Edit tour

Linux Analysis Report
TeamServerImage

Overview

General Information

Sample Name:	TeamServerImage
Analysis ID:	1312181
MD5:	b50b86d735412685eb6044ad8d01781c
SHA1:	a83ca7884d0a5aa87e1cbfcf979702eeba6476b7
SHA256:	fe7a8192cea4c6bd5f1bc187d61e3156ca1e452e3160bed15f1e8d18cccf86a5
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample contains AV-related strings

Found strings indicative of a multi-platform dropper

Yara signature match

Sample contains strings that are potentially command strings

Classification

Analysis Advice

Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1312181
Start date and time:	2023-09-21 12:07:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	TeamServerImage
Detection:	MAL
Classification:	mal64.spre.evad.lin@0/0@0/0

Warnings

VT rate limit hit for: http://javax.xml.XMLConstants/property/accessExternalDTDR

Runtime Messages

Command:	/tmp/TeamServerImage
PID:	5415
Exit Code:	1
Exit Code Info:
Killed:	False
Standard Output:	NOTE: The Cobalt Strike Team Server executable program should be called using the provided scripts. The Cobalt Strike function parameter was not provided. The Cobalt Strike Team Server Starter process requires a function parameter (teamserver, c2lint, peclone, version). The function parameter should be followed by any/all additional parameters required for that function.
Standard Error:

Process Tree

system is lnxubuntu20

TeamServerImage (PID: 5415, Parent: 5342, MD5: 00000000000000000000000000000000) Arguments: /tmp/TeamServerImage

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Shellcode_Generic_8c487e57	unknown	unknown	0x2e7cb10:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 0x2e7d7f0:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 0x2e806b0:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 0x2e83130:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 0x2e83400:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 0x2e847b8:$a: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_CobaltStrike_c851687a	Identifies UAC Bypass module from Cobalt Strike	unknown	0x30aef17:$a1: bypassuac.dll 0x30af2ff:$a2: bypassuac.x64.dll 0x2f624af:$b12: ReflectiveLoader 0x30002c3:$b12: ReflectiveLoader 0x3020ab7:$b12: ReflectiveLoader 0x3020b74:$b12: ReflectiveLoader 0x306e859:$b12: ReflectiveLoader 0x3097f1b:$b12: ReflectiveLoader 0x3097f93:$b12: ReflectiveLoader 0x30e049c:$b12: ReflectiveLoader 0x3143908:$b12: ReflectiveLoader
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_CobaltStrike_09b79efa	Identifies Invoke Assembly module from Cobalt Strike	unknown	0x3032007:$a1: invokeassembly.x64.dll 0x3032ed7:$a2: invokeassembly.dll 0x2f624af:$b6: ReflectiveLoader 0x30002c3:$b6: ReflectiveLoader 0x3020ab7:$b6: ReflectiveLoader 0x3020b74:$b6: ReflectiveLoader 0x306e859:$b6: ReflectiveLoader 0x3097f1b:$b6: ReflectiveLoader 0x3097f93:$b6: ReflectiveLoader 0x30e049c:$b6: ReflectiveLoader 0x3143908:$b6: ReflectiveLoader
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_CobaltStrike_15f680fb	Identifies Netview module from Cobalt Strike	unknown	0x30aed87:$a1: netview.x64.dll 0x30af2d7:$a2: netview.dll 0x2f624af:$b5: ReflectiveLoader 0x306e859:$b5: ReflectiveLoader 0x3143908:$b5: ReflectiveLoader
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_CobaltStrike_5b4383ec	Identifies Portscan module from Cobalt Strike	unknown	0x30aeeef:$a1: portscan.x64.dll 0x30af057:$a2: portscan.dll 0x2f624af:$b4: ReflectiveLoader 0x306e859:$b4: ReflectiveLoader 0x3143908:$b4: ReflectiveLoader
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b25797:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b2581a:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b26365:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2b2681d:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2b2678e:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2b2681d:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2b25888:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b25aa5:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2b258d9:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b25922:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2b25c95:$a11: Could not open service control manager on %s: %d 0x2b264c3:$a12: %d is an x64 process (can't inject x86 content) 0x2b264fe:$a13: %d is an x86 process (can't inject x64 content) 0x2b26aa4:$a14: Failed to impersonate logged on user %d (%u) 0x2b26466:$a15: could not create remote thread in %d: %d 0x2b25963:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b263fe:$a17: could not write to process memory: %d 0x2b25cd1:$a18: Could not create service %s on %s: %d 0x2b25d86:$a19: Could not delete service %s on %s: %d 0x2b25b40:$a20: Could not open process token: %d (%u) 0x2b25997:$a21: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_CobaltStrike_d00573a3	Identifies Screenshot module from Cobalt Strike	unknown	0x3032a87:$a1: screenshot.x64.dll 0x30aea17:$a2: screenshot.dll 0x2f624af:$b5: ReflectiveLoader 0x30002c3:$b5: ReflectiveLoader 0x3020ab7:$b5: ReflectiveLoader 0x3020b74:$b5: ReflectiveLoader 0x306e859:$b5: ReflectiveLoader 0x3097f1b:$b5: ReflectiveLoader 0x3097f93:$b5: ReflectiveLoader 0x30e049c:$b5: ReflectiveLoader 0x3143908:$b5: ReflectiveLoader 0x276c600:$b6: Adobe APP14 marker: version %d, flags 0x%04x 0x%04x, transform %d
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_Metasploit_38b8ceec	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).	unknown	0x2e7cb17:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 0x2e7d7f7:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 0x2e806b7:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 0x2e83137:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 0x2e83407:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 0x2e847bf:$a1: 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x2e7af81:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 0x2e7bdc1:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 0x2e808d9:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 0x2e812a1:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_Metasploit_24338919	Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon).	unknown	0x2e7cba0:$a1: 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 0x2e7d880:$a1: 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x2e7afed:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 0x2e7be2d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 0x2e80945:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 0x2e8130d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Windows_Trojan_Metasploit_91bc5d7d	unknown	unknown	0x2e8099b:$a: 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5 0x2e81363:$a: 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Linux_Trojan_Swrort_5ad1a4f9	unknown	unknown	0x2e834db:$a: 53 57 68 B7 E9 38 FF FF D5 53 53 57 68 74 EC 3B E1 FF D5 57
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2f624af:$loader_export: ReflectiveLoader 0x30002c3:$loader_export: ReflectiveLoader 0x3020ab7:$loader_export: ReflectiveLoader 0x3020b74:$loader_export: ReflectiveLoader 0x306e859:$loader_export: ReflectiveLoader 0x3097f1b:$loader_export: ReflectiveLoader 0x3097f93:$loader_export: ReflectiveLoader 0x30e049c:$loader_export: ReflectiveLoader 0x3143908:$loader_export: ReflectiveLoader 0x2b25706:$exportname: beacon.dll 0x3097de0:$exportname: beacon.dll 0x30aeb7f:$exportname: beacon.dll 0x30eff42:$exportname: beacon.dll
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Msfpayloads_msf_6	Metasploit Payloads - file msf.vbs	Florian Roth	0x2e79888:$s1: = CreateObject("Wscript.Shell") 0x2e7c3b4:$s1: = CreateObject("Wscript.Shell") 0x2e8736a:$s1: = CreateObject("Wscript.Shell") 0x2e7c19b:$s2: = CreateObject("Scripting.FileSystemObject") 0x2e7c22a:$s3: .GetSpecialFolder(2) 0x2e7c34a:$s4: .Write Chr(CLng(" 0x2e7c313:$s6: For i = 1 to Len( 0x2e7c331:$s7: ) Step 2
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	Msfpayloads_msf_ref	Metasploit Payloads - file msf-ref.ps1	Florian Roth	0x2e5db1a:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x2e5fbbf:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x2e62f4a:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x2e6853f:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x2e5e032:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x2e600d7:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x2e63462:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x2e68a57:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x2e5e0fc:$s5: = [System.Convert]::FromBase64String( 0x2e601be:$s5: = [System.Convert]::FromBase64String( 0x2e6352c:$s5: = [System.Convert]::FromBase64String( 0x2e68b3e:$s5: = [System.Convert]::FromBase64String( 0x2e5dd8e:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x2e5fe33:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x2e631be:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x2e687b3:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x2e5df7c:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, 0x2e60021:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, 0x2e633ac:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, 0x2e689a1:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,
5415.1.000055df9305f000.000055df98c08000.r-x.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2b264fe:$x2: %d is an x86 process (can't inject x64 content) 0x2b2681d:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2b26a37:$x4: Failed to impersonate token from %d (%u) 0x2b26aa4:$x5: Failed to impersonate logged on user %d (%u) 0x2b25797:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: TeamServerImage PID: 5415	Windows_Trojan_CobaltStrike_c851687a	Identifies UAC Bypass module from Cobalt Strike	unknown	0x46c1ed:$a1: bypassuac.dll 0x46c202:$a1: bypassuac.dll 0x46c579:$a2: bypassuac.x64.dll 0x2d7470:$b12: ReflectiveLoader 0x2d749f:$b12: ReflectiveLoader 0x3b2161:$b12: ReflectiveLoader 0x3b217d:$b12: ReflectiveLoader 0x3da83d:$b12: ReflectiveLoader 0x3da859:$b12: ReflectiveLoader 0x3da93d:$b12: ReflectiveLoader 0x3da958:$b12: ReflectiveLoader 0x42f4d6:$b12: ReflectiveLoader 0x42f4e8:$b12: ReflectiveLoader 0x456f14:$b12: ReflectiveLoader 0x456f28:$b12: ReflectiveLoader 0x456f92:$b12: ReflectiveLoader 0x456faa:$b12: ReflectiveLoader 0x49e651:$b12: ReflectiveLoader 0x49e666:$b12: ReflectiveLoader 0x4e81d5:$b12: ReflectiveLoader
Process Memory Space: TeamServerImage PID: 5415	Windows_Trojan_CobaltStrike_09b79efa	Identifies Invoke Assembly module from Cobalt Strike	unknown	0x3ee9ca:$a1: invokeassembly.x64.dll 0x3ee9e8:$a1: invokeassembly.x64.dll 0x3efb4e:$a2: invokeassembly.dll 0x3efb68:$a2: invokeassembly.dll 0x2d7470:$b6: ReflectiveLoader 0x2d749f:$b6: ReflectiveLoader 0x3b2161:$b6: ReflectiveLoader 0x3b217d:$b6: ReflectiveLoader 0x3da83d:$b6: ReflectiveLoader 0x3da859:$b6: ReflectiveLoader 0x3da93d:$b6: ReflectiveLoader 0x3da958:$b6: ReflectiveLoader 0x42f4d6:$b6: ReflectiveLoader 0x42f4e8:$b6: ReflectiveLoader 0x456f14:$b6: ReflectiveLoader 0x456f28:$b6: ReflectiveLoader 0x456f92:$b6: ReflectiveLoader 0x456faa:$b6: ReflectiveLoader 0x49e651:$b6: ReflectiveLoader 0x49e666:$b6: ReflectiveLoader 0x4e81d5:$b6: ReflectiveLoader
Process Memory Space: TeamServerImage PID: 5415	Windows_Trojan_CobaltStrike_15f680fb	Identifies Netview module from Cobalt Strike	unknown	0x46c017:$a1: netview.x64.dll 0x46c02e:$a1: netview.x64.dll 0x46c551:$a2: netview.dll 0x46c564:$a2: netview.dll 0x2d7470:$b5: ReflectiveLoader 0x2d749f:$b5: ReflectiveLoader 0x42f4d6:$b5: ReflectiveLoader 0x42f4e8:$b5: ReflectiveLoader 0x4e81d5:$b5: ReflectiveLoader
Process Memory Space: TeamServerImage PID: 5415	Windows_Trojan_CobaltStrike_5b4383ec	Identifies Portscan module from Cobalt Strike	unknown	0x46c1bb:$a1: portscan.x64.dll 0x46c1d3:$a1: portscan.x64.dll 0x46c2ff:$a2: portscan.dll 0x46c313:$a2: portscan.dll 0x2d7470:$b4: ReflectiveLoader 0x2d749f:$b4: ReflectiveLoader 0x42f4d6:$b4: ReflectiveLoader 0x42f4e8:$b4: ReflectiveLoader 0x4e81d5:$b4: ReflectiveLoader
Process Memory Space: TeamServerImage PID: 5415	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x111d67:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x111dea:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x112935:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x112ded:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x112d5e:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x112ded:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x111e58:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x112075:$a7: could not run command (w/ token) because of its length of %d bytes! 0x111ea9:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x111ef2:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x112265:$a11: Could not open service control manager on %s: %d 0x112a93:$a12: %d is an x64 process (can't inject x86 content) 0x112ace:$a13: %d is an x86 process (can't inject x64 content) 0x113064:$a14: Failed to impersonate logged on user %d (%u) 0x112a36:$a15: could not create remote thread in %d: %d 0x111f33:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1129ce:$a17: could not write to process memory: %d 0x1122a1:$a18: Could not create service %s on %s: %d 0x112356:$a19: Could not delete service %s on %s: %d 0x112110:$a20: Could not open process token: %d (%u) 0x111f67:$a21: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: TeamServerImage PID: 5415	Windows_Trojan_CobaltStrike_d00573a3	Identifies Screenshot module from Cobalt Strike	unknown	0x3ef630:$a1: screenshot.x64.dll 0x3ef64a:$a1: screenshot.x64.dll 0x46bce3:$a2: screenshot.dll 0x46bcf9:$a2: screenshot.dll 0x2d7470:$b5: ReflectiveLoader 0x2d749f:$b5: ReflectiveLoader 0x3b2161:$b5: ReflectiveLoader 0x3b217d:$b5: ReflectiveLoader 0x3da83d:$b5: ReflectiveLoader 0x3da859:$b5: ReflectiveLoader 0x3da93d:$b5: ReflectiveLoader 0x3da958:$b5: ReflectiveLoader 0x42f4d6:$b5: ReflectiveLoader 0x42f4e8:$b5: ReflectiveLoader 0x456f14:$b5: ReflectiveLoader 0x456f28:$b5: ReflectiveLoader 0x456f92:$b5: ReflectiveLoader 0x456faa:$b5: ReflectiveLoader 0x49e651:$b5: ReflectiveLoader 0x49e666:$b5: ReflectiveLoader 0x4e81d5:$b5: ReflectiveLoader
Process Memory Space: TeamServerImage PID: 5415	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2d7470:$loader_export: ReflectiveLoader 0x2d749f:$loader_export: ReflectiveLoader 0x3b2161:$loader_export: ReflectiveLoader 0x3b217d:$loader_export: ReflectiveLoader 0x3da83d:$loader_export: ReflectiveLoader 0x3da859:$loader_export: ReflectiveLoader 0x3da93d:$loader_export: ReflectiveLoader 0x3da958:$loader_export: ReflectiveLoader 0x42f4d6:$loader_export: ReflectiveLoader 0x42f4e8:$loader_export: ReflectiveLoader 0x456f14:$loader_export: ReflectiveLoader 0x456f28:$loader_export: ReflectiveLoader 0x456f92:$loader_export: ReflectiveLoader 0x456faa:$loader_export: ReflectiveLoader 0x49e651:$loader_export: ReflectiveLoader 0x49e666:$loader_export: ReflectiveLoader 0x4e81d5:$loader_export: ReflectiveLoader 0x111cd6:$exportname: beacon.dll 0x456dd8:$exportname: beacon.dll 0x456deb:$exportname: beacon.dll 0x46be57:$exportname: beacon.dll
Process Memory Space: TeamServerImage PID: 5415	Msfpayloads_msf_6	Metasploit Payloads - file msf.vbs	Florian Roth	0x174369:$s1: = CreateObject("Wscript.Shell") 0x1755aa:$s1: = CreateObject("Wscript.Shell") 0x175391:$s2: = CreateObject("Scripting.FileSystemObject") 0x175420:$s3: .GetSpecialFolder(2) 0x175540:$s4: .Write Chr(CLng(" 0x175509:$s6: For i = 1 to Len( 0x175527:$s7: ) Step 2
Process Memory Space: TeamServerImage PID: 5415	Msfpayloads_msf_ref	Metasploit Payloads - file msf-ref.ps1	Florian Roth	0x1661c4:$s2: = ([AppDomain]::CurrentDomain.GetAssemblies() \| Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\') 0x1666dc:$s4: .DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', 0x1667a6:$s5: = [System.Convert]::FromBase64String( 0x16779f:$s5: = [System.Convert]::FromBase64String( 0x166438:$s6: [Parameter(Position = 0, Mandatory = $True)] [Type[]] 0x166626:$s7: DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard,
Process Memory Space: TeamServerImage PID: 5415	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x112ace:$x2: %d is an x86 process (can't inject x64 content) 0x112ded:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x112ff7:$x4: Failed to impersonate token from %d (%u) 0x113064:$x5: Failed to impersonate logged on user %d (%u) 0x111d67:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 22 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Malware Analysis System Evasion
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: TeamServerImage

Virustotal: Detection: 10%

Perma Link

Spreading

Found strings indicative of a multi-platform dropper

Source: TeamServerImage	String: curl,lynx,wget*
Source: TeamServerImage	String: curl,lynx,wget* C

Source: TeamServerImage	ELF static info symbol of initial sample: freeaddrinfo
Source: TeamServerImage	ELF static info symbol of initial sample: gai_strerror
Source: TeamServerImage	ELF static info symbol of initial sample: getaddrinfo
Source: TeamServerImage	ELF static info symbol of initial sample: getnameinfo

