90248FUNC<unknown>DEFAULT3
                                                strchrnul.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strcmp.symtab0x40a90044FUNC<unknown>DEFAULT3
                                                strcmp.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strcoll.symtab0x40a90044FUNC<unknown>DEFAULT3
                                                strcpy.symtab0x40a93036FUNC<unknown>DEFAULT3
                                                strcpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strcspn.symtab0x411b90144FUNC<unknown>DEFAULT3
                                                strcspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strdup.symtab0x417760140FUNC<unknown>DEFAULT3
                                                strdup.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strerror_r.symtab0x4175e0380FUNC<unknown>DEFAULT3
                                                strlen.symtab0x40a960184FUNC<unknown>DEFAULT3
                                                strlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strncpy.symtab0x4137c0188FUNC<unknown>DEFAULT3
                                                strncpy.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strnlen.symtab0x417490248FUNC<unknown>DEFAULT3
                                                strnlen.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strpbrk.symtab0x411de064FUNC<unknown>DEFAULT3
                                                strpbrk.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strrchr.symtab0x411c20160FUNC<unknown>DEFAULT3
                                                strrchr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strspn.symtab0x411cc072FUNC<unknown>DEFAULT3
                                                strspn.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strstr.symtab0x40aa20256FUNC<unknown>DEFAULT3
                                                strstr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strtok.symtab0x40ab6032FUNC<unknown>DEFAULT3
                                                strtok.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strtok_r.symtab0x411d10208FUNC<unknown>DEFAULT3
                                                strtok_r.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                strtol.symtab0x40d06028FUNC<unknown>DEFAULT3
                                                strtol.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                sysconf.symtab0x40d55c792FUNC<unknown>DEFAULT3
                                                sysconf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                tcgetattr.symtab0x411e60176FUNC<unknown>DEFAULT3
                                                tcgetattr.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                tcpcsum.symtab0x4026b4348FUNC<unknown>DEFAULT3
                                                time.symtab0x40a59016FUNC<unknown>DEFAULT3
                                                time.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                toupper.symtab0x40a5d060FUNC<unknown>DEFAULT3
                                                toupper.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                trim.symtab0x400b94460FUNC<unknown>DEFAULT3
                                                type_codes.symtab0x41b00024OBJECT<unknown>DEFAULT5
                                                type_sizes.symtab0x41b01812OBJECT<unknown>DEFAULT5
                                                uname.symtab0x415c2060FUNC<unknown>DEFAULT3
                                                uname.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                unknown.1327.symtab0x41b0d014OBJECT<unknown>DEFAULT5
                                                unsafe_state.symtab0x42c1e020OBJECT<unknown>DEFAULT12
                                                useragents.symtab0x42c0c428OBJECT<unknown>DEFAULT12
                                                usleep.symtab0x40d880144FUNC<unknown>DEFAULT3
                                                usleep.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                vseattack.symtab0x403e182412FUNC<unknown>DEFAULT3
                                                vsnprintf.symtab0x415d40248FUNC<unknown>DEFAULT3
                                                vsnprintf.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                waitpid.symtab0x40e6cc192FUNC<unknown>DEFAULT3
                                                wcrtomb.symtab0x417da0108FUNC<unknown>DEFAULT3
                                                wcrtomb.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                wcsnrtombs.symtab0x417e50192FUNC<unknown>DEFAULT3
                                                wcsnrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                wcsrtombs.symtab0x417e1064FUNC<unknown>DEFAULT3
                                                wcsrtombs.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS
                                                write.symtab0x40e4cc192FUNC<unknown>DEFAULT3
                                                xdigits.4935.symtab0x41af0417OBJECT<unknown>DEFAULT5
                                                xstatconv.c.symtab0x00FILE<unknown>DEFAULTSHN_ABS