Source: TeamServerImage	String found in binary or memory: http://127.0.0.1:%u/
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/allow-java-encodings
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/continue-after-fatal-error
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/create-cdata-nodes
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/disallow-doctype-decl
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/create-entity-ref-nodes
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/dom/defer-node-expansion
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/dom/include-ignorable-whitespace
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/generate-synthetic-annotations
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/honour-all-schemaLocations
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/include-comments
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/parser-settings
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/internal/tolerate-duplicates
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/namespace-growth
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/nonvalidating/load-external-dtd
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/scanner/notify-builtin-refs
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/scanner/notify-char-refs
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/standard-uri-conformant
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validate-annotations
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/balance-syntax-trees
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/dynamic
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/id-idref-checking
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/identity-constraint-checking
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/schema
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/schema-full-checking
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/schema/augment-psvi
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/schema/element-default
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/schema/ignore-xsi-type-until-elemdecl
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/schema/normalized-value
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/validation/unparsed-entity-checking
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-duplicate-attdef
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/validation/warn-on-undeclared-elemdef
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/warn-on-duplicate-entitydef
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/features/xinclude
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-base-uris
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/features/xinclude/fixup-language
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/dom/current-element-node
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/dom/document-class-name
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/input-buffer-size
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/datatype-validator-factory
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/document-scanner
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-processor
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/dtd-scanner
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/entity-manager
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/entity-resolver
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-handler
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/error-reporter
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/grammar-pool
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-binder
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/namespace-context
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/stax-entity-resolver
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/symbol-table
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/internal/validation-manager
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/validation/schema/dv-factory
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/validator/dtd
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/validator/schema
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/xinclude-handler
Source: TeamServerImage	String found in binary or memory: http://apache.org/xml/properties/internal/xpointer-handler
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/locale
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/schema/external-schemaLocation
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/security-manager
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/validation/schema/root-element-declaration
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/properties/validation/schema/root-type-definition
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://apache.org/xml/serializer
Source: TeamServerImage	String found in binary or memory: http://blog.gentilkiwi.com/
Source: TeamServerImage	String found in binary or memory: http://commons.apache.org/logging/tech.html.
Source: TeamServerImage	String found in binary or memory: http://commons.apache.org/logging/troubleshooting.html.
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: TeamServerImage	String found in binary or memory: http://creativecommons.org/licenses/by/4.0/
Source: TeamServerImage	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: TeamServerImage	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: TeamServerImage	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: TeamServerImage	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: TeamServerImage	String found in binary or memory: http://ebourg.github.com/jsign
Source: TeamServerImage	String found in binary or memory: http://elonen.iki.fi/code/nanohttpd/
Source: TeamServerImage	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: TeamServerImage	String found in binary or memory: http://james.apache.org/mime4j/
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://java.sun.com/dtd/preferences.dtd
Source: TeamServerImage	String found in binary or memory: http://java.sun.com/xml/dom/properties/ancestor-check
Source: TeamServerImage	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaLanguage
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://java.sun.com/xml/jaxp/properties/schemaSource
Source: TeamServerImage	String found in binary or memory: http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace
Source: TeamServerImage	String found in binary or memory: http://java.sun.com/xml/stream/properties/ignore-external-dtd
Source: TeamServerImage	String found in binary or memory: http://java.sun.com/xml/stream/properties/reader-in-defined-state
Source: TeamServerImage	String found in binary or memory: http://java.sun.com/xml/stream/properties/report-cdata-event
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/feature/secure-processing
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/feature/useCatalog
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalDTDR
Source: TeamServerImage	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalSchema
Source: TeamServerImage	String found in binary or memory: http://javax.xml.XMLConstants/property/accessExternalStylesheet
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.dom.DOMResult/feature
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://javax.xml.transform.dom.DOMSource/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.sax.SAXResult/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.sax.SAXSource/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.sax.SAXTransformerFactory/feature/xmlfilter
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.stax.StAXResult/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.stax.StAXSource/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.stream.StreamResult/feature
Source: TeamServerImage	String found in binary or memory: http://javax.xml.transform.stream.StreamSource/feature
Source: TeamServerImage	String found in binary or memory: http://libtom.org/?page=index&newsitems=5&whatfile=crypt
Source: TeamServerImage	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: TeamServerImage	String found in binary or memory: http://sleep.dashnine.org
Source: TeamServerImage	String found in binary or memory: http://sleep.dashnine.org/manual
Source: TeamServerImage	String found in binary or memory: http://stackoverflow.com/questions/60269/how-to-implement-draggable-tab-using-java-swing
Source: TeamServerImage	String found in binary or memory: http://tango.freedesktop.org/
Source: TeamServerImage	String found in binary or memory: http://timestamp.comodoca.com/authenticode
Source: TeamServerImage	String found in binary or memory: http://timestamp.comodoca.com/rfc3161
Source: TeamServerImage	String found in binary or memory: http://www.chambersign.org
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: TeamServerImage	String found in binary or memory: http://www.exploit-monday.com/2012/05/accessing-native-windows-api-in.html
Source: TeamServerImage	String found in binary or memory: http://www.gentleface.com
Source: TeamServerImage	String found in binary or memory: http://www.gentleface.com/free_icon_set.html
Source: TeamServerImage	String found in binary or memory: http://www.gentleface.com/free_icon_set.html#geticons
Source: TeamServerImage	String found in binary or memory: http://www.gimp.org/xmp/
Source: TeamServerImage	String found in binary or memory: http://www.jgraphx.com/
Source: TeamServerImage	String found in binary or memory: http://www.jquery.com/
Source: TeamServerImage	String found in binary or memory: http://www.jyloo.com/synthetica/
Source: TeamServerImage	String found in binary or memory: http://www.metasploit.com/
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/feature/use-service-mechanism
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://www.oracle.com/xml
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/is-standalone
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/elementAttributeLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/enableExtensionFunctions
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/entityReplacementLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/getEntityCountInfo
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/isStandalone
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxElementDepth
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxOccurLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/maxXMLNameLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit
Source: TeamServerImage	String found in binary or memory: http://www.oracle.com/xml/jaxp/properties/xsltcIsStandalone
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: TeamServerImage	String found in binary or memory: http://www.tightvnc.com/
Source: TeamServerImage	String found in binary or memory: http://www.winpcap.org/
Source: TeamServerImage	String found in binary or memory: http://www.xmlmind.com/foconverter/
Source: TeamServerImage	String found in binary or memory: http://xml.apache.org/xalan
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.apache.org/xalan/features/incremental
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.apache.org/xalan/features/optimize
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.apache.org/xalan/properties/source-location
Source: TeamServerImage	String found in binary or memory: http://xml.apache.org/xslt
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/features/
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.org/sax/features/allow-dtd-events-after-endDTD
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.org/sax/features/use-entity-resolver2
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/properties/
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/properties/dom-node
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: TeamServerImage	String found in binary or memory: http://xml.org/sax/properties/xml-string
Source: TeamServerImage	String found in binary or memory: http://xmlgraphics.apache.org/fop/
Source: TeamServerImage	String found in binary or memory: https://attack.mitre.org/
Source: TeamServerImage	String found in binary or memory: https://attack.mitre.org/wiki/enterprise:Terms_of_Use
Source: TeamServerImage	String found in binary or memory: https://cobalt-strike.github.io/community_kit/
Source: TeamServerImage	String found in binary or memory: https://github.com/HaraldWalker/user-agent-utils
Source: TeamServerImage	String found in binary or memory: https://github.com/ars3n11/Aggressor-Scripts/blob/master/ProcessTree.cna
Source: TeamServerImage	String found in binary or memory: https://github.com/chemeris/msinttypes/blob/master/stdint.h
Source: TeamServerImage	String found in binary or memory: https://github.com/hfiref0x/UACME/
Source: TeamServerImage	String found in binary or memory: https://github.com/leechristensen/UnmanagedPowerShell
Source: TeamServerImage	String found in binary or memory: https://github.com/libssh2/libssh2
Source: TeamServerImage	String found in binary or memory: https://github.com/natevw/ipcalf
Source: TeamServerImage	String found in binary or memory: https://github.com/rsmudge/vncdll
Source: TeamServerImage	String found in binary or memory: https://github.com/stephenfewer/ReflectiveDLLInjection
Source: TeamServerImage	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: https://repository.luxtrust.lu
Source: TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: TeamServerImage	String found in binary or memory: https://tls.mbed.org/
Source: TeamServerImage	String found in binary or memory: https://www.cobaltstrike.com/
Source: TeamServerImage	String found in binary or memory: https://www.cobaltstrike.com/help-malleable-c2#validssl
Source: TeamServerImage	String found in binary or memory: https://www.cobaltstrike.com/scripts
Source: TeamServerImage	String found in binary or memory: https://www.cobaltstrike.com/support
Source: TeamServerImage	String found in binary or memory: https://www.graalvm.org/
Source: TeamServerImage	String found in binary or memory: https://www.graalvm.org/reference-manual/native-image/CertificateManagement#runtime-options

System Summary

Malicious sample detected (through community Yara rule)

Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Shellcode_Generic_8c487e57 Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies UAC Bypass module from Cobalt Strike Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies Invoke Assembly module from Cobalt Strike Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies Netview module from Cobalt Strike Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies Portscan module from Cobalt Strike Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies Screenshot module from Cobalt Strike Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon). Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon). Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Swrort_5ad1a4f9 Author: unknown
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.vbs Author: Florian Roth
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Identifies UAC Bypass module from Cobalt Strike Author: unknown
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Identifies Invoke Assembly module from Cobalt Strike Author: unknown
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Identifies Netview module from Cobalt Strike Author: unknown
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Identifies Portscan module from Cobalt Strike Author: unknown
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Identifies Screenshot module from Cobalt Strike Author: unknown
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Metasploit Payloads - file msf.vbs Author: Florian Roth
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Metasploit Payloads - file msf-ref.ps1 Author: Florian Roth
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Shellcode_Generic_8c487e57 os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Shellcode.Generic, fingerprint = 834caf96192a513aa93ac48fb8d2f3326bf9f08acaf7a27659f688b26e3e57e4, id = 8c487e57-4b8c-488e-a1d9-786ff935fd2c, last_modified = 2022-07-18
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_c851687a os = windows, severity = x86, description = Identifies UAC Bypass module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 70224e28a223d09f2211048936beb9e2d31c0312c97a80e22c85e445f1937c10, id = c851687a-aac6-43e7-a0b6-6aed36dcf12e, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_09b79efa os = windows, severity = x86, description = Identifies Invoke Assembly module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 04ef6555e8668c56c528dc62184331a6562f47652c73de732e5f7c82779f2fd8, id = 09b79efa-55d7-481d-9ee0-74ac5f787cef, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_15f680fb os = windows, severity = x86, description = Identifies Netview module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 0ecb8e41c01bf97d6dea4cf6456b769c6dd2a037b37d754f38580bcf561e1d2c, id = 15f680fb-a04f-472d-a182-0b9bee111351, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_5b4383ec os = windows, severity = x86, description = Identifies Portscan module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 283d3d2924e92b31f26ec4fc6b79c51bd652fb1377b6985b003f09f8c3dba66c, id = 5b4383ec-3c93-4e91-850e-d43cc3a86710, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_d00573a3 os = windows, severity = x86, description = Identifies Screenshot module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = b6fa0792b99ea55f359858d225685647f54b55caabe53f58b413083b8ad60e79, id = d00573a3-db26-4e6b-aabf-7af4a818f383, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_38b8ceec os = windows, severity = x86, description = Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)., creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 44b9022d87c409210b1d0807f5a4337d73f19559941660267d63cd2e4f2ff342, id = 38b8ceec-601c-4117-b7a0-74720e26bf38, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_24338919 os = windows, severity = x86, description = Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)., creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = ac76190a84c4bdbb6927c5ad84a40e2145ca9e76369a25ac2ffd727eefef4804, id = 24338919-8efe-4cf2-a23a-a3f22095b42d, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d reference_sample = 0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987, os = windows, severity = x86, creation_date = 2021-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3, id = 91bc5d7d-31e3-4c02-82b3-a685194981f3, last_modified = 2021-10-04
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Swrort_5ad1a4f9 reference_sample = fa5695c355a6dc1f368a4b36a45e8f18958dacdbe0eac80c618fbec976bac8fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Swrort, fingerprint = a91458dd4bcd082506c554ca8479e1b0d23598e0e9a0e44ae1afb2651ce38dce, id = 5ad1a4f9-bfe5-4e5f-94e9-4983c93a1c1f, last_modified = 2021-09-16
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_6 date = 2017-02-09, hash1 = 8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f, author = Florian Roth, description = Metasploit Payloads - file msf.vbs, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5415.1.000055df9305f000.000055df98c08000.r-x.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_c851687a os = windows, severity = x86, description = Identifies UAC Bypass module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 70224e28a223d09f2211048936beb9e2d31c0312c97a80e22c85e445f1937c10, id = c851687a-aac6-43e7-a0b6-6aed36dcf12e, last_modified = 2021-08-23
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_09b79efa os = windows, severity = x86, description = Identifies Invoke Assembly module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 04ef6555e8668c56c528dc62184331a6562f47652c73de732e5f7c82779f2fd8, id = 09b79efa-55d7-481d-9ee0-74ac5f787cef, last_modified = 2021-08-23
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_15f680fb os = windows, severity = x86, description = Identifies Netview module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 0ecb8e41c01bf97d6dea4cf6456b769c6dd2a037b37d754f38580bcf561e1d2c, id = 15f680fb-a04f-472d-a182-0b9bee111351, last_modified = 2021-08-23
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_5b4383ec os = windows, severity = x86, description = Identifies Portscan module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 283d3d2924e92b31f26ec4fc6b79c51bd652fb1377b6985b003f09f8c3dba66c, id = 5b4383ec-3c93-4e91-850e-d43cc3a86710, last_modified = 2021-08-23
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_d00573a3 os = windows, severity = x86, description = Identifies Screenshot module from Cobalt Strike, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = b6fa0792b99ea55f359858d225685647f54b55caabe53f58b413083b8ad60e79, id = d00573a3-db26-4e6b-aabf-7af4a818f383, last_modified = 2021-08-23
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Msfpayloads_msf_6 date = 2017-02-09, hash1 = 8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f, author = Florian Roth, description = Metasploit Payloads - file msf.vbs, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: Msfpayloads_msf_ref date = 2017-02-09, hash1 = 4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87, author = Florian Roth, description = Metasploit Payloads - file msf-ref.ps1, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: TeamServerImage PID: 5415, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: Initial sample	Potential command found: net [command] [arguments]
Source: Initial sample	Potential command found: net dclist <DOMAIN>
Source: Initial sample	Potential command found: net domain_trusts <DOMAIN>
Source: Initial sample	Potential command found: net group <\\TARGET> <GROUPNAME>
Source: Initial sample	Potential command found: net localgroup <\\TARGET> <GROUPNAME>
Source: Initial sample	Potential command found: net logons <\\TARGET>
Source: Initial sample	Potential command found: net sessions <\\TARGET>
Source: Initial sample	Potential command found: net share <\\TARGET>
Source: Initial sample	Potential command found: net time <\\TARGET>
Source: Initial sample	Potential command found: net user <\\TARGET> <USER>
Source: Initial sample	Potential command found: net view <DOMAIN>
Source: Initial sample	Potential command found: net computers <DOMAIN.FQDN>
Source: Initial sample	Potential command found: net domain_controllers <DOMAIN.FQDN>
Source: Initial sample	Potential command found: ssh [target:port] [user] [pass]
Source: Initial sample	Potential command found: zip comment read failed
Source: Initial sample	Potential command found: zip comment read failed C
Source: Initial sample	Potential command found: zip file is empty
Source: Initial sample	Potential command found: zip file is empty C
Source: Initial sample	Potential command found: zip END header not found C
Source: Initial sample	Potential command found: GET https://
Source: Initial sample	Potential command found: GET https:// C
Source: Initial sample	Potential command found: zip file closed
Source: Initial sample	Potential command found: zip file closed C

Source: classification engine

Classification label: mal64.spre.evad.lin@0/0@0/0

Source: TeamServerImage

Binary or memory string: Set xlmodule = objWorkbook.VBProject.VBComponents.Add(1)

Source: TeamServerImage	Binary or memory string: item "&VMware" { host_update($1, $null, "VMware", 1.0, $null); }
Source: TeamServerImage	Binary or memory string: org.graalvm.compiler.hotspot.HotSpotGraalJVMCIServiceLocator
Source: TeamServerImage	Binary or memory string: resources/vmware-logo-icon.png C
Source: TeamServerImage	Binary or memory string: dO,jdk.vm.ci.hotspot.HotSpotJVMCIBackendFactory C
Source: TeamServerImage	Binary or memory string: ;jdk.vm.ci.hotspot.aarch64.AArch64HotSpotJVMCIBackendFactory C
Source: TeamServerImage	Binary or memory string: $&jdk.vm.ci.services.JVMCIServiceLocator C
Source: TeamServerImage	Binary or memory string: resources/vmware-logo-icon.png
Source: TeamServerImage	Binary or memory string: jdk.vm.ci.hotspot.HotSpotJVMCIBackendFactory
Source: TeamServerImage	Binary or memory string: jdk.vm.ci.services.JVMCIServiceLocator
Source: TeamServerImage	Binary or memory string: java.lang.VirtualMachineError
Source: TeamServerImage	Binary or memory string: jdk.vm.ci.hotspot.aarch64.AArch64HotSpotJVMCIBackendFactory
Source: TeamServerImage	Binary or memory string: jdk.vm.ci.hotspot.amd64.AMD64HotSpotJVMCIBackendFactory
Source: TeamServerImage	Binary or memory string: R@Native image does not support the following JVMCI CPU features: C
Source: TeamServerImage	Binary or memory string: 127jdk.vm.ci.hotspot.amd64.AMD64HotSpotJVMCIBackendFactory C
Source: TeamServerImage	Binary or memory string: java.lang.VirtualMachineError C
Source: TeamServerImage	Binary or memory string: VirtualMachineError.java C
Source: TeamServerImage	Binary or memory string: .BV<org.graalvm.compiler.hotspot.HotSpotGraalJVMCIServiceLocator C
Source: TeamServerImage	Binary or memory string: Native image does not support the following JVMCI CPU features: C

Lowering of HIPS / PFW / Operating System Security Settings

Sample contains AV-related strings

Source: TeamServerImage	esets: Connection resetsun/net/ConnectionResetExceptionsun/nio/fs/UnixExceptionsun/nio/fs/UnixFileAttributesst_modest_inost_devst_rdevst_nlinkst_uidst_gidst_sizest_atime_secst_atime_nsecst_mtime_secst_mtime_nsecst_ctime_secst_ctime_nsecf_frsizef_blocksf_bfreef_bavailsun/nio/fs/UnixMountEntryfstypeoptsopenat64fstatat64unlinkatrenameatfutimesatlutimesfutimensfdopendirsun/nio/fs/UnixFileStoreAttributesshould not reach heremy_futimesat_func is NULLmy_futimens_func is NULLmy_lutimes_func is NULLnative heapappendclose failedStream ClosedGetLength failedSeek failedSeek errorjava/io/IOExceptionerror=%d, %s:/bin:/usr/binPATHCan't set SIGCHLD handlerBad file descriptor%d:%dvfork failedposix_spawn failedExec failedFailed to exec spawn helper: pid: %d, exit value: %dFailed to exec spawn helper: pid: %d, signal: %dFailed to exec spawn helper: pid: %d, status: 0x%08xBad code from spawn helper (Failed to exec spawn helper)
Source: TeamServerImage	clamd: exclamdown
Source: TeamServerImage	clamd: .notdef.nullnonmarkingreturnspaceexclamquotedblnumbersigndollarpercentampersandquotesingleparenleftparenrightasteriskpluscommahyphenperiodslashzeroonetwothreefourfivesixseveneightninecolonsemicolonlessequalgreaterquestionatABCDEFGHIJKLMNOPQRSTUVWXYZbracketleftbackslashbracketrightasciicircumunderscoregraveabcdefghijklmnopqrstuvwxyzbraceleftbarbracerightasciitildeAdieresisAringCcedillaEacuteNtildeOdieresisUdieresisaacuteagraveacircumflexadieresisatildearingccedillaeacuteegraveecircumflexedieresisiacuteigraveicircumflexidieresisntildeoacuteograveocircumflexodieresisotildeuacuteugraveucircumflexudieresisdaggerdegreecentsterlingsectionbulletparagraphgermandblsregisteredcopyrighttrademarkacutedieresisnotequalAEOslashinfinityplusminuslessequalgreaterequalyenmupartialdiffsummationproductpiintegralordfeminineordmasculineOmegaaeoslashquestiondownexclamdownlogicalnotradicalflorinapproxequalDeltaguillemotleftguillemotrightellipsisnonbreakingspaceAgraveAtildeOtildeOEoeendashemdashquotedblleftquotedblrightquoteleftquoterightdividelozengeydieresisYdieresisfractioncurrencyguilsinglleftguilsinglrightfifldaggerdblperiodcenteredquotesinglbasequotedblbaseperthousandAcircumflexEcircumflexAacuteEdieresisEgraveIacuteIcircumflexIdieresisIgraveOacuteOcircumflexappleOgraveUacuteUcircumflexUgravedotlessicircumflextildemacronbrevedotaccentringcedillahungarumlautogonekcaronLslashlslashScaronscaronZcaronzcaronbrokenbarEthethYacuteyacuteThornthornminusmultiplyonesuperiortwosuperiorthreesuperioronehalfonequarterthreequartersfrancGbrevegbreveIdotaccentScedillascedillaCacutecacuteCcaronccarondcroat
Source: TeamServerImage	clamd: exclamdownsmall
Source: TeamServerImage	clamd: .notdefspaceexclamquotedblnumbersigndollarpercentampersandquoterightparenleftparenrightasteriskpluscommahyphenperiodslashzeroonetwothreefourfivesixseveneightninecolonsemicolonlessequalgreaterquestionatABCDEFGHIJKLMNOPQRSTUVWXYZbracketleftbackslashbracketrightasciicircumunderscorequoteleftabcdefghijklmnopqrstuvwxyzbraceleftbarbracerightasciitildeexclamdowncentsterlingfractionyenflorinsectioncurrencyquotesinglequotedblleftguillemotleftguilsinglleftguilsinglrightfiflendashdaggerdaggerdblperiodcenteredparagraphbulletquotesinglbasequotedblbasequotedblrightguillemotrightellipsisperthousandquestiondowngraveacutecircumflextildemacronbrevedotaccentdieresisringcedillahungarumlautogonekcaronemdashAEordfeminineLslashOslashOEordmasculineaedotlessilslashoslashoegermandblsonesuperiorlogicalnotmutrademarkEthonehalfplusminusThornonequarterdividebrokenbardegreethornthreequarterstwosuperiorregisteredminusethmultiplythreesuperiorcopyrightAacuteAcircumflexAdieresisAgraveAringAtildeCcedillaEacuteEcircumflexEdieresisEgraveIacuteIcircumflexIdieresisIgraveNtildeOacuteOcircumflexOdieresisOgraveOtildeScaronUacuteUcircumflexUdieresisUgraveYacuteYdieresisZcaronaacuteacircumflexadieresisagravearingatildeccedillaeacuteecircumflexedieresisegraveiacuteicircumflexidieresisigraventildeoacuteocircumflexodieresisograveotildescaronuacuteucircumflexudieresisugraveyacuteydieresiszcaronexclamsmallHungarumlautsmalldollaroldstyledollarsuperiorampersandsmallAcutesmallparenleftsuperiorparenrightsuperiortwodotenleaderonedotenleaderzerooldstyleoneoldstyletwooldstylethreeoldstylefouroldstylefiveoldstylesixoldstylesevenoldstyleeightoldstylenineoldstylecommasuperiorthreequartersemdashperiodsuperiorquestionsmallasuperiorbsuperiorcentsuperiordsuperioresuperiorisuperiorlsuperiormsuperiornsuperiorosuperiorrsuperiorssuperiortsuperiorffffifflparenleftinferiorparenrightinferiorCircumflexsmallhyphensuperiorGravesmallAsmallBsmallCsmallDsmallEsmallFsmallGsmallHsmallIsmallJsmallKsmallLsmallMsmallNsmallOsmallPsmallQsmallRsmallSsmallTsmallUsmallVsmallWsmallXsmallYsmallZsmallcolonmonetaryonefittedrupiahTildesmallexclamdownsmallcentoldstyleLslashsmallScaronsmallZcaronsmallDieresissmallBrevesmallCaronsmallDotaccentsmallMacronsmallfiguredashhypheninferiorOgoneksmallRingsmallCedillasmallquestiondownsmalloneeighththreeeighthsfiveeighthsseveneighthsonethirdtwothirdszerosuperiorfoursuperiorfivesuperiorsixsuperiorsevensuperioreightsuperiorninesuperiorzeroinferioroneinferiortwoinferiorthreeinferiorfourinferiorfiveinferiorsixinferiorseveninferioreightinferiornineinferiorcentinferiordollarinferiorperiodinferiorcommainferiorAgravesmallAacutesmallAcircumflexsmallAtildesmallAdieresissmallAringsmallAEsmallCcedillasmallEgravesmallEacutesmallEcircumflexsmallEdieresissmallIgravesmallIacutesmallIcircumflexsmallIdieresissmallEthsmallNtildesmallOgravesmallOacutesmallOcircumflexsmallOtildesmallOdieresissmallOEsmallOslashsmallUgravesmallUacutesmallUcircumflexsmallUdieresissmallYacutesmallThornsmallYdieresissmall001.000001.001001.00
Source: TeamServerImage	esets: jdk.internal.icu.impl.UnicodeSetStringSpan$OffsetList
Source: TeamServerImage	esets: u95jdk.internal.icu.impl.UnicodeSetStringSpan$OffsetList C
Source: TeamServerImage	avast: com.oracle.svm.core.stack.JavaStackFrameVisitor
Source: TeamServerImage	avast: Z/com.oracle.svm.core.stack.JavaStackFrameVisitor C
Source: TeamServerImage	esets: jdk.internal.icu.impl.UnicodeSetStringSpan
Source: TeamServerImage	esets: *jdk.internal.icu.impl.UnicodeSetStringSpan C
Source: TeamServerImage	avast: com.oracle.svm.core.stack.JavaStackWalker
Source: TeamServerImage	avast: h)com.oracle.svm.core.stack.JavaStackWalker C
Source: TeamServerImage	avast: com.oracle.svm.core.stack.JavaStackWalk
Source: TeamServerImage	avast: 'com.oracle.svm.core.stack.JavaStackWalk C
Source: TeamServerImage	avast: JavaStackFrameVisitor.java
Source: TeamServerImage	avast: JavaStackFrameVisitor.java C
Source: TeamServerImage	esets: UnicodeSetStringSpan.java
Source: TeamServerImage	esets: UnicodeSetStringSpan.java C
Source: TeamServerImage	avast: slowPathRunJavaStateActions
Source: TeamServerImage	avast: slowPathRunJavaStateActions C
Source: TeamServerImage	esets: jdk.xml.resetSymbolTable C
Source: TeamServerImage	avast: MaxJavaStackTraceDepth
Source: TeamServerImage	avast: MaxJavaStackTraceDepth C
Source: TeamServerImage	esets: resetStreamSettings
Source: TeamServerImage	esets: resetStreamSettings C
Source: TeamServerImage	avast: toJavaStringUnchecked
Source: TeamServerImage	avast: toJavaStringUnchecked C
Source: TeamServerImage	esets: resetSchemaValidator
Source: TeamServerImage	esets: resetSchemaValidator C
Source: TeamServerImage	avast: JavaStackWalk.java
Source: TeamServerImage	avast: JavaStackWalk.java C
Source: TeamServerImage	avast: JavaStackWalker.java
Source: TeamServerImage	avast: JavaStackWalker.java C
Source: TeamServerImage	esets: RESETSYMBOLTABLE C
Source: TeamServerImage	esets: resetStrBuffer
Source: TeamServerImage	esets: resetStrBuffer C

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 Disable or Modify Tools	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TeamServerImage	10%	Virustotal		Browse
TeamServerImage	11%	ReversingLabs	Linux.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://javax.xml.XMLConstants/property/accessExternalDTDR	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://apache.org/xml/features/dom/create-entity-ref-nodes	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://javax.xml.XMLConstants/property/accessExternalDTDR	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false	Avira URL Cloud: safe	unknown
http://apache.org/xml/features/validation/dynamic	TeamServerImage	false		high
http://apache.org/xml/features/validation/schema/augment-psvi	TeamServerImage	false		high
http://apache.org/xml/properties/internal/validator/dtd	TeamServerImage	false		high
http://crl.chambersign.org/chambersroot.crl0	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://apache.org/xml/properties/input-buffer-size	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/properties/internal/datatype-validator-factory	TeamServerImage	false		high
http://apache.org/xml/properties/internal/validator/schema	TeamServerImage	false		high
http://apache.org/xml/features/validation/schema/ignore-xsi-type-until-elemdecl	TeamServerImage	false		high
http://www.tightvnc.com/	TeamServerImage	false		high
http://apache.org/xml/features/validate-annotations	TeamServerImage	false		high
http://www.chambersign.org1	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://blog.gentilkiwi.com/	TeamServerImage	false		unknown
http://repository.swisssign.com/0	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://xml.org/sax/features/namespace-prefixes	TeamServerImage	false		high
http://apache.org/xml/properties/internal/entity-manager	TeamServerImage	false		high
http://apache.org/xml/properties/internal/dtd-processor	TeamServerImage	false		high
http://apache.org/xml/features/namespace-growth	TeamServerImage	false		high
http://xml.org/sax/features/string-interning	TeamServerImage	false		high
http://commons.apache.org/logging/troubleshooting.html.	TeamServerImage	false		high
https://ocsp.quovadisoffshore.com	TeamServerImage	false		unknown
http://apache.org/xml/features/internal/parser-settings	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/features/dom/include-ignorable-whitespace	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/features/create-cdata-nodes	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://libtom.org/?page=index&newsitems=5&whatfile=crypt	TeamServerImage	false		unknown
http://sleep.dashnine.org/manual	TeamServerImage	false		unknown
http://apache.org/xml/properties/internal/stax-entity-resolver	TeamServerImage	false		high
https://repository.luxtrust.lu	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://javax.xml.XMLConstants/feature/secure-processing	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://xmlgraphics.apache.org/fop/	TeamServerImage	false		high
https://github.com/natevw/ipcalf	TeamServerImage	false		high
http://apache.org/xml/features/xinclude/fixup-base-uris	TeamServerImage	false		high
https://github.com/chemeris/msinttypes/blob/master/stdint.h	TeamServerImage	false		high
http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://www.jgraphx.com/	TeamServerImage	false		unknown
http://apache.org/xml/properties/internal/error-reporter	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/properties/internal/namespace-context	TeamServerImage	false		high
http://apache.org/xml/features/warn-on-duplicate-entitydef	TeamServerImage	false		high
http://javax.xml.XMLConstants/feature/useCatalog	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://javax.xml.XMLConstants/property/accessExternalSchema	TeamServerImage	false		unknown
http://apache.org/xml/features/include-comments	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/features/scanner/notify-char-refs	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://ebourg.github.com/jsign	TeamServerImage	false		high
http://java.sun.com/xml/stream/properties/report-cdata-event	TeamServerImage	false		unknown
http://policy.camerfirma.com0	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://java.sun.com/dtd/preferences.dtd	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://java.sun.com/xml/stream/properties/ignore-external-dtd	TeamServerImage	false		unknown
http://javax.xml.transform.stax.StAXSource/feature	TeamServerImage	false		unknown
http://apache.org/xml/features/continue-after-fatal-error	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/features/standard-uri-conformant	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/properties/internal/document-scanner	TeamServerImage	false		high
http://ns.useplus.org/ldf/xmp/1.0/	TeamServerImage	false		unknown
https://tls.mbed.org/	TeamServerImage	false		high
http://apache.org/xml/features/validation/identity-constraint-checking	TeamServerImage	false		high
http://xml.apache.org/xalan/features/optimize	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://xml.org/sax/features/use-entity-resolver2	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
https://www.cobaltstrike.com/help-malleable-c2#validssl	TeamServerImage	false		high
http://apache.org/xml/properties/internal/entity-resolver	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	TeamServerImage	false		unknown
https://github.com/libssh2/libssh2	TeamServerImage	false		high
http://apache.org/xml/features/	TeamServerImage	false		high
http://apache.org/xml/features/generate-synthetic-annotations	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
https://github.com/HaraldWalker/user-agent-utils	TeamServerImage	false		high
http://xml.org/sax/features/allow-dtd-events-after-endDTD	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/features/validation/balance-syntax-trees	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://www.gentleface.com/free_icon_set.html	TeamServerImage	false		unknown
https://www.cobaltstrike.com/	TeamServerImage	false		high
http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
https://github.com/stephenfewer/ReflectiveDLLInjection	TeamServerImage	false		high
http://crl.securetrust.com/STCA.crl	TeamServerImage	false		unknown
http://apache.org/xml/properties/internal/namespace-binder	TeamServerImage	false		high
https://github.com/rsmudge/vncdll	TeamServerImage	false		high
http://www.oracle.com/xml/is-standalone	TeamServerImage	false		high
http://crl.xrampsecurity.com/XGCA.crl0	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://javax.xml.transform.sax.SAXTransformerFactory/feature	TeamServerImage	false		unknown
http://xml.org/sax/features/validation	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://javax.xml.XMLConstants/property/accessExternalStylesheet	TeamServerImage	false		unknown
http://www.jyloo.com/synthetica/	TeamServerImage	false		unknown
http://www.winpcap.org/	TeamServerImage	false		high
https://attack.mitre.org/	TeamServerImage	false		high
http://apache.org/xml/properties/internal/xinclude-handler	TeamServerImage	false		high
http://www.quovadis.bm0	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown
http://apache.org/xml/properties/security-manager	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://apache.org/xml/features/validation/unparsed-entity-checking	TeamServerImage	false		high
http://java.sun.com/xml/dom/properties/ancestor-check	TeamServerImage	false		unknown
http://xml.apache.org/xslt	TeamServerImage	false		high
https://cobalt-strike.github.io/community_kit/	TeamServerImage	false		unknown
http://apache.org/xml/features/validation/schema	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://javax.xml.transform.stax.StAXResult/feature	TeamServerImage	false		unknown
http://apache.org/xml/properties/internal/dtd-scanner	TeamServerImage	false		high
http://xml.org/sax/properties/lexical-handler	TeamServerImage	false		high
http://apache.org/xml/properties/schema/external-schemaLocation	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
https://www.graalvm.org/	TeamServerImage	false		unknown
http://james.apache.org/mime4j/	TeamServerImage	false		high
http://xml.org/sax/features/	TeamServerImage	false		high
http://apache.org/xml/properties/internal/error-handler	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		high
http://www.gentleface.com	TeamServerImage	false		unknown
https://repository.luxtrust.lu0	TeamServerImage, 5415.1.00007f34e891a000.00007f34e9760000.rw-.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped, too many notes (256)
Entropy (8bit):	6.331906005851493
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	TeamServerImage
File size:	96'448'168 bytes
MD5:	b50b86d735412685eb6044ad8d01781c
SHA1:	a83ca7884d0a5aa87e1cbfcf979702eeba6476b7
SHA256:	fe7a8192cea4c6bd5f1bc187d61e3156ca1e452e3160bed15f1e8d18cccf86a5
SHA512:	ac94fa8e731bcb5954ddaecbec8f3c17f0fa681db527476c3dc60b26918f65354feccca3c501adcd7235a8b2972786c33c0d34397ddb2a8d67a3080281065258
SSDEEP:	786432:RWXPcu9IEmx2xVWTWSoZv0YMfQoq3iT2sntEEDF:YmEmcVGWSoZvtMfQF3HEt
TLSH:	4F283902F99005ADD5ABC27A46BF0E72EB773036827C5BCB76CC44114FCB9A14A7A791
File Content Preview:	.ELF..............>.....@V).....@...................@.8...@.(.'.........@.......@.......@.......h.......h.......................................................................................................%.......%......... .............h.......h......