                                                Download Network PCAP: filteredfull

                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                2025-02-26T20:50:30.156794+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458168185.224.0.148606TCP
                                                2025-02-26T20:50:51.527590+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458170185.224.0.148606TCP
                                                2025-02-26T20:51:12.901738+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458172185.224.0.148606TCP
                                                2025-02-26T20:51:34.261142+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458174185.224.0.148606TCP
                                                2025-02-26T20:51:55.666769+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458176185.224.0.148606TCP
                                                2025-02-26T20:52:17.045082+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458178185.224.0.148606TCP
                                                2025-02-26T20:52:38.400815+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458180185.224.0.148606TCP
                                                2025-02-26T20:52:59.780924+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458182185.224.0.148606TCP
                                                2025-02-26T20:53:21.151161+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458184185.224.0.148606TCP
                                                2025-02-26T20:53:42.528699+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458186185.224.0.148606TCP
                                                2025-02-26T20:54:03.903681+01002846526ETPRO MALWARE ELF/BASHLITE Variant CnC Checkin1192.168.2.1458188185.224.0.148606TCP
                                                • Total Packets: 55
                                                • 606 undefined
                                                • 443 (HTTPS)
                                                • 53 (DNS)
                                                TimestampSource PortDest PortSource IPDest IP
                                                Feb 26, 2025 20:50:28.767709017 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:28.767728090 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:28.767740011 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:28.767976046 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:28.767976046 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:28.767976046 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:28.768739939 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:28.773561954 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:29.004153013 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:29.004261017 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:29.004399061 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:29.009931087 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:29.177829027 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:29.178026915 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:29.178975105 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:29.184178114 CET4434247034.243.160.129192.168.2.14
                                                Feb 26, 2025 20:50:29.184230089 CET42470443192.168.2.1434.243.160.129
                                                Feb 26, 2025 20:50:30.141652107 CET58168606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:30.146656036 CET60658168185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:50:30.146799088 CET58168606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:30.156794071 CET58168606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:30.163248062 CET60658168185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:50:51.520222902 CET60658168185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:50:51.521104097 CET58168606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:51.521996021 CET58170606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:51.526053905 CET60658168185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:50:51.527015924 CET60658170185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:50:51.527086020 CET58170606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:51.527590036 CET58170606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:50:51.532453060 CET60658170185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:12.895328045 CET60658170185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:12.895648956 CET58170606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:12.896646976 CET58172606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:12.900631905 CET60658170185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:12.901607990 CET60658172185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:12.901700974 CET58172606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:12.901737928 CET58172606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:12.906680107 CET60658172185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:34.255434990 CET60658172185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:34.255726099 CET58172606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:34.255726099 CET58172606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:34.256161928 CET58174606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:34.260691881 CET60658172185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:34.261027098 CET60658174185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:34.261080027 CET58174606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:34.261142015 CET58174606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:34.266011953 CET60658174185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:55.659776926 CET60658174185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:55.660255909 CET58174606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:55.661011934 CET58176606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:55.665195942 CET60658174185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:55.666578054 CET60658176185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:51:55.666646004 CET58176606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:55.666769028 CET58176606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:51:55.672549009 CET60658176185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:17.036850929 CET60658176185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:17.037064075 CET58176606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:17.037612915 CET58178606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:17.044962883 CET60658176185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:17.044974089 CET60658178185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:17.045032024 CET58178606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:17.045082092 CET58178606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:17.049963951 CET60658178185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:38.394552946 CET60658178185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:38.394933939 CET58178606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:38.395709991 CET58180606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:38.400039911 CET60658178185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:38.400684118 CET60658180185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:38.400769949 CET58180606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:38.400815010 CET58180606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:38.405774117 CET60658180185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:59.772015095 CET60658180185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:59.772296906 CET58180606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:59.773118019 CET58182606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:59.780574083 CET60658180185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:59.780747890 CET60658182185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:52:59.780811071 CET58182606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:59.780924082 CET58182606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:52:59.786123037 CET60658182185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:21.145342112 CET60658182185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:21.145652056 CET58182606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:21.146142960 CET58184606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:21.150602102 CET60658182185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:21.151063919 CET60658184185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:21.151114941 CET58184606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:21.151160955 CET58184606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:21.156096935 CET60658184185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:42.522440910 CET60658184185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:42.522742987 CET58184606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:42.523510933 CET58186606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:42.527956009 CET60658184185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:42.528532982 CET60658186185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:53:42.528609991 CET58186606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:42.528698921 CET58186606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:53:42.533724070 CET60658186185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:54:03.897562027 CET60658186185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:54:03.897732019 CET58186606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:54:03.898505926 CET58188606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:54:03.902843952 CET60658186185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:54:03.903513908 CET60658188185.224.0.148192.168.2.14
                                                Feb 26, 2025 20:54:03.903615952 CET58188606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:54:03.903681040 CET58188606192.168.2.14185.224.0.148
                                                Feb 26, 2025 20:54:03.908643961 CET60658188185.224.0.148192.168.2.14
                                                TimestampSource PortDest PortSource IPDest IP
                                                Feb 26, 2025 20:53:13.274765015 CET3930253192.168.2.148.8.8.8
                                                Feb 26, 2025 20:53:13.274830103 CET4308753192.168.2.148.8.8.8
                                                Feb 26, 2025 20:53:13.281436920 CET53393028.8.8.8192.168.2.14
                                                Feb 26, 2025 20:53:13.281487942 CET53430878.8.8.8192.168.2.14
                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Feb 26, 2025 20:53:13.274765015 CET192.168.2.148.8.8.80xfd91Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                                Feb 26, 2025 20:53:13.274830103 CET192.168.2.148.8.8.80x50bbStandard query (0)daisy.ubuntu.com28IN (0x0001)false
                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Feb 26, 2025 20:53:13.281436920 CET8.8.8.8192.168.2.140xfd91No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                                Feb 26, 2025 20:53:13.281436920 CET8.8.8.8192.168.2.140xfd91No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                                TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                Feb 26, 2025 20:50:28.767740011 CET34.243.160.129443192.168.2.1442470CN=motd.ubuntu.com CN=R11, O=Let's Encrypt, C=USCN=R11, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USSun Jan 05 09:21:36 CET 2025 Wed Mar 13 01:00:00 CET 2024Sat Apr 05 10:21:35 CEST 2025 Sat Mar 13 00:59:59 CET 2027
                                                CN=R11, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USWed Mar 13 01:00:00 CET 2024Sat Mar 13 00:59:59 CET 2027