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	DYN (Shared object file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x295640
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	11
Section Header Offset:	96445608
Section Header Size:	64
Number of Section Headers:	40
Header String Table Index:	39

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x2a8	0x2a8	0x1c	0x0	0x2	A	0	0	1
.note.ABI-tag	NOTE	0x2c4	0x2c4	0x20	0x0	0x2	A	0	0	4
.note.gnu.property	NOTE	0x2e8	0x2e8	0x32a0	0x0	0x2	A	0	0	8
.note.gnu.build-id	NOTE	0x3588	0x3588	0x24	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x35b0	0x35b0	0xf0	0x0	0x2	A	6	0	8
.dynsym	DYNSYM	0x36a0	0x36a0	0x18d8	0x18	0x2	A	7	1	8
.dynstr	STRTAB	0x4f78	0x4f78	0x12c3	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x623c	0x623c	0x212	0x2	0x2	A	6	0	2
.gnu.version_r	VERNEED	0x6450	0x6450	0x170	0x0	0x2	A	7	7	8
.rela.dyn	RELA	0x65c0	0x65c0	0x28bd08	0x18	0x2	A	6	0	8
.rela.plt	RELA	0x2922c8	0x2922c8	0x11a0	0x18	0x42	AI	6	26	8
.init	PROGBITS	0x293468	0x293468	0x17	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x293480	0x293480	0xbd0	0x10	0x6	AX	0	0	16
.plt.got	PROGBITS	0x294050	0x294050	0x10	0x8	0x6	AX	0	0	8
.text	PROGBITS	0x295000	0x295000	0x24cc022	0x0	0x6	AX	0	0	4096
.fini	PROGBITS	0x2761024	0x2761024	0x9	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x2762000	0x2762000	0x312d0	0x0	0x2	A	0	0	4096
.svm_heap	PROGBITS	0x2794000	0x2794000	0x33f4000	0x0	0x2	A	0	0	4096
.eh_frame_hdr	PROGBITS	0x5b88000	0x5b88000	0x548c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x5b8d490	0x5b8d490	0x1abc0	0x0	0x2	A	0	0	8
.gcc_except_table	PROGBITS	0x5ba8050	0x5ba8050	0x2d5	0x0	0x2	A	0	0	1
.init_array	INIT_ARRAY	0x5da8e68	0x5ba8e68	0x10	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x5da8e78	0x5ba8e78	0x8	0x8	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0x5da8e80	0x5ba8e80	0x1888	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0x5daa708	0x5baa708	0x280	0x10	0x3	WA	7	0	8
.got	PROGBITS	0x5daa988	0x5baa988	0x660	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x5dab000	0x5bab000	0x102c8	0x0	0x3	WA	0	0	4096
.bss	NOBITS	0x5dbb2e0	0x5bbb2c8	0x22150	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x5bbb2c8	0x67	0x1	0x30	MS	0	0	1
.debug_aranges	PROGBITS	0x0	0x5bbb32f	0xe80	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x5bbc1af	0xde45	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x5bc9ff4	0xdb1	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x5bcada5	0x1da2	0x0	0x0		0	0	1
.debug_str	PROGBITS	0x0	0x5bccb47	0x4d67	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x5bd18ae	0x58b1	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x5bd715f	0x1420	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x5bd8580	0xe208	0x18	0x0		38	902	8
.strtab	STRTAB	0x0	0x5be6788	0x13b8a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x5bfa312	0x193	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x40	0x40	0x268	0x268	2.0461	0x4	R	0x8
INTERP	0x2a8	0x2a8	0x2a8	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x0	0x0	0x5ba8325	0x5ba8325	6.3346	0x5	R E	0x200000		.interp .note.ABI-tag .note.gnu.property .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .svm_heap .eh_frame_hdr .eh_frame .gcc_except_table
LOAD	0x5ba8e68	0x5da8e68	0x5da8e68	0x12460	0x345c8	2.8924	0x6	RW	0x200000		.init_array .fini_array .data.rel.ro .dynamic .got .data .bss
DYNAMIC	0x5baa708	0x5daa708	0x5daa708	0x280	0x280	1.7380	0x6	RW	0x8		.dynamic
NOTE	0x2c4	0x2c4	0x2c4	0x20	0x20	1.5613	0x4	R	0x4		.note.ABI-tag
NOTE	0x2e8	0x2e8	0x2e8	0x32a0	0x32a0	1.9152	0x4	R	0x8		.note.gnu.property
NOTE	0x3588	0x3588	0x3588	0x24	0x24	4.1916	0x4	R	0x4		.note.gnu.build-id
GNU_EH_FRAME	0x5b88000	0x5b88000	0x5b88000	0x548c	0x548c	5.9866	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x5ba8e68	0x5da8e68	0x5da8e68	0x2198	0x2198	3.1694	0x4	R	0x1		.init_array .fini_array .data.rel.ro .dynamic .got

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libstdc++.so.6	0x1
DT_NEEDED	sharedlib	libm.so.6	0x1
DT_NEEDED	sharedlib	libfreetype.so.6	0x1
DT_NEEDED	sharedlib	libpthread.so.0	0x1
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	libz.so.1	0x1
DT_NEEDED	sharedlib	librt.so.1	0x1
DT_NEEDED	sharedlib	libgcc_s.so.1	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_INIT	value	0x293468	0xc
DT_FINI	value	0x2761024	0xd
DT_INIT_ARRAY	value	0x5da8e68	0x19
DT_INIT_ARRAYSZ	bytes	16	0x1b
DT_FINI_ARRAY	value	0x5da8e78	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_GNU_HASH	value	0x35b0	0x6ffffef5
DT_STRTAB	value	0x4f78	0x5
DT_SYMTAB	value	0x36a0	0x6
DT_STRSZ	bytes	4803	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x5daa988	0x3
DT_PLTRELSZ	bytes	4512	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x2922c8	0x17
DT_RELA	value	0x65c0	0x7
DT_RELASZ	bytes	2669832	0x8
DT_RELAENT	bytes	24	0x9
DT_TEXTREL	value	0x0	0x16
DT_FLAGS	value	0xc	0x1e
DT_FLAGS_1	value	0x8000001	0x6ffffffb
DT_VERNEED	value	0x6450	0x6ffffffe
DT_VERNEEDNUM	value	7	0x6fffffff
DT_VERSYM	value	0x623c	0x6ffffff0
DT_RELACOUNT	value	111168	0x6ffffff9
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
FT_Activate_Size			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Done_Face			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Done_FreeType			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Get_Char_Index			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Init_FreeType			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Library_SetLcdFilter			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Load_Glyph			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Matrix_Multiply			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_MulFix			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_New_Memory_Face			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Open_Face			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Decompose			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Embolden			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Get_BBox			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Get_CBox			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Translate			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Render_Glyph			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Set_Char_Size			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Set_Transform			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
IsolateEnterStub__CEntryPointNativeFunctions__attachThread__fe8e89788bae97cf98065b8b062da14102a906b7__2b64db5eac3e1a5e679637d48826f72a2be23a42			.dynsym	0x3a77b0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__c5b5663bc8e51fac8eb7cc2a6c1952957d7e49f1__e3f95e216b9b0443e095f98421be4f9508afbc9d			.dynsym	0x3a7890	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__803a26f98b4febfb61e3b676ead8b433cc2f21b3__3cdc54b389bc5e287aebc9dca36a2fb081fc5b39			.dynsym	0x3a7990	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__573569b4c2b1f6ab146362c4435fcfe4abea4692__9d3359159eb3fd8426ba331efd872dbe28268132			.dynsym	0x3a7ab0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__669b6d90f89f02f4f21a6830554f612197337b86__1bf20bd8ee8d1284f6f76462b563914eae6bfc68			.dynsym	0x3a7bd0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__75d5a57aa8fca0d2471ea17ca517f44cfdf0f2fc__293fe173aeaef5a23ac83062148fca98f49d7f18			.dynsym	0x3a7cc0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__fa8c10625da916d6c43ee2eea372e6d2349f2fa0__f2c185b4673374474a8deac159ef6df212b755b6			.dynsym	0x3a7cf0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__8df18e9ea6eb1ed7b1c899a0bbc578da0e2cc0ad__3d26790b83b03d9c10db0419f30f48d545478b3d			.dynsym	0x3ae270	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__a8346bf814329333010f55369a80ae610088db0e__442c1b35ff12eecc1b833843d889f8d0e24ec2a4			.dynsym	0x3ae370	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__e85ea02793eeddf2ada6e1599b1df16bb01b9094__a58831a7d5f4ea86fd5300341ffa8d1f8f5e6e43			.dynsym	0x3ae410	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JavaMainWrapper__run__5087f5482cc9a6abc971913ece43acb471d2631b__a61fe6c26e84dd4037e4629852b5488bfcc16e7e			.dynsym	0x3aeae0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__VmLocatorSymbol__vmLocatorSymbol__bec84cad1f8708102cd8814ef3e496531bf6ff5b__bbf2dbb2d6a07a8e1dae8a3072b01ad86ecc1a50			.dynsym	0x3aee40	0	FUNC	<unknown>	DEFAULT	15
JNI_CreateJavaVM			.dynsym	0x3ae270	250	FUNC	<unknown>	DEFAULT	15
JNI_GetCreatedJavaVMs			.dynsym	0x3ae370	153	FUNC	<unknown>	DEFAULT	15
JNI_GetDefaultJavaVMInitArgs			.dynsym	0x3ae410	108	FUNC	<unknown>	DEFAULT	15
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Unwind_Resume	GCC_3.0	libgcc_s.so.1	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_finalize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
__errno_location	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fpclassifyf	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fxstat64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__getdelim	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gxx_personality_v0	CXXABI_1.3	libstdc++.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__isinf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__isnanf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__libc_current_sigrtmax	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__lxstat64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__sched_cpucount	GLIBC_2.6	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_fail	GLIBC_2.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__strtok_r	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__svm_version_info			.dynsym	0x5dacbe0	8	OBJECT	<unknown>	DEFAULT	27
__svm_vm_java_version			.dynsym	0x5dad130	8	OBJECT	<unknown>	DEFAULT	27
__svm_vm_target_ccompiler			.dynsym	0x5dad1f8	8	OBJECT	<unknown>	DEFAULT	27
__svm_vm_target_libc			.dynsym	0x5dad0e0	8	OBJECT	<unknown>	DEFAULT	27
__svm_vm_target_libraries			.dynsym	0x5dac2d8	8	OBJECT	<unknown>	DEFAULT	27
__svm_vm_target_platform			.dynsym	0x5dac410	8	OBJECT	<unknown>	DEFAULT	27
__svm_vm_target_staticlibraries			.dynsym	0x5dac678	8	OBJECT	<unknown>	DEFAULT	27
__timezone	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
__xmknod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xpg_strerror_r	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xstat64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_setjmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
abort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
accept	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
bind	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
calloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ceil	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
clock_gettime	GLIBC_2.2.5	librt.so.1	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connect	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
crc32			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlclose	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlopen	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlsym	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dup2	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
execve	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
execvp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exp	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fchmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fchown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fcntl	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fdopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fflush	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgets	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgetxattr	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
flistxattr	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
floor	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
freeaddrinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fscanf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fsetxattr	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fstatvfs64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fsync	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftruncate64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gai_strerror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getaddrinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getcwd	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getgrgid_r	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getnameinfo	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpagesize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpwuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpwuid_r	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getrlimit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gettimeofday	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gmtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
graal_attach_thread			.dynsym	0x3a77b0	218	FUNC	<unknown>	DEFAULT	15
graal_create_isolate			.dynsym	0x3a7890	247	FUNC	<unknown>	DEFAULT	15
graal_detach_all_threads_and_tear_down_isolate			.dynsym	0x3a7990	285	FUNC	<unknown>	DEFAULT	15
graal_detach_thread			.dynsym	0x3a7ab0	286	FUNC	<unknown>	DEFAULT	15
graal_get_current_thread			.dynsym	0x3a7bd0	239	FUNC	<unknown>	DEFAULT	15
graal_get_isolate			.dynsym	0x3a7cc0	46	FUNC	<unknown>	DEFAULT	15
graal_tear_down_isolate			.dynsym	0x3a7cf0	283	FUNC	<unknown>	DEFAULT	15
inet_pton	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflate			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateEnd			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateInit2_			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inflateReset			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ioctl	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
isdigit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lchown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
listen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
log	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
log10	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
longjmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek64	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
main			.dynsym	0x3aeae0	329	FUNC	<unknown>	DEFAULT	15
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.14	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mprotect	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
munmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
nanosleep	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open64	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pathconf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pipe	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
poll	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
posix_spawn	GLIBC_2.15	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pow	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pread64	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
printf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_destroy	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_getguardsize	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_getstack	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_setdetachstate	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_setstacksize	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_broadcast	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_init	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_timedwait	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_wait	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_condattr_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_condattr_setclock	GLIBC_2.3.3	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_create	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_getattr_np	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_join	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_kill	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_destroy	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_lock	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_unlock	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_self	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_setname_np	GLIBC_2.12	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
putenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pwrite64	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
qsort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realpath	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvfrom	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
remove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rmdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sched_getaffinity	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sched_yield	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sem_destroy	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sem_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sem_post	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sem_wait	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
send	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendfile64	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setrlimit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
shutdown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigaction	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigaddset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigemptyset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigprocmask	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
snprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socketpair	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sqrt	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sqrtf	GLIBC_2.2.5	libm.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sscanf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
statvfs64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
stdout	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
strcasecmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strerror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strrchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtol	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtoull	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
symlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
syscall	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sysconf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
timezone	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
umask	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
uname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
utimes	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
vfork	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
vfprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
vmLocatorSymbol			.dynsym	0x3aee40	318	FUNC	<unknown>	DEFAULT	15
vsnprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitpid	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x2a8	0	SECTION	<unknown>	DEFAULT	1
	GLIBC_2.2.5	libc.so.6	.symtab	0x2c4	0	SECTION	<unknown>	DEFAULT	2
			.symtab	0x2e8	0	SECTION	<unknown>	DEFAULT	3
			.symtab	0x3588	0	SECTION	<unknown>	DEFAULT	4
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x35b0	0	SECTION	<unknown>	DEFAULT	5
	GLIBC_2.2.5	libc.so.6	.symtab	0x36a0	0	SECTION	<unknown>	DEFAULT	6
	GLIBC_2.2.5	libc.so.6	.symtab	0x4f78	0	SECTION	<unknown>	DEFAULT	7
	GLIBC_2.2.5	libc.so.6	.symtab	0x623c	0	SECTION	<unknown>	DEFAULT	8
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x6450	0	SECTION	<unknown>	DEFAULT	9
	GLIBC_2.2.5	libc.so.6	.symtab	0x65c0	0	SECTION	<unknown>	DEFAULT	10
	GLIBC_2.2.5	libc.so.6	.symtab	0x2922c8	0	SECTION	<unknown>	DEFAULT	11
	GLIBC_2.2.5	libc.so.6	.symtab	0x293468	0	SECTION	<unknown>	DEFAULT	12
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x293480	0	SECTION	<unknown>	DEFAULT	13
	GLIBC_2.6	libc.so.6	.symtab	0x294050	0	SECTION	<unknown>	DEFAULT	14
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x295000	0	SECTION	<unknown>	DEFAULT	15
	GLIBC_2.2.5	libc.so.6	.symtab	0x2761024	0	SECTION	<unknown>	DEFAULT	16
	GLIBC_2.2.5	libm.so.6	.symtab	0x2762000	0	SECTION	<unknown>	DEFAULT	17
	GLIBC_2.2.5	libc.so.6	.symtab	0x2794000	0	SECTION	<unknown>	DEFAULT	18
	GLIBC_2.2.5	libc.so.6	.symtab	0x5b88000	0	SECTION	<unknown>	DEFAULT	19
	GLIBC_2.3	libc.so.6	.symtab	0x5b8d490	0	SECTION	<unknown>	DEFAULT	20
	GLIBC_2.2.5	libc.so.6	.symtab	0x5ba8050	0	SECTION	<unknown>	DEFAULT	21
	GLIBC_2.2.5	libc.so.6	.symtab	0x5da8e68	0	SECTION	<unknown>	DEFAULT	22
	GLIBC_2.2.5	libc.so.6	.symtab	0x5da8e78	0	SECTION	<unknown>	DEFAULT	23
	GLIBC_2.2.5	libc.so.6	.symtab	0x5da8e80	0	SECTION	<unknown>	DEFAULT	24
	GLIBC_2.15	libc.so.6	.symtab	0x5daa708	0	SECTION	<unknown>	DEFAULT	25
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x5daa988	0	SECTION	<unknown>	DEFAULT	26
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x5dab000	0	SECTION	<unknown>	DEFAULT	27
	GLIBC_2.2.5	libm.so.6	.symtab	0x5dbb2e0	0	SECTION	<unknown>	DEFAULT	28
	GLIBC_2.2.5	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	29
			.symtab	0x0	0	SECTION	<unknown>	DEFAULT	30
	GLIBC_2.2.5	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	31
	GLIBC_2.12	libpthread.so.0	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	32
	GLIBC_2.3	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	33
	GLIBC_2.3.2	libpthread.so.0	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	34
	GLIBC_2.2.5	libpthread.so.0	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	35
	GLIBC_2.2.5	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	36
AWTCharAdvance			.symtab	0x26ecab0	3	FUNC	<unknown>	DEFAULT	15
AWTFontAscent			.symtab	0x26eca60	3	FUNC	<unknown>	DEFAULT	15
AWTFontDefaultChar			.symtab	0x26eca30	3	FUNC	<unknown>	DEFAULT	15
AWTFontDescent	GLIBC_2.2.5	libpthread.so.0	.symtab	0x26eca70	3	FUNC	<unknown>	DEFAULT	15
AWTFontGenerateImage			.symtab	0x26ecaa0	3	FUNC	<unknown>	DEFAULT	15
AWTFontMaxBounds			.symtab	0x26eca50	3	FUNC	<unknown>	DEFAULT	15
AWTFontMaxByte1			.symtab	0x26eca00	3	FUNC	<unknown>	DEFAULT	15
AWTFontMaxCharOrByte2			.symtab	0x26eca20	3	FUNC	<unknown>	DEFAULT	15
AWTFontMinByte1	GLIBC_2.2.5	libc.so.6	.symtab	0x26ec9f0	3	FUNC	<unknown>	DEFAULT	15
AWTFontMinCharOrByte2			.symtab	0x26eca10	3	FUNC	<unknown>	DEFAULT	15
AWTFontPerChar			.symtab	0x26eca40	3	FUNC	<unknown>	DEFAULT	15
AWTFontTextExtents16			.symtab	0x26eca80	1	FUNC	<unknown>	DEFAULT	15
AWTFreeChar	GLIBC_2.2.5	libc.so.6	.symtab	0x26eca90	1	FUNC	<unknown>	DEFAULT	15
AWTFreeFont			.symtab	0x26ec9e0	1	FUNC	<unknown>	DEFAULT	15
AWTIsHeadless			.symtab	0x273d170	215	FUNC	<unknown>	DEFAULT	15
AWTLoadFont			.symtab	0x26ec9d0	8	FUNC	<unknown>	DEFAULT	15
AWT_OnLoad			.symtab	0x273d250	370	FUNC	<unknown>	DEFAULT	15
AccelGlyphCache_RemoveAllCellInfos			.symtab	0x26ec980	53	FUNC	<unknown>	DEFAULT	15
AlphaRules			.symtab	0x5db7040	104	OBJECT	<unknown>	HIDDEN	27
Any3ByteDrawGlyphList			.symtab	0x2741f30	294	FUNC	<unknown>	HIDDEN	15
Any3ByteDrawGlyphListXor			.symtab	0x2742060	394	FUNC	<unknown>	HIDDEN	15
Any3ByteIsomorphicCopy			.symtab	0x2742210	80	FUNC	<unknown>	HIDDEN	15
Any3ByteIsomorphicScaleCopy			.symtab	0x2742260	189	FUNC	<unknown>	HIDDEN	15
Any3ByteIsomorphicXorCopy			.symtab	0x2742320	181	FUNC	<unknown>	HIDDEN	15
Any3BytePrimitives			.symtab	0x5db70c0	1064	OBJECT	<unknown>	HIDDEN	27
Any3ByteSetLine			.symtab	0x2741ad0	288	FUNC	<unknown>	HIDDEN	15
Any3ByteSetParallelogram			.symtab	0x2741750	886	FUNC	<unknown>	HIDDEN	15
Any3ByteSetParallelogramFuncs			.symtab	0x5db74f0	16	OBJECT	<unknown>	HIDDEN	27
Any3ByteSetRect			.symtab	0x2741620	109	FUNC	<unknown>	HIDDEN	15
Any3ByteSetSpans			.symtab	0x2741690	187	FUNC	<unknown>	HIDDEN	15
Any3ByteXorLine			.symtab	0x2741dd0	338	FUNC	<unknown>	HIDDEN	15
Any3ByteXorRect			.symtab	0x2741bf0	181	FUNC	<unknown>	HIDDEN	15