                                                System Behavior

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/rm
                                                Arguments:rm -f /tmp/tmp.rhgTkvJk5R /tmp/tmp.Bh7e0qF7Q5 /tmp/tmp.xJ4SZyXcDC
                                                File size:72056 bytes
                                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/cat
                                                Arguments:cat /tmp/tmp.rhgTkvJk5R
                                                File size:43416 bytes
                                                MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/head
                                                Arguments:head -n 10
                                                File size:47480 bytes
                                                MD5 hash:fd96a67145172477dd57131396fc9608

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/tr
                                                Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                File size:51544 bytes
                                                MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/cut
                                                Arguments:cut -c -80
                                                File size:47480 bytes
                                                MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/cat
                                                Arguments:cat /tmp/tmp.rhgTkvJk5R
                                                File size:43416 bytes
                                                MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/head
                                                Arguments:head -n 10
                                                File size:47480 bytes
                                                MD5 hash:fd96a67145172477dd57131396fc9608

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/tr
                                                Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                                File size:51544 bytes
                                                MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/cut
                                                Arguments:cut -c -80
                                                File size:47480 bytes
                                                MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/dash
                                                Arguments:-
                                                File size:129816 bytes
                                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/usr/bin/rm
                                                Arguments:rm -f /tmp/tmp.rhgTkvJk5R /tmp/tmp.Bh7e0qF7Q5 /tmp/tmp.xJ4SZyXcDC
                                                File size:72056 bytes
                                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                Start time (UTC):19:50:28
                                                Start date (UTC):26/02/2025
                                                Path:/tmp/m-p.s-l.Sakura.elf
                                                Arguments:/tmp/m-p.s-l.Sakura.elf
                                                File size:5773336 bytes
                                                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                                Start time (UTC):19:50:29
                                                Start date (UTC):26/02/2025
                                                Path:/tmp/m-p.s-l.Sakura.elf
                                                Arguments:-
                                                File size:5773336 bytes
                                                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                                Start time (UTC):19:50:29
                                                Start date (UTC):26/02/2025
                                                Path:/tmp/m-p.s-l.Sakura.elf
                                                Arguments:-
                                                File size:5773336 bytes
                                                MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9