Any3ByteXorSpans			.symtab	0x2741cb0	287	FUNC	<unknown>	HIDDEN	15
Any4ByteDrawGlyphList			.symtab	0x2742e90	304	FUNC	<unknown>	HIDDEN	15
Any4ByteDrawGlyphListXor			.symtab	0x2742fc0	444	FUNC	<unknown>	HIDDEN	15
Any4ByteIsomorphicCopy			.symtab	0x27431a0	88	FUNC	<unknown>	HIDDEN	15
Any4ByteIsomorphicScaleCopy			.symtab	0x2743200	198	FUNC	<unknown>	HIDDEN	15
Any4BytePrimitives			.symtab	0x5db7500	1064	OBJECT	<unknown>	HIDDEN	27
Any4ByteSetLine			.symtab	0x27426f0	560	FUNC	<unknown>	HIDDEN	15
Any4ByteSetParallelogram			.symtab	0x2742530	447	FUNC	<unknown>	HIDDEN	15
Any4ByteSetParallelogramFuncs			.symtab	0x5db7930	16	OBJECT	<unknown>	HIDDEN	27
Any4ByteSetRect			.symtab	0x27423e0	123	FUNC	<unknown>	HIDDEN	15
Any4ByteSetSpans			.symtab	0x2742460	198	FUNC	<unknown>	HIDDEN	15
Any4ByteXorLine			.symtab	0x2742b40	841	FUNC	<unknown>	HIDDEN	15
Any4ByteXorRect			.symtab	0x2742920	203	FUNC	<unknown>	HIDDEN	15
Any4ByteXorSpans			.symtab	0x27429f0	328	FUNC	<unknown>	HIDDEN	15
AnyByteDrawGlyphList			.symtab	0x27439e0	271	FUNC	<unknown>	HIDDEN	15
AnyByteDrawGlyphListXor			.symtab	0x2743af0	287	FUNC	<unknown>	HIDDEN	15
AnyByteIsomorphicCopy			.symtab	0x2743c30	80	FUNC	<unknown>	HIDDEN	15
AnyByteIsomorphicScaleCopy			.symtab	0x2743c80	154	FUNC	<unknown>	HIDDEN	15
AnyByteIsomorphicXorCopy			.symtab	0x2743d20	95	FUNC	<unknown>	HIDDEN	15
AnyBytePrimitives			.symtab	0x5db7940	1064	OBJECT	<unknown>	HIDDEN	27
AnyByteSetLine			.symtab	0x27434c0	256	FUNC	<unknown>	HIDDEN	15
AnyByteSetParallelogram			.symtab	0x2743400	178	FUNC	<unknown>	HIDDEN	15
AnyByteSetParallelogramFuncs			.symtab	0x5db7d70	16	OBJECT	<unknown>	HIDDEN	27
AnyByteSetRect			.symtab	0x27432d0	120	FUNC	<unknown>	HIDDEN	15
AnyByteSetSpans			.symtab	0x2743350	170	FUNC	<unknown>	HIDDEN	15
AnyByteXorLine			.symtab	0x27438d0	272	FUNC	<unknown>	HIDDEN	15
AnyByteXorRect			.symtab	0x27435c0	335	FUNC	<unknown>	HIDDEN	15
AnyByteXorSpans			.symtab	0x2743710	433	FUNC	<unknown>	HIDDEN	15
AnyIntDrawGlyphList			.symtab	0x2744450	264	FUNC	<unknown>	HIDDEN	15
AnyIntDrawGlyphListXor			.symtab	0x2744560	288	FUNC	<unknown>	HIDDEN	15
AnyIntIsomorphicCopy			.symtab	0x27446a0	88	FUNC	<unknown>	HIDDEN	15
AnyIntIsomorphicScaleCopy			.symtab	0x2744780	161	FUNC	<unknown>	HIDDEN	15
AnyIntIsomorphicXorCopy			.symtab	0x2744700	114	FUNC	<unknown>	HIDDEN	15
AnyIntPrimitives			.symtab	0x5db7d80	1064	OBJECT	<unknown>	HIDDEN	27
AnyIntSetLine			.symtab	0x2744040	256	FUNC	<unknown>	HIDDEN	15
AnyIntSetParallelogram			.symtab	0x2743f40	243	FUNC	<unknown>	HIDDEN	15
AnyIntSetParallelogramFuncs			.symtab	0x5db81b0	16	OBJECT	<unknown>	HIDDEN	27
AnyIntSetRect			.symtab	0x2743d80	164	FUNC	<unknown>	HIDDEN	15
AnyIntSetSpans			.symtab	0x2743e30	261	FUNC	<unknown>	HIDDEN	15
AnyIntXorLine			.symtab	0x2744330	288	FUNC	<unknown>	HIDDEN	15
AnyIntXorRect			.symtab	0x2744140	196	FUNC	<unknown>	HIDDEN	15
AnyIntXorSpans			.symtab	0x2744210	287	FUNC	<unknown>	HIDDEN	15
AnyShortDrawGlyphList			.symtab	0x2745050	265	FUNC	<unknown>	HIDDEN	15
AnyShortDrawGlyphListXor			.symtab	0x2745160	289	FUNC	<unknown>	HIDDEN	15
AnyShortIsomorphicCopy			.symtab	0x27452b0	80	FUNC	<unknown>	HIDDEN	15
AnyShortIsomorphicScaleCopy			.symtab	0x2745300	155	FUNC	<unknown>	HIDDEN	15
AnyShortIsomorphicXorCopy			.symtab	0x27453a0	113	FUNC	<unknown>	HIDDEN	15
AnyShortPrimitives			.symtab	0x5db81c0	1064	OBJECT	<unknown>	HIDDEN	27
AnyShortSetLine			.symtab	0x2744bb0	256	FUNC	<unknown>	HIDDEN	15
AnyShortSetParallelogram			.symtab	0x2744a70	309	FUNC	<unknown>	HIDDEN	15
AnyShortSetParallelogramFuncs			.symtab	0x5db85f0	16	OBJECT	<unknown>	HIDDEN	27
AnyShortSetRect			.symtab	0x2744830	236	FUNC	<unknown>	HIDDEN	15
AnyShortSetSpans			.symtab	0x2744920	325	FUNC	<unknown>	HIDDEN	15
AnyShortXorLine			.symtab	0x2744f30	288	FUNC	<unknown>	HIDDEN	15
AnyShortXorRect			.symtab	0x2744cb0	268	FUNC	<unknown>	HIDDEN	15
AnyShortXorSpans			.symtab	0x2744dc0	362	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitAlphaMaskFill			.symtab	0x2747020	1278	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitDrawGlyphList			.symtab	0x2745bb0	398	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitDrawGlyphListAA			.symtab	0x2745d40	665	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitDrawGlyphListXor			.symtab	0x2745fe0	397	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitPrimitives			.symtab	0x5db8600	1400	OBJECT	<unknown>	HIDDEN	27
ByteBinary1BitSetLine			.symtab	0x2745670	424	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitSetRect			.symtab	0x2745420	245	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitSetSpans			.symtab	0x2745520	324	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitToByteBinary1BitConvert			.symtab	0x2746170	428	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitToIntArgbAlphaMaskBlit			.symtab	0x27466a0	1183	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitToIntArgbConvert			.symtab	0x2746320	284	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitXorLine			.symtab	0x2745a50	344	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitXorRect			.symtab	0x2745820	225	FUNC	<unknown>	HIDDEN	15
ByteBinary1BitXorSpans			.symtab	0x2745910	313	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitAlphaMaskFill			.symtab	0x27491c0	1294	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitDrawGlyphList			.symtab	0x2747cd0	413	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitDrawGlyphListAA			.symtab	0x2747e70	681	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitDrawGlyphListXor			.symtab	0x2748120	409	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitPrimitives			.symtab	0x5db8b80	1400	OBJECT	<unknown>	HIDDEN	27
ByteBinary2BitSetLine			.symtab	0x27477a0	416	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitSetRect			.symtab	0x2747570	236	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitSetSpans			.symtab	0x2747660	316	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitToByteBinary2BitConvert			.symtab	0x27482c0	452	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitToIntArgbAlphaMaskBlit			.symtab	0x2748820	1183	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitToIntArgbConvert			.symtab	0x2748490	283	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitXorLine			.symtab	0x2747b60	368	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitXorRect			.symtab	0x2747940	224	FUNC	<unknown>	HIDDEN	15
ByteBinary2BitXorSpans			.symtab	0x2747a20	312	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitAlphaMaskFill			.symtab	0x274b3b0	1294	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitDrawGlyphList			.symtab	0x2749ea0	421	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitDrawGlyphListAA			.symtab	0x274a050	681	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitDrawGlyphListXor			.symtab	0x274a300	417	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitPrimitives			.symtab	0x5db9100	1400	OBJECT	<unknown>	HIDDEN	27
ByteBinary4BitSetLine			.symtab	0x2749940	440	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitSetRect			.symtab	0x27496f0	241	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitSetSpans			.symtab	0x27497f0	321	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitToByteBinary4BitConvert			.symtab	0x274a4b0	452	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitToIntArgbAlphaMaskBlit			.symtab	0x274aa20	1183	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitToIntArgbConvert			.symtab	0x274a680	280	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitXorLine			.symtab	0x2749d30	368	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitXorRect			.symtab	0x2749b00	229	FUNC	<unknown>	HIDDEN	15
ByteBinary4BitXorSpans			.symtab	0x2749bf0	309	FUNC	<unknown>	HIDDEN	15
ByteGrayAlphaMaskFill			.symtab	0x274f0c0	1140	FUNC	<unknown>	HIDDEN	15
ByteGrayBicubicTransformHelper			.symtab	0x2750af0	1505	FUNC	<unknown>	HIDDEN	15
ByteGrayBilinearTransformHelper			.symtab	0x27508c0	558	FUNC	<unknown>	HIDDEN	15
ByteGrayDrawGlyphListAA			.symtab	0x2750640	417	FUNC	<unknown>	HIDDEN	15
ByteGrayNrstNbrTransformHelper			.symtab	0x27507f0	198	FUNC	<unknown>	HIDDEN	15
ByteGrayPrimitives			.symtab	0x5db9680	2128	OBJECT	<unknown>	HIDDEN	27
ByteGraySrcMaskFill			.symtab	0x274eb50	821	FUNC	<unknown>	HIDDEN	15
ByteGraySrcOverMaskFill			.symtab	0x274ee90	556	FUNC	<unknown>	HIDDEN	15
ByteGrayToByteIndexedConvert			.symtab	0x27514d0	406	FUNC	<unknown>	HIDDEN	15
ByteGrayToByteIndexedScaleConvert			.symtab	0x2751c10	463	FUNC	<unknown>	HIDDEN	15
ByteGrayToFourByteAbgrConvert			.symtab	0x27574d0	800	FUNC	<unknown>	HIDDEN	15
ByteGrayToFourByteAbgrPreConvert			.symtab	0x275bc60	800	FUNC	<unknown>	HIDDEN	15
ByteGrayToFourByteAbgrPreScaleConvert			.symtab	0x275c490	172	FUNC	<unknown>	HIDDEN	15
ByteGrayToFourByteAbgrScaleConvert			.symtab	0x2757bc0	172	FUNC	<unknown>	HIDDEN	15
ByteGrayToIndex12GrayConvert			.symtab	0x26f5de0	98	FUNC	<unknown>	HIDDEN	15
ByteGrayToIndex12GrayScaleConvert			.symtab	0x26f6510	167	FUNC	<unknown>	HIDDEN	15
ByteGrayToIndex8GrayConvert			.symtab	0x26f8c30	92	FUNC	<unknown>	HIDDEN	15
ByteGrayToIndex8GrayScaleConvert			.symtab	0x26f92e0	166	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntArgbConvert			.symtab	0x274b8e0	1022	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntArgbPreConvert			.symtab	0x27016a0	1022	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntArgbPreScaleConvert			.symtab	0x2701f90	179	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntArgbScaleConvert			.symtab	0x274ce70	179	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntRgbConvert			.symtab	0x27091f0	913	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntRgbScaleConvert			.symtab	0x2709910	174	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntRgbxConvert			.symtab	0x270c260	988	FUNC	<unknown>	HIDDEN	15
ByteGrayToIntRgbxScaleConvert			.symtab	0x270c8f0	177	FUNC	<unknown>	HIDDEN	15
ByteGrayToThreeByteBgrConvert			.symtab	0x2721470	115	FUNC	<unknown>	HIDDEN	15
ByteGrayToThreeByteBgrScaleConvert			.symtab	0x2721710	168	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshort555RgbConvert			.symtab	0x2727370	1044	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshort555RgbScaleConvert			.symtab	0x2727de0	184	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshort555RgbxConvert			.symtab	0x272c860	1092	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshort555RgbxScaleConvert			.symtab	0x272d300	186	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshort565RgbConvert			.symtab	0x272f7d0	1061	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshort565RgbScaleConvert			.symtab	0x2730250	187	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshortGrayConvert			.symtab	0x2734f70	736	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshortGrayScaleConvert			.symtab	0x27359b0	171	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshortIndexedConvert			.symtab	0x2738c20	328	FUNC	<unknown>	HIDDEN	15
ByteGrayToUshortIndexedScaleConvert			.symtab	0x2739390	395	FUNC	<unknown>	HIDDEN	15
ByteGrayTransformHelperFuncs			.symtab	0x5db9ed0	24	OBJECT	<unknown>	HIDDEN	27
ByteIndexedAlphaMaskFill			.symtab	0x2752cf0	1455	FUNC	<unknown>	HIDDEN	15
ByteIndexedBicubicTransformHelper			.symtab	0x2754e50	2267	FUNC	<unknown>	HIDDEN	15
ByteIndexedBilinearTransformHelper			.symtab	0x2754930	1303	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmBicubicTransformHelper			.symtab	0x2755a10	1257	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmBilinearTransformHelper			.symtab	0x2755800	519	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmNrstNbrTransformHelper			.symtab	0x2755730	203	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToByteGrayScaleXparOver			.symtab	0x274dd90	861	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToByteGrayXparBgCopy			.symtab	0x274e1d0	866	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToByteGrayXparOver			.symtab	0x274da70	790	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToByteIndexedScaleXparOver			.symtab	0x27521e0	562	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToByteIndexedXparBgCopy			.symtab	0x2752630	497	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToByteIndexedXparOver			.symtab	0x2751ff0	481	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToFourByteAbgrPreScaleXparOver			.symtab	0x275c790	323	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToFourByteAbgrPreXparBgCopy			.symtab	0x275c9a0	323	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToFourByteAbgrPreXparOver			.symtab	0x275c680	259	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToFourByteAbgrScaleXparOver			.symtab	0x2757de0	210	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToFourByteAbgrXparBgCopy			.symtab	0x2757f80	231	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToFourByteAbgrXparOver			.symtab	0x2757d40	154	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIndex12GrayXparBgCopy			.symtab	0x26f6770	481	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIndex12GrayXparOver			.symtab	0x26f65c0	423	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIndex8GrayXparBgCopy			.symtab	0x26f95f0	481	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIndex8GrayXparOver			.symtab	0x26f9450	415	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbBmScaleXparOver			.symtab	0x26ff6d0	560	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbBmXparBgCopy			.symtab	0x26ff900	576	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbBmXparOver			.symtab	0x26ff4d0	498	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbPreScaleXparOver			.symtab	0x2702290	303	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbPreXparBgCopy			.symtab	0x27023c0	256	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbPreXparOver			.symtab	0x27021a0	225	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbScaleXparOver			.symtab	0x26fbd30	176	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbXparBgCopy			.symtab	0x26fbea0	130	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntArgbXparOver			.symtab	0x26fbcb0	117	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntBgrScaleXparOver			.symtab	0x2705c00	736	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntBgrXparBgCopy			.symtab	0x2705ee0	717	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntBgrXparOver			.symtab	0x2705800	665	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntRgbxScaleXparOver			.symtab	0x270caf0	179	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntRgbxXparBgCopy			.symtab	0x270cc60	133	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToIntRgbxXparOver			.symtab	0x270ca70	120	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToThreeByteBgrScaleXparOver			.symtab	0x2721920	198	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToThreeByteBgrXparBgCopy			.symtab	0x2721ab0	188	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToThreeByteBgrXparOver			.symtab	0x2721890	133	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort555RgbScaleXparOver			.symtab	0x2728760	1284	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort555RgbXparBgCopy			.symtab	0x2728d40	1336	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort555RgbXparOver			.symtab	0x2728290	1221	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort555RgbxScaleXparOver			.symtab	0x272dc70	1276	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort555RgbxXparBgCopy			.symtab	0x272e240	1325	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort555RgbxXparOver			.symtab	0x272d7b0	1205	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort565RgbScaleXparOver			.symtab	0x2730bc0	1276	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort565RgbXparBgCopy			.symtab	0x2731190	1325	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshort565RgbXparOver			.symtab	0x2730700	1205	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshortGrayScaleXparOver			.symtab	0x27362f0	937	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshortGrayXparBgCopy			.symtab	0x2736780	938	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshortGrayXparOver			.symtab	0x2735f90	854	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshortIndexedScaleXparOver			.symtab	0x2739860	467	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshortIndexedXparBgCopy			.symtab	0x2739c10	429	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmToUshortIndexedXparOver			.symtab	0x27396c0	405	FUNC	<unknown>	HIDDEN	15
ByteIndexedBmTransformHelperFuncs			.symtab	0x5dba520	24	OBJECT	<unknown>	HIDDEN	27
ByteIndexedDrawGlyphListAA			.symtab	0x2754420	887	FUNC	<unknown>	HIDDEN	15
ByteIndexedNrstNbrTransformHelper			.symtab	0x27547a0	395	FUNC	<unknown>	HIDDEN	15
ByteIndexedPrimitives			.symtab	0x5db9f00	1568	OBJECT	<unknown>	HIDDEN	27
ByteIndexedToByteGrayConvert			.symtab	0x274c670	1837	FUNC	<unknown>	HIDDEN	15
ByteIndexedToByteGrayScaleConvert			.symtab	0x274d2d0	1939	FUNC	<unknown>	HIDDEN	15
ByteIndexedToByteIndexedConvert			.symtab	0x2755f90	573	FUNC	<unknown>	HIDDEN	15
ByteIndexedToByteIndexedScaleConvert			.symtab	0x27561d0	699	FUNC	<unknown>	HIDDEN	15
ByteIndexedToFourByteAbgrConvert			.symtab	0x27577f0	150	FUNC	<unknown>	HIDDEN	15
ByteIndexedToFourByteAbgrPreConvert			.symtab	0x275bf80	241	FUNC	<unknown>	HIDDEN	15
ByteIndexedToFourByteAbgrPreScaleConvert			.symtab	0x275c540	308	FUNC	<unknown>	HIDDEN	15
ByteIndexedToFourByteAbgrScaleConvert			.symtab	0x2757c70	206	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIndex12GrayConvert			.symtab	0x26f5ed0	163	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIndex12GrayScaleConvert			.symtab	0x26f62c0	579	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIndex8GrayConvert			.symtab	0x26f8d10	392	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIndex8GrayScaleConvert			.symtab	0x26f9100	471	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntArgbBmConvert			.symtab	0x26ff2d0	115	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntArgbBmScaleConvert			.symtab	0x26ff400	193	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntArgbConvert			.symtab	0x26fbb10	105	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntArgbPreConvert			.symtab	0x2701aa0	228	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntArgbPreScaleConvert			.symtab	0x2702050	328	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntArgbScaleConvert			.symtab	0x26fbc00	174	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntBgrConvert			.symtab	0x2705100	542	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntBgrScaleConvert			.symtab	0x2705590	622	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntRgbxConvert			.symtab	0x270c640	108	FUNC	<unknown>	HIDDEN	15
ByteIndexedToIntRgbxScaleConvert			.symtab	0x270c9b0	177	FUNC	<unknown>	HIDDEN	15
ByteIndexedToThreeByteBgrConvert			.symtab	0x27214f0	130	FUNC	<unknown>	HIDDEN	15
ByteIndexedToThreeByteBgrScaleConvert			.symtab	0x27217c0	195	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshort555RgbConvert			.symtab	0x2727790	921	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshort555RgbScaleConvert			.symtab	0x2727ea0	1008	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshort555RgbxConvert			.symtab	0x272ccb0	921	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshort555RgbxScaleConvert			.symtab	0x272d3c0	1008	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshort565RgbConvert			.symtab	0x272fc00	921	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshort565RgbScaleConvert			.symtab	0x2730310	1008	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshortGrayConvert			.symtab	0x2735250	1265	FUNC	<unknown>	HIDDEN	15
ByteIndexedToUshortGrayScaleConvert			.symtab	0x2735a60	1328	FUNC	<unknown>	HIDDEN	15
ByteIndexedTransformHelperFuncs			.symtab	0x5dba540	24	OBJECT	<unknown>	HIDDEN	27
CompositeTypes			.symtab	0x5db0c00	224	OBJECT	<unknown>	HIDDEN	27
DW.ref.__gxx_personality_v0			.symtab	0x5db0828	8	OBJECT	<unknown>	HIDDEN	27
Disposer_AddRecord			.symtab	0x26eefb0	137	FUNC	<unknown>	DEFAULT	15
FT_Activate_Size			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Done_Face			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Done_FreeType			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Get_Char_Index			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Init_FreeType			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Library_SetLcdFilter			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Load_Glyph			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Matrix_Multiply			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_MulFix			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_New_Memory_Face			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Open_Face			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Decompose			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Embolden			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Get_BBox			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Get_CBox			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Outline_Translate			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Render_Glyph			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Set_Char_Size			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FT_Set_Transform			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
FillPolygon			.symtab	0x27191b0	1846	FUNC	<unknown>	DEFAULT	15
FourByteAbgrAlphaMaskFill			.symtab	0x27589c0	997	FUNC	<unknown>	HIDDEN	15
FourByteAbgrBicubicTransformHelper			.symtab	0x275ae50	1801	FUNC	<unknown>	HIDDEN	15
FourByteAbgrBilinearTransformHelper			.symtab	0x275ac00	590	FUNC	<unknown>	HIDDEN	15
FourByteAbgrDrawGlyphListAA			.symtab	0x275a380	789	FUNC	<unknown>	HIDDEN	15
FourByteAbgrDrawGlyphListLCD			.symtab	0x275a6a0	1152	FUNC	<unknown>	HIDDEN	15
FourByteAbgrNrstNbrTransformHelper			.symtab	0x275ab20	215	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreAlphaMaskFill			.symtab	0x275d380	879	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreBicubicTransformHelper			.symtab	0x275f350	1073	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreBilinearTransformHelper			.symtab	0x275f1b0	401	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreDrawGlyphListAA			.symtab	0x275e970	725	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreDrawGlyphListLCD			.symtab	0x275ec50	1209	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreNrstNbrTransformHelper			.symtab	0x275f110	157	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPrePrimitives			.symtab	0x5dbac20	1680	OBJECT	<unknown>	HIDDEN	27
FourByteAbgrPreSrcMaskFill			.symtab	0x275cca0	1008	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreSrcOverMaskFill			.symtab	0x275d090	740	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreToIntArgbConvert			.symtab	0x275b590	271	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreToIntArgbScaleConvert			.symtab	0x275c080	335	FUNC	<unknown>	HIDDEN	15
FourByteAbgrPreTransformHelperFuncs			.symtab	0x5dbb2b0	24	OBJECT	<unknown>	HIDDEN	27
FourByteAbgrPrimitives			.symtab	0x5dba560	1680	OBJECT	<unknown>	HIDDEN	27
FourByteAbgrSrcMaskFill			.symtab	0x27581a0	1201	FUNC	<unknown>	HIDDEN	15
FourByteAbgrSrcOverMaskFill			.symtab	0x2758660	860	FUNC	<unknown>	HIDDEN	15
FourByteAbgrToIntArgbConvert			.symtab	0x2756490	1576	FUNC	<unknown>	HIDDEN	15
FourByteAbgrToIntArgbScaleConvert			.symtab	0x2757890	213	FUNC	<unknown>	HIDDEN	15
FourByteAbgrTransformHelperFuncs			.symtab	0x5dbabf0	24	OBJECT	<unknown>	HIDDEN	27
GetNativePrim			.symtab	0x26f5a20	77	FUNC	<unknown>	DEFAULT	15
GrPrim_CompGetAlphaInfo			.symtab	0x26f4ac0	82	FUNC	<unknown>	HIDDEN	15
GrPrim_CompGetXorInfo			.symtab	0x26f4a60	87	FUNC	<unknown>	HIDDEN	15
GrPrim_RefineBounds			.symtab	0x26f52e0	1034	FUNC	<unknown>	DEFAULT	15
GrPrim_Sg2dGetClip			.symtab	0x26f5ad0	49	FUNC	<unknown>	DEFAULT	15
GrPrim_Sg2dGetCompInfo			.symtab	0x26f5a70	82	FUNC	<unknown>	DEFAULT	15
GrPrim_Sg2dGetEaRGB			.symtab	0x26f5b30	19	FUNC	<unknown>	DEFAULT	15
GrPrim_Sg2dGetLCDTextContrast	GCC_3.0	libgcc_s.so.1	.symtab	0x26f5b50	19	FUNC	<unknown>	DEFAULT	15
GrPrim_Sg2dGetPixel			.symtab	0x26f5b10	19	FUNC	<unknown>	DEFAULT	15
ICU_to_Harfbuzz_ScriptCode			.symtab	0x5db0920	184	OBJECT	<unknown>	HIDDEN	27
IO_append_fdID			.symtab	0x5dbb910	8	OBJECT	<unknown>	HIDDEN	28
IO_fd_fdID			.symtab	0x5dbb918	8	OBJECT	<unknown>	HIDDEN	28
IPv4_supported			.symtab	0x25ed570	41	FUNC	<unknown>	DEFAULT	15
IPv6_supported	GLIBC_2.2.5	libc.so.6	.symtab	0x25ed5a0	279	FUNC	<unknown>	DEFAULT	15
Index12GrayAlphaMaskFill			.symtab	0x26f6a20	828	FUNC	<unknown>	HIDDEN	15
Index12GrayBicubicTransformHelper			.symtab	0x26f8560	636	FUNC	<unknown>	HIDDEN	15
Index12GrayBilinearTransformHelper			.symtab	0x26f8430	300	FUNC	<unknown>	HIDDEN	15
Index12GrayDrawGlyphListAA			.symtab	0x26f81e0	451	FUNC	<unknown>	HIDDEN	15
Index12GrayNrstNbrTransformHelper			.symtab	0x26f83b0	123	FUNC	<unknown>	HIDDEN	15
Index12GrayPrimitives			.symtab	0x5db12e0	1568	OBJECT	<unknown>	HIDDEN	27
Index12GraySrcOverMaskFill			.symtab	0x26f7860	611	FUNC	<unknown>	HIDDEN	15
Index12GrayToByteGrayConvert			.symtab	0x274ce00	103	FUNC	<unknown>	HIDDEN	15
Index12GrayToByteGrayScaleConvert			.symtab	0x274d220	172	FUNC	<unknown>	HIDDEN	15
Index12GrayToByteIndexedConvert			.symtab	0x2751670	433	FUNC	<unknown>	HIDDEN	15
Index12GrayToByteIndexedScaleConvert			.symtab	0x2751de0	514	FUNC	<unknown>	HIDDEN	15
Index12GrayToIndex12GrayConvert			.symtab	0x26f8960	271	FUNC	<unknown>	HIDDEN	15
Index12GrayToIndex12GrayScaleConvert			.symtab	0x26f87e0	369	FUNC	<unknown>	HIDDEN	15
Index12GrayToIndex8GrayConvert			.symtab	0x26f8c90	122	FUNC	<unknown>	HIDDEN	15
Index12GrayToIndex8GrayScaleConvert			.symtab	0x26f9390	186	FUNC	<unknown>	HIDDEN	15
Index12GrayToIntArgbConvert			.symtab	0x26fbb80	119	FUNC	<unknown>	HIDDEN	15
Index12GrayToIntArgbScaleConvert			.symtab	0x26f5f80	180	FUNC	<unknown>	HIDDEN	15
Index12GrayToUshortIndexedConvert			.symtab	0x2738d70	378	FUNC	<unknown>	HIDDEN	15
Index12GrayToUshortIndexedScaleConvert			.symtab	0x2739520	416	FUNC	<unknown>	HIDDEN	15
Index12GrayTransformHelperFuncs			.symtab	0x5db1900	24	OBJECT	<unknown>	HIDDEN	27
Index8GrayAlphaMaskFill			.symtab	0x26f98a0	805	FUNC	<unknown>	HIDDEN	15
Index8GrayBicubicTransformHelper			.symtab	0x26fb460	973	FUNC	<unknown>	HIDDEN	15
Index8GrayBilinearTransformHelper			.symtab	0x26fb2a0	446	FUNC	<unknown>	HIDDEN	15
Index8GrayDrawGlyphListAA			.symtab	0x26fb020	443	FUNC	<unknown>	HIDDEN	15
Index8GrayNrstNbrTransformHelper			.symtab	0x26fb1e0	178	FUNC	<unknown>	HIDDEN	15
Index8GrayPrimitives			.symtab	0x5db1920	1512	OBJECT	<unknown>	HIDDEN	27
Index8GraySrcOverMaskFill			.symtab	0x26fa6c0	568	FUNC	<unknown>	HIDDEN	15
Index8GrayToByteGrayConvert			.symtab	0x274cda0	92	FUNC	<unknown>	HIDDEN	15
Index8GrayToByteGrayScaleConvert			.symtab	0x274d170	166	FUNC	<unknown>	HIDDEN	15
Index8GrayToIndex12GrayConvert			.symtab	0x26f5e50	117	FUNC	<unknown>	HIDDEN	15
Index8GrayToIndex12GrayScaleConvert			.symtab	0x26f8a70	5	FUNC	<unknown>	HIDDEN	15
Index8GrayToIndex8GrayConvert			.symtab	0x26fb9b0	256	FUNC	<unknown>	HIDDEN	15
Index8GrayToIndex8GrayScaleConvert			.symtab	0x26fb830	369	FUNC	<unknown>	HIDDEN	15
Index8GrayTransformHelperFuncs			.symtab	0x5db1f10	24	OBJECT	<unknown>	HIDDEN	27
InitializeEncoding			.symtab	0x2612280	708	FUNC	<unknown>	HIDDEN	15
IntArgbAlphaMaskFill			.symtab	0x26fc690	975	FUNC	<unknown>	HIDDEN	15
IntArgbBicubicTransformHelper			.symtab	0x26fe790	2171	FUNC	<unknown>	HIDDEN	15
IntArgbBilinearTransformHelper			.symtab	0x26fe500	651	FUNC	<unknown>	HIDDEN	15
IntArgbBmAlphaMaskFill			.symtab	0x26ffbd0	991	FUNC	<unknown>	HIDDEN	15
IntArgbBmBicubicTransformHelper			.symtab	0x2701000	714	FUNC	<unknown>	HIDDEN	15
IntArgbBmBilinearTransformHelper			.symtab	0x2700ed0	300	FUNC	<unknown>	HIDDEN	15
IntArgbBmDrawGlyphListAA			.symtab	0x27007d0	672	FUNC	<unknown>	HIDDEN	15
IntArgbBmDrawGlyphListLCD			.symtab	0x2700a70	980	FUNC	<unknown>	HIDDEN	15
IntArgbBmNrstNbrTransformHelper			.symtab	0x2700e50	125	FUNC	<unknown>	HIDDEN	15
IntArgbBmPrimitives			.symtab	0x5db2400	1008	OBJECT	<unknown>	HIDDEN	27
IntArgbBmToByteGrayScaleXparOver			.symtab	0x274e0f0	210	FUNC	<unknown>	HIDDEN	15
IntArgbBmToByteGrayXparBgCopy			.symtab	0x274e5d0	1209	FUNC	<unknown>	HIDDEN	15
IntArgbBmToByteGrayXparOver			.symtab	0x274e540	142	FUNC	<unknown>	HIDDEN	15
IntArgbBmToByteIndexedScaleXparOver			.symtab	0x2752420	527	FUNC	<unknown>	HIDDEN	15
IntArgbBmToByteIndexedXparBgCopy			.symtab	0x2752a20	497	FUNC	<unknown>	HIDDEN	15
IntArgbBmToByteIndexedXparOver			.symtab	0x2752830	481	FUNC	<unknown>	HIDDEN	15
IntArgbBmToFourByteAbgrPreScaleXparOver			.symtab	0x275c8e0	184	FUNC	<unknown>	HIDDEN	15
IntArgbBmToFourByteAbgrScaleXparOver			.symtab	0x2757ec0	184	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntArgbConvert			.symtab	0x26ff030	308	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntArgbScaleXparOver			.symtab	0x26fbde0	177	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntBgrScaleXparOver			.symtab	0x2705b30	202	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntBgrXparBgCopy			.symtab	0x27061b0	572	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntBgrXparOver			.symtab	0x2705aa0	138	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntRgbXparBgCopy			.symtab	0x2709600	391	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntRgbXparOver			.symtab	0x2709590	104	FUNC	<unknown>	HIDDEN	15
IntArgbBmToIntRgbxScaleXparOver			.symtab	0x270cbb0	175	FUNC	<unknown>	HIDDEN	15
IntArgbBmToThreeByteBgrScaleXparOver			.symtab	0x27219f0	180	FUNC	<unknown>	HIDDEN	15
IntArgbBmToThreeByteBgrXparBgCopy			.symtab	0x2721c00	192	FUNC	<unknown>	HIDDEN	15
IntArgbBmToThreeByteBgrXparOver			.symtab	0x2721b70	138	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort555RgbScaleXparOver			.symtab	0x2728c70	203	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort555RgbXparBgCopy			.symtab	0x2729310	1237	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort555RgbXparOver			.symtab	0x2729280	138	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort555RgbxScaleXparOver			.symtab	0x272e170	203	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort565RgbScaleXparOver			.symtab	0x27310c0	203	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort565RgbXparBgCopy			.symtab	0x2731750	1237	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshort565RgbXparOver			.symtab	0x27316c0	138	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshortGrayScaleXparOver			.symtab	0x27366a0	214	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshortIndexedScaleXparOver			.symtab	0x2739a40	456	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshortIndexedXparBgCopy			.symtab	0x2739f40	409	FUNC	<unknown>	HIDDEN	15
IntArgbBmToUshortIndexedXparOver			.symtab	0x2739dc0	376	FUNC	<unknown>	HIDDEN	15
IntArgbBmTransformHelperFuncs			.symtab	0x5db27f0	24	OBJECT	<unknown>	HIDDEN	27
IntArgbDrawGlyphListAA			.symtab	0x26fddb0	648	FUNC	<unknown>	HIDDEN	15
IntArgbDrawGlyphListLCD			.symtab	0x26fe040	980	FUNC	<unknown>	HIDDEN	15
IntArgbNrstNbrTransformHelper			.symtab	0x26fe420	219	FUNC	<unknown>	HIDDEN	15
IntArgbPreAlphaMaskFill			.symtab	0x2702ba0	927	FUNC	<unknown>	HIDDEN	15
IntArgbPreBicubicTransformHelper			.symtab	0x2704a40	460	FUNC	<unknown>	HIDDEN	15
IntArgbPreBilinearTransformHelper			.symtab	0x2704940	244	FUNC	<unknown>	HIDDEN	15
IntArgbPreDrawGlyphListAA			.symtab	0x2704280	592	FUNC	<unknown>	HIDDEN	15
IntArgbPreDrawGlyphListLCD			.symtab	0x27044d0	1020	FUNC	<unknown>	HIDDEN	15
IntArgbPreNrstNbrTransformHelper			.symtab	0x27048d0	112	FUNC	<unknown>	HIDDEN	15
IntArgbPrePrimitives			.symtab	0x5db2820	1624	OBJECT	<unknown>	HIDDEN	27
IntArgbPreSrcMaskFill			.symtab	0x27025c0	721	FUNC	<unknown>	HIDDEN	15
IntArgbPreSrcOverMaskFill			.symtab	0x27028a0	767	FUNC	<unknown>	HIDDEN	15
IntArgbPreToByteGrayAlphaMaskBlit			.symtab	0x274ff40	929	FUNC	<unknown>	HIDDEN	15
IntArgbPreToByteGraySrcOverMaskBlit			.symtab	0x274fb90	937	FUNC	<unknown>	HIDDEN	15
IntArgbPreToByteIndexedAlphaMaskBlit			.symtab	0x2753870	1527	FUNC	<unknown>	HIDDEN	15
IntArgbPreToFourByteAbgrAlphaMaskBlit			.symtab	0x2759bb0	1041	FUNC	<unknown>	HIDDEN	15
IntArgbPreToFourByteAbgrPreAlphaMaskBlit			.symtab	0x275e210	967	FUNC	<unknown>	HIDDEN	15
IntArgbPreToFourByteAbgrPreSrcOverMaskBlit			.symtab	0x275ddd0	1077	FUNC	<unknown>	HIDDEN	15
IntArgbPreToFourByteAbgrSrcOverMaskBlit			.symtab	0x27595d0	1503	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIndex12GrayAlphaMaskBlit			.symtab	0x26f7110	953	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIndex12GraySrcOverMaskBlit			.symtab	0x26f7de0	1022	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIndex8GrayAlphaMaskBlit			.symtab	0x26f9f70	953	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIndex8GraySrcOverMaskBlit			.symtab	0x26fac20	1009	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbAlphaMaskBlit			.symtab	0x26fd5a0	1081	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbBmAlphaMaskBlit			.symtab	0x2700390	1081	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbConvert			.symtab	0x2701300	216	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbPreAlphaMaskBlit			.symtab	0x2703a90	1036	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbPreSrcOverMaskBlit			.symtab	0x2703650	1078	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbScaleConvert			.symtab	0x2701b90	300	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntArgbSrcOverMaskBlit			.symtab	0x26fd1e0	960	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntBgrAlphaMaskBlit			.symtab	0x2707920	1049	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntBgrSrcOverMaskBlit			.symtab	0x2707550	967	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntRgbAlphaMaskBlit			.symtab	0x270aea0	1033	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntRgbSrcOverMaskBlit			.symtab	0x270aab0	999	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntRgbxAlphaMaskBlit			.symtab	0x270e1d0	1049	FUNC	<unknown>	HIDDEN	15
IntArgbPreToIntRgbxSrcOverMaskBlit			.symtab	0x270dde0	1000	FUNC	<unknown>	HIDDEN	15
IntArgbPreToThreeByteBgrAlphaMaskBlit			.symtab	0x2723590	1080	FUNC	<unknown>	HIDDEN	15
IntArgbPreToThreeByteBgrSrcOverMaskBlit			.symtab	0x2723170	1056	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshort555RgbAlphaMaskBlit			.symtab	0x272b020	1129	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshort555RgbSrcOverMaskBlit			.symtab	0x272abf0	1068	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshort565RgbAlphaMaskBlit			.symtab	0x2733900	1129	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshort565RgbSrcOverMaskBlit			.symtab	0x2732c00	1060	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshortGrayAlphaMaskBlit			.symtab	0x2737fb0	987	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshortGraySrcOverMaskBlit			.symtab	0x2737bb0	1022	FUNC	<unknown>	HIDDEN	15
IntArgbPreToUshortIndexedAlphaMaskBlit			.symtab	0x273ac70	1456	FUNC	<unknown>	HIDDEN	15
IntArgbPreTransformHelperFuncs			.symtab	0x5db2e80	24	OBJECT	<unknown>	HIDDEN	27
IntArgbPrimitives			.symtab	0x5db1f40	1176	OBJECT	<unknown>	HIDDEN	27
IntArgbSrcMaskFill			.symtab	0x26fbfc0	801	FUNC	<unknown>	HIDDEN	15
IntArgbSrcOverMaskFill			.symtab	0x26fc2f0	927	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary1BitAlphaMaskBlit			.symtab	0x2746b40	1244	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary1BitConvert			.symtab	0x2746440	296	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary1BitXorBlit			.symtab	0x2746570	304	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary2BitAlphaMaskBlit			.symtab	0x2748cc0	1276	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary2BitConvert			.symtab	0x27485b0	304	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary2BitXorBlit			.symtab	0x27486e0	312	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary4BitAlphaMaskBlit			.symtab	0x274aec0	1260	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary4BitConvert			.symtab	0x274a7a0	312	FUNC	<unknown>	HIDDEN	15
IntArgbToByteBinary4BitXorBlit			.symtab	0x274a8e0	320	FUNC	<unknown>	HIDDEN	15
IntArgbToByteGrayAlphaMaskBlit			.symtab	0x274f820	873	FUNC	<unknown>	HIDDEN	15
IntArgbToByteGrayConvert			.symtab	0x274bce0	1744	FUNC	<unknown>	HIDDEN	15
IntArgbToByteGrayScaleConvert			.symtab	0x274cf30	198	FUNC	<unknown>	HIDDEN	15
IntArgbToByteGraySrcOverMaskBlit			.symtab	0x274f540	732	FUNC	<unknown>	HIDDEN	15
IntArgbToByteGrayXorBlit			.symtab	0x274ea90	182	FUNC	<unknown>	HIDDEN	15
IntArgbToByteIndexedAlphaMaskBlit			.symtab	0x27532a0	1488	FUNC	<unknown>	HIDDEN	15
IntArgbToByteIndexedConvert			.symtab	0x2751130	465	FUNC	<unknown>	HIDDEN	15
IntArgbToByteIndexedScaleConvert			.symtab	0x2751830	487	FUNC	<unknown>	HIDDEN	15
IntArgbToByteIndexedXorBlit			.symtab	0x2752c20	195	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrAlphaMaskBlit			.symtab	0x2759210	948	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrConvert			.symtab	0x2756ac0	1332	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrPreAlphaMaskBlit			.symtab	0x275da20	935	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrPreConvert			.symtab	0x275b6a0	231	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrPreScaleConvert			.symtab	0x275c1d0	292	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrPreSrcOverMaskBlit			.symtab	0x275d6f0	804	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrPreXorBlit			.symtab	0x275caf0	424	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrScaleConvert			.symtab	0x2757970	184	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrSrcOverMaskBlit			.symtab	0x2758db0	1108	FUNC	<unknown>	HIDDEN	15
IntArgbToFourByteAbgrXorBlit			.symtab	0x2758070	295	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex12GrayAlphaMaskBlit			.symtab	0x26f6d60	942	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex12GrayConvert			.symtab	0x26f5c80	156	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex12GrayScaleConvert			.symtab	0x26f6040	224	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex12GraySrcOverMaskBlit			.symtab	0x26f7ad0	779	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex12GrayXorBlit			.symtab	0x26f6960	192	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex8GrayAlphaMaskBlit			.symtab	0x26f9bd0	921	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex8GrayConvert			.symtab	0x26f8ae0	155	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex8GrayScaleConvert			.symtab	0x26f8ea0	207	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex8GraySrcOverMaskBlit			.symtab	0x26fa900	785	FUNC	<unknown>	HIDDEN	15
IntArgbToIndex8GrayXorBlit			.symtab	0x26f97e0	191	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbAlphaMaskBlit			.symtab	0x26fce00	987	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbBmAlphaMaskBlit			.symtab	0x26fffb0	987	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbBmConvert			.symtab	0x26ff170	346	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbBmScaleConvert			.symtab	0x26ff350	171	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbBmXorBlit			.symtab	0x26ffb40	139	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbPreAlphaMaskBlit			.symtab	0x2703270	986	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbPreConvert			.symtab	0x27013e0	215	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbPreScaleConvert			.symtab	0x2701cc0	310	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbPreSrcOverMaskBlit			.symtab	0x2702f40	808	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbPreXorBlit			.symtab	0x27024c0	245	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbSrcOverMaskBlit			.symtab	0x26fca60	924	FUNC	<unknown>	HIDDEN	15
IntArgbToIntArgbXorBlit			.symtab	0x26fbf30	134	FUNC	<unknown>	HIDDEN	15
IntArgbToIntBgrAlphaMaskBlit			.symtab	0x27071a0	933	FUNC	<unknown>	HIDDEN	15
IntArgbToIntBgrConvert			.symtab	0x2704eb0	440	FUNC	<unknown>	HIDDEN	15
IntArgbToIntBgrScaleConvert			.symtab	0x27053f0	204	FUNC	<unknown>	HIDDEN	15
IntArgbToIntBgrSrcOverMaskBlit			.symtab	0x2706eb0	752	FUNC	<unknown>	HIDDEN	15
IntArgbToIntBgrXorBlit			.symtab	0x27063f0	164	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbAlphaMaskBlit			.symtab	0x270a710	917	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbSrcOverMaskBlit			.symtab	0x270a410	757	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbXorBlit			.symtab	0x27099c0	134	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbxAlphaMaskBlit			.symtab	0x270da30	933	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbxConvert			.symtab	0x270c0b0	282	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbxScaleConvert			.symtab	0x270c760	164	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbxSrcOverMaskBlit			.symtab	0x270d730	766	FUNC	<unknown>	HIDDEN	15
IntArgbToIntRgbxXorBlit			.symtab	0x270ccf0	137	FUNC	<unknown>	HIDDEN	15
IntArgbToThreeByteBgrAlphaMaskBlit			.symtab	0x2722da0	975	FUNC	<unknown>	HIDDEN	15
IntArgbToThreeByteBgrConvert			.symtab	0x27213e0	132	FUNC	<unknown>	HIDDEN	15
IntArgbToThreeByteBgrScaleConvert			.symtab	0x2721660	174	FUNC	<unknown>	HIDDEN	15
IntArgbToThreeByteBgrSrcOverMaskBlit			.symtab	0x2722a80	791	FUNC	<unknown>	HIDDEN	15
IntArgbToThreeByteBgrXorBlit			.symtab	0x2721cc0	242	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort4444ArgbSrcOverMaskBlit			.symtab	0x27264d0	1234	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbAlphaMaskBlit			.symtab	0x272a7c0	1071	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbConvert			.symtab	0x2726f80	848	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbScaleConvert			.symtab	0x2727c40	193	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbSrcOverMaskBlit			.symtab	0x272a3e0	987	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbXorBlit			.symtab	0x27297f0	175	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbxConvert			.symtab	0x272c470	848	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbxScaleConvert			.symtab	0x272d160	193	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort555RgbxXorBlit			.symtab	0x272e770	175	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort565RgbAlphaMaskBlit			.symtab	0x27334d0	1071	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort565RgbConvert			.symtab	0x272f3e0	848	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort565RgbScaleConvert			.symtab	0x27300b0	193	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort565RgbSrcOverMaskBlit			.symtab	0x2732820	987	FUNC	<unknown>	HIDDEN	15
IntArgbToUshort565RgbXorBlit			.symtab	0x2731c30	175	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortGrayAlphaMaskBlit			.symtab	0x2737810	925	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortGrayConvert			.symtab	0x2734a20	1195	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortGrayScaleConvert			.symtab	0x2735810	203	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortGraySrcOverMaskBlit			.symtab	0x27374e0	801	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortGrayXorBlit			.symtab	0x2736b30	188	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortIndexedAlphaMaskBlit			.symtab	0x273a700	1380	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortIndexedConvert			.symtab	0x2738930	352	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortIndexedScaleConvert			.symtab	0x2739030	426	FUNC	<unknown>	HIDDEN	15
IntArgbToUshortIndexedXorBlit			.symtab	0x273a0e0	193	FUNC	<unknown>	HIDDEN	15
IntArgbTransformHelperFuncs			.symtab	0x5db23e0	24	OBJECT	<unknown>	HIDDEN	27
IntBgrAlphaMaskFill			.symtab	0x2706ab0	1023	FUNC	<unknown>	HIDDEN	15
IntBgrBicubicTransformHelper			.symtab	0x2708bd0	1038	FUNC	<unknown>	HIDDEN	15
IntBgrBilinearTransformHelper			.symtab	0x2708a50	384	FUNC	<unknown>	HIDDEN	15
IntBgrDrawGlyphListAA			.symtab	0x2708480	499	FUNC	<unknown>	HIDDEN	15
IntBgrDrawGlyphListLCD			.symtab	0x2708680	829	FUNC	<unknown>	HIDDEN	15
IntBgrNrstNbrTransformHelper			.symtab	0x27089c0	143	FUNC	<unknown>	HIDDEN	15
IntBgrPrimitives			.symtab	0x5db2ea0	2352	OBJECT	<unknown>	HIDDEN	27
IntBgrSrcMaskFill			.symtab	0x27064a0	801	FUNC	<unknown>	HIDDEN	15
IntBgrSrcOverMaskFill			.symtab	0x27067d0	729	FUNC	<unknown>	HIDDEN	15
IntBgrToIntArgbConvert			.symtab	0x2704ca0	522	FUNC	<unknown>	HIDDEN	15
IntBgrToIntArgbScaleConvert			.symtab	0x2705320	208	FUNC	<unknown>	HIDDEN	15
IntBgrToIntBgrAlphaMaskBlit			.symtab	0x27080e0	917	FUNC	<unknown>	HIDDEN	15
IntBgrTransformHelperFuncs			.symtab	0x5db37d0	24	OBJECT	<unknown>	HIDDEN	27
IntRgbAlphaMaskFill			.symtab	0x270a060	943	FUNC	<unknown>	HIDDEN	15
IntRgbBicubicTransformHelper			.symtab	0x270bd10	549	FUNC	<unknown>	HIDDEN	15
IntRgbBilinearTransformHelper			.symtab	0x270bc00	271	FUNC	<unknown>	HIDDEN	15
IntRgbDrawGlyphListAA			.symtab	0x270b640	499	FUNC	<unknown>	HIDDEN	15
IntRgbDrawGlyphListLCD			.symtab	0x270b840	829	FUNC	<unknown>	HIDDEN	15
IntRgbNrstNbrTransformHelper			.symtab	0x270bb80	118	FUNC	<unknown>	HIDDEN	15
IntRgbPrimitives			.symtab	0x5db3800	1960	OBJECT	<unknown>	HIDDEN	27
IntRgbSrcMaskFill			.symtab	0x2709a50	801	FUNC	<unknown>	HIDDEN	15
IntRgbSrcOverMaskFill			.symtab	0x2709d80	734	FUNC	<unknown>	HIDDEN	15
IntRgbToByteGrayAlphaMaskBlit			.symtab	0x27502f0	841	FUNC	<unknown>	HIDDEN	15
IntRgbToByteIndexedAlphaMaskBlit			.symtab	0x2753e70	1456	FUNC	<unknown>	HIDDEN	15
IntRgbToFourByteAbgrAlphaMaskBlit			.symtab	0x2759fd0	940	FUNC	<unknown>	HIDDEN	15
IntRgbToFourByteAbgrConvert			.symtab	0x2757000	1061	FUNC	<unknown>	HIDDEN	15
IntRgbToFourByteAbgrPreAlphaMaskBlit			.symtab	0x275e5e0	900	FUNC	<unknown>	HIDDEN	15
IntRgbToFourByteAbgrPreConvert			.symtab	0x275b790	1061	FUNC	<unknown>	HIDDEN	15
IntRgbToFourByteAbgrPreScaleConvert			.symtab	0x275c300	178	FUNC	<unknown>	HIDDEN	15
IntRgbToFourByteAbgrScaleConvert			.symtab	0x2757a30	178	FUNC	<unknown>	HIDDEN	15
IntRgbToIndex12GrayAlphaMaskBlit			.symtab	0x26f74d0	904	FUNC	<unknown>	HIDDEN	15
IntRgbToIndex8GrayAlphaMaskBlit			.symtab	0x26fa330	905	FUNC	<unknown>	HIDDEN	15
IntRgbToIntArgbAlphaMaskBlit			.symtab	0x26fd9e0	971	FUNC	<unknown>	HIDDEN	15
IntRgbToIntArgbConvert			.symtab	0x2709020	317	FUNC	<unknown>	HIDDEN	15
IntRgbToIntArgbPreAlphaMaskBlit			.symtab	0x2703ea0	989	FUNC	<unknown>	HIDDEN	15
IntRgbToIntArgbPreConvert			.symtab	0x27014c0	317	FUNC	<unknown>	HIDDEN	15
IntRgbToIntArgbPreScaleConvert			.symtab	0x2701e00	167	FUNC	<unknown>	HIDDEN	15
IntRgbToIntArgbScaleConvert			.symtab	0x2709790	167	FUNC	<unknown>	HIDDEN	15
IntRgbToIntBgrAlphaMaskBlit			.symtab	0x2707d40	917	FUNC	<unknown>	HIDDEN	15
IntRgbToIntRgbAlphaMaskBlit			.symtab	0x270b2b0	901	FUNC	<unknown>	HIDDEN	15
IntRgbToIntRgbxAlphaMaskBlit			.symtab	0x270e5f0	914	FUNC	<unknown>	HIDDEN	15
IntRgbToThreeByteBgrAlphaMaskBlit			.symtab	0x27239d0	940	FUNC	<unknown>	HIDDEN	15
IntRgbToUshort555RgbAlphaMaskBlit			.symtab	0x272b490	1055	FUNC	<unknown>	HIDDEN	15
IntRgbToUshort565RgbAlphaMaskBlit			.symtab	0x2733d70	1055	FUNC	<unknown>	HIDDEN	15
IntRgbToUshortGrayAlphaMaskBlit			.symtab	0x2738390	941	FUNC	<unknown>	HIDDEN	15
IntRgbToUshortIndexedAlphaMaskBlit			.symtab	0x273b220	1351	FUNC	<unknown>	HIDDEN	15
IntRgbTransformHelperFuncs			.symtab	0x5db3fb0	24	OBJECT	<unknown>	HIDDEN	27
IntRgbxAlphaMaskFill			.symtab	0x270d390	927	FUNC	<unknown>	HIDDEN	15
IntRgbxBicubicTransformHelper			.symtab	0x270f060	596	FUNC	<unknown>	HIDDEN	15
IntRgbxBilinearTransformHelper			.symtab	0x270ef40	284	FUNC	<unknown>	HIDDEN	15
IntRgbxDrawGlyphListAA			.symtab	0x270e990	471	FUNC	<unknown>	HIDDEN	15
IntRgbxDrawGlyphListLCD			.symtab	0x270eb70	837	FUNC	<unknown>	HIDDEN	15
IntRgbxNrstNbrTransformHelper			.symtab	0x270eec0	121	FUNC	<unknown>	HIDDEN	15
IntRgbxPrimitives			.symtab	0x5db3fe0	1736	OBJECT	<unknown>	HIDDEN	27
IntRgbxSrcMaskFill			.symtab	0x270cd80	801	FUNC	<unknown>	HIDDEN	15
IntRgbxSrcOverMaskFill			.symtab	0x270d0b0	726	FUNC	<unknown>	HIDDEN	15
IntRgbxToIntArgbConvert			.symtab	0x270bf60	327	FUNC	<unknown>	HIDDEN	15
IntRgbxToIntArgbScaleConvert			.symtab	0x270c6b0	168	FUNC	<unknown>	HIDDEN	15
IntRgbxTransformHelperFuncs			.symtab	0x5db46b0	24	OBJECT	<unknown>	HIDDEN	27
IsolateEnterStub__CEntryPointNativeFunctions__attachThread__fe8e89788bae97cf98065b8b062da14102a906b7__2b64db5eac3e1a5e679637d48826f72a2be23a42			.symtab	0x3a77b0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__c5b5663bc8e51fac8eb7cc2a6c1952957d7e49f1__e3f95e216b9b0443e095f98421be4f9508afbc9d			.symtab	0x3a7890	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__803a26f98b4febfb61e3b676ead8b433cc2f21b3__3cdc54b389bc5e287aebc9dca36a2fb081fc5b39			.symtab	0x3a7990	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__573569b4c2b1f6ab146362c4435fcfe4abea4692__9d3359159eb3fd8426ba331efd872dbe28268132			.symtab	0x3a7ab0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__669b6d90f89f02f4f21a6830554f612197337b86__1bf20bd8ee8d1284f6f76462b563914eae6bfc68			.symtab	0x3a7bd0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__75d5a57aa8fca0d2471ea17ca517f44cfdf0f2fc__293fe173aeaef5a23ac83062148fca98f49d7f18			.symtab	0x3a7cc0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__fa8c10625da916d6c43ee2eea372e6d2349f2fa0__f2c185b4673374474a8deac159ef6df212b755b6			.symtab	0x3a7cf0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__8df18e9ea6eb1ed7b1c899a0bbc578da0e2cc0ad__3d26790b83b03d9c10db0419f30f48d545478b3d			.symtab	0x3ae270	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__a8346bf814329333010f55369a80ae610088db0e__442c1b35ff12eecc1b833843d889f8d0e24ec2a4			.symtab	0x3ae370	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__e85ea02793eeddf2ada6e1599b1df16bb01b9094__a58831a7d5f4ea86fd5300341ffa8d1f8f5e6e43			.symtab	0x3ae410	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__JavaMainWrapper__run__5087f5482cc9a6abc971913ece43acb471d2631b__a61fe6c26e84dd4037e4629852b5488bfcc16e7e			.symtab	0x3aeae0	0	FUNC	<unknown>	DEFAULT	15
IsolateEnterStub__VmLocatorSymbol__vmLocatorSymbol__bec84cad1f8708102cd8814ef3e496531bf6ff5b__bbf2dbb2d6a07a8e1dae8a3072b01ad86ecc1a50			.symtab	0x3aee40	0	FUNC	<unknown>	DEFAULT	15
J2dTraceImpl			.symtab	0x2724a30	574	FUNC	<unknown>	DEFAULT	15
J2dTraceInit			.symtab	0x2724950	211	FUNC	<unknown>	DEFAULT	15
JDK_Canonicalize			.symtab	0x260f8c0	493	FUNC	<unknown>	DEFAULT	15
JDK_execvpe			.symtab	0x2610060	322	FUNC	<unknown>	DEFAULT	15
JNI_CreateJavaVM			.symtab	0x3ae270	250	FUNC	<unknown>	DEFAULT	15
JNI_GetCreatedJavaVMs			.symtab	0x3ae370	153	FUNC	<unknown>	DEFAULT	15
JNI_GetDefaultJavaVMInitArgs			.symtab	0x3ae410	108	FUNC	<unknown>	DEFAULT	15
JNI_OnLoad_awt			.symtab	0x273d3e0	16	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_awt_headless			.symtab	0x26ec9c0	16	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_dynamic_awt			.symtab	0x273d3d0	5	FUNC	<unknown>	DEFAULT	15
JNI_OnLoad_dynamic_net			.symtab	0x25ecb70	247	FUNC	<unknown>	DEFAULT	15
JNI_OnLoad_extnet			.symtab	0x2607630	6	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_fontmanager			.symtab	0x2683d40	6	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_java			.symtab	0x260fab0	6	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_javajpeg			.symtab	0x25fb7a0	13	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_lcms			.symtab	0x2613ff0	30	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_net			.symtab	0x25ecc70	16	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_nio			.symtab	0x260bad0	30	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_prefs			.symtab	0x2655ae0	6	FUNC	<unknown>	HIDDEN	15
JNI_OnLoad_zip			.symtab	0x2760c70	6	FUNC	<unknown>	HIDDEN	15
JNU_CallMethodByName			.symtab	0x2612020	113	FUNC	<unknown>	DEFAULT	15
JNU_CallMethodByNameV			.symtab	0x2611e10	516	FUNC	<unknown>	DEFAULT	15
JNU_CallStaticMethodByName			.symtab	0x2611aa0	869	FUNC	<unknown>	DEFAULT	15
JNU_ClassString	GLIBC_2.2.5	libpthread.so.0	.symtab	0x26121e0	155	FUNC	<unknown>	DEFAULT	15
JNU_CopyObjectArray			.symtab	0x2613b30	155	FUNC	<unknown>	DEFAULT	15
JNU_GetEnv			.symtab	0x2613bd0	26	FUNC	<unknown>	DEFAULT	15
JNU_GetStringPlatformChars			.symtab	0x2612df0	3380	FUNC	<unknown>	DEFAULT	15
JNU_NewObjectByName			.symtab	0x26120a0	296	FUNC	<unknown>	DEFAULT	15
JNU_NewStringPlatform			.symtab	0x26126a0	261	FUNC	<unknown>	DEFAULT	15
JNU_ReleaseStringPlatformChars			.symtab	0x26121d0	8	FUNC	<unknown>	DEFAULT	15
JNU_ThrowArrayIndexOutOfBoundsException			.symtab	0x2611910	70	FUNC	<unknown>	DEFAULT	15
JNU_ThrowByName			.symtab	0x2611880	62	FUNC	<unknown>	DEFAULT	15
JNU_ThrowByNameWithLastError			.symtab	0x26127b0	256	FUNC	<unknown>	DEFAULT	15
JNU_ThrowByNameWithMessageAndLastError			.symtab	0x26128b0	655	FUNC	<unknown>	DEFAULT	15
JNU_ThrowIOException			.symtab	0x2611a50	70	FUNC	<unknown>	DEFAULT	15
JNU_ThrowIOExceptionWithLastError			.symtab	0x2612b40	244	FUNC	<unknown>	DEFAULT	15
JNU_ThrowIllegalArgumentException			.symtab	0x26119b0	70	FUNC	<unknown>	DEFAULT	15
JNU_ThrowInternalError	GLIBC_2.2.5	libpthread.so.0	.symtab	0x2611a00	70	FUNC	<unknown>	DEFAULT	15
JNU_ThrowNullPointerException			.symtab	0x26118c0	70	FUNC	<unknown>	DEFAULT	15
JNU_ThrowOutOfMemoryError			.symtab	0x2611960	70	FUNC	<unknown>	DEFAULT	15
JVM_ActiveProcessorCount			.symtab	0x2760c90	75	FUNC	<unknown>	HIDDEN	15
JVM_FillInStackTrace			.symtab	0x2760ed0	27	FUNC	<unknown>	DEFAULT	15
JVM_FindLibraryEntry			.symtab	0x2760ce0	99	FUNC	<unknown>	DEFAULT	15
JVM_GetInheritedAccessControlContext			.symtab	0x2760ef0	27	FUNC	<unknown>	DEFAULT	15
JVM_Halt			.symtab	0x2760d50	9	FUNC	<unknown>	DEFAULT	15
JVM_InitStackTraceElement			.symtab	0x2760f10	27	FUNC	<unknown>	DEFAULT	15
JVM_InitStackTraceElementArray			.symtab	0x2760f30	27	FUNC	<unknown>	DEFAULT	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_clearNativeReadAbortFlag			.symtab	0x25f1820	35	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_disposeReader			.symtab	0x25f1920	324	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_initJPEGImageReader			.symtab	0x25f0260	674	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_initReaderIDs			.symtab	0x25f0000	604	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_readImage			.symtab	0x25f0b80	3219	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_readImageHeader			.symtab	0x25f0560	1516	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_resetLibraryState			.symtab	0x25f1850	35	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_resetReader			.symtab	0x25f1880	158	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_setOutColorSpace			.symtab	0x25f0b50	35	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_setSource			.symtab	0x25f0510	75	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageWriter_disposeWriter			.symtab	0x25f1e70	324	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageWriter_initJPEGImageWriter			.symtab	0x25f1be0	642	FUNC	<unknown>	HIDDEN	15
Java_com_sun_imageio_plugins_jpeg_JPEGImageWriter_initWriterIDs			.symtab	0x25f1a70	367	FUNC	<unknown>	HIDDEN	15
Java_java_awt_Font_initIDs			.symtab	0x26ecc30	1	FUNC	<unknown>	HIDDEN	15
Java_java_awt_Toolkit_initIDs			.symtab	0x2740180	1	FUNC	<unknown>	HIDDEN	15
Java_java_awt_image_BufferedImage_initIDs			.symtab	0x273ed90	241	FUNC	<unknown>	HIDDEN	15
Java_java_awt_image_ColorModel_initIDs			.symtab	0x273f570	483	FUNC	<unknown>	HIDDEN	15
Java_java_awt_image_IndexColorModel_initIDs			.symtab	0x273f760	143	FUNC	<unknown>	HIDDEN	15
Java_java_awt_image_Raster_initIDs			.symtab	0x273ee90	534	FUNC	<unknown>	HIDDEN	15
Java_java_awt_image_SampleModel_initIDs			.symtab	0x273f7f0	192	FUNC	<unknown>	HIDDEN	15
Java_java_awt_image_SinglePixelPackedSampleModel_initIDs			.symtab	0x273f4b0	192	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileCleanable_cleanupClose0			.symtab	0x260c550	68	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileDescriptor_close0			.symtab	0x260c540	5	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileDescriptor_initIDs			.symtab	0x260c4e0	92	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_available0			.symtab	0x260c7c0	159	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_initIDs			.symtab	0x260c5a0	36	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_length0			.symtab	0x260c600	109	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_open0			.symtab	0x260c5d0	15	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_position0			.symtab	0x260c670	117	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_read0			.symtab	0x260c5e0	12	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_readBytes			.symtab	0x260c5f0	12	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileInputStream_skip0			.symtab	0x260c6f0	201	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileOutputStream_initIDs			.symtab	0x260c860	36	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileOutputStream_open0			.symtab	0x260c890	29	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileOutputStream_write			.symtab	0x260c8b0	15	FUNC	<unknown>	HIDDEN	15
Java_java_io_FileOutputStream_writeBytes			.symtab	0x260c8c0	27	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_getFilePointer			.symtab	0x260dfc0	117	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_initIDs			.symtab	0x260def0	36	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_length			.symtab	0x260e040	109	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_open0			.symtab	0x260df20	83	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_read0			.symtab	0x260df80	12	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_readBytes			.symtab	0x260df90	12	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_seek0			.symtab	0x260e0b0	116	FUNC	<unknown>	HIDDEN	15
Java_java_io_RandomAccessFile_writeBytes			.symtab	0x260dfa0	26	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_canonicalize0			.symtab	0x260ea20	209	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_checkAccess			.symtab	0x260ebd0	205	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_createDirectory			.symtab	0x260f1d0	146	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_createFileExclusively			.symtab	0x260ee10	240	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_delete0			.symtab	0x260ef00	138	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_getBooleanAttributes0			.symtab	0x260eb00	206	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_getLastModifiedTime			.symtab	0x260eca0	207	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_getLength			.symtab	0x260ed70	159	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_getNameMax0			.symtab	0x260f5d0	146	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_getSpace			.symtab	0x260f4a0	289	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_initIDs			.symtab	0x260e9d0	74	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_list			.symtab	0x260ef90	569	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_rename0			.symtab	0x260f270	260	FUNC	<unknown>	HIDDEN	15
Java_java_io_UnixFileSystem_setLastModifiedTime			.symtab	0x260f380	286	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessEnvironment_environ			.symtab	0x260c8e0	503	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessHandleImpl_getCurrentPid0			.symtab	0x260cc10	13	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessHandleImpl_initNative			.symtab	0x260cae0	60	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessHandleImpl_isAlive0			.symtab	0x260cc20	65	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessHandleImpl_waitForProcessExit0			.symtab	0x260cb20	240	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessImpl_forkAndExec			.symtab	0x260cfc0	3876	FUNC	<unknown>	HIDDEN	15
Java_java_lang_ProcessImpl_init			.symtab	0x260cdd0	483	FUNC	<unknown>	HIDDEN	15

Network Behavior

⊘No network behavior found

System Behavior

Analysis Process: TeamServerImage PID: 5415, Parent PID: 5342

General

Start time (UTC):	10:07:54
Start date (UTC):	21/09/2023
Path:	/tmp/TeamServerImage
Arguments:	/tmp/TeamServerImage
File size:	96448168 bytes
MD5 hash:	00000000000000000000000000000000

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report TeamServerImage

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Malware Analysis System Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

System Behavior

Analysis Process: TeamServerImage PID: 5415, Parent PID: 5342

General

File Activities

File Read

Linux Analysis Report
TeamServerImage