Edit tour

Linux Analysis Report
.report_system.elf

Overview

General Information

Sample name:	.report_system.elf
Analysis ID:	1545291
MD5:	1271e6e82b344df1c7960230ec449af7
SHA1:	7fe3253d34cae21facc8c445c3620b9e8566988b
SHA256:	fff96ad553f916da4eb0d55b1075b9b4aea7b93249663aefbc0310e53c7498ba
Tags:	elfuser-abuse_ch
Infos:

Detection

Xmrig

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Contains symbols with names commonly found in malware

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Machine Learning detection for sample

Sample reads /proc/mounts (often used for finding a writable filesystem)

Stdout / stderr contain strings indicative of a mining client

Tries to load the MSR kernel module used for reading/writing to CPUs model specific register

Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher)

Creates hidden files and/or directories

Executes commands using a shell command-line interpreter

Executes the "modprobe" command used for loading kernel modules

Reads CPU information from /proc indicative of miner or evasive malware

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Suricata IDS alerts with low severity for network traffic

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545291
Start date and time:	2024-10-30 11:32:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	.report_system.elf
Detection:	MAL
Classification:	mal96.troj.mine.linELF@0/1@4/0
Cookbook Comments:	Analysis time extended to 480s due to sleep detection in submitted sample

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: .report_system.elf

Runtime Messages

Command:	/tmp/.report_system.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	[2024-10-30 05:32:55.479] unable to open "/tmp/config.json". [2024-10-30 05:32:55.486] unable to open "/root/.xmrig.json". [2024-10-30 05:32:55.489] unable to open "/root/.config/xmrig.json".
Standard Error:

Process Tree

system is lnxubuntu20

.report_system.elf (PID: 5435, Parent: 5358, MD5: 1271e6e82b344df1c7960230ec449af7) Arguments: /tmp/.report_system.elf

.report_system.elf New Fork (PID: 5436, Parent: 5435)

.report_system.elf New Fork (PID: 5442, Parent: 5436)

sh (PID: 5442, Parent: 5436, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"

sh New Fork (PID: 5443, Parent: 5442)

modprobe (PID: 5443, Parent: 5442, MD5: 0b44462b1a40df8039d6d61cfff7ea84) Arguments: /sbin/modprobe msr allow_writes=on

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XMRIG		No Attribution	https://www.aquasec.com/blog/container-security-tnt-container-attack/ https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.xmrig

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
.report_system.elf	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
.report_system.elf	Linux_Cryptominer_Camelot_cdd631c1	unknown	unknown	0x7c149:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x8a47a:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x95308:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xa1571:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xa8743:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xadf16:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xc709c:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xe0981:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xe2fe1:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x104271:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x10aea8:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x10cfb2:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73
.report_system.elf	Linux_Cryptominer_Malxmr_979160f6	unknown	unknown	0x274c07:$a: E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1 0x2759a3:$a: E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1
.report_system.elf	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x377b98:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
.report_system.elf	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x65972a:$a1: mining.set_target 0x64a095:$a2: XMRIG_HOSTNAME 0x64dd80:$a3: Usage: xmrig [OPTIONS] 0x64a076:$a4: XMRIG_VERSION

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.0000000000400000.0000000000c29000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5435.1.0000000000400000.0000000000c29000.r-x.sdmp	Linux_Cryptominer_Camelot_cdd631c1	unknown	unknown	0x7c149:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x8a47a:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x95308:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xa1571:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xa8743:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xadf16:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xc709c:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xe0981:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xe2fe1:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x104271:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x10aea8:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x10cfb2:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73
5435.1.0000000000400000.0000000000c29000.r-x.sdmp	Linux_Cryptominer_Malxmr_979160f6	unknown	unknown	0x274c07:$a: E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1 0x2759a3:$a: E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1
5435.1.0000000000400000.0000000000c29000.r-x.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x377b98:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
5435.1.0000000000400000.0000000000c29000.r-x.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x65972a:$a1: mining.set_target 0x64a095:$a2: XMRIG_HOSTNAME 0x64dd80:$a3: Usage: xmrig [OPTIONS] 0x64a076:$a4: XMRIG_VERSION
5436.1.0000000000400000.0000000000c29000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5436.1.0000000000400000.0000000000c29000.r-x.sdmp	Linux_Cryptominer_Camelot_cdd631c1	unknown	unknown	0x7c149:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x8a47a:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x95308:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xa1571:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xa8743:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xadf16:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xc709c:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xe0981:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0xe2fe1:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x104271:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x10aea8:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 0x10cfb2:$a: 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73
5436.1.0000000000400000.0000000000c29000.r-x.sdmp	Linux_Cryptominer_Malxmr_979160f6	unknown	unknown	0x274c07:$a: E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1 0x2759a3:$a: E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1
5436.1.0000000000400000.0000000000c29000.r-x.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x377b98:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
5436.1.0000000000400000.0000000000c29000.r-x.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x65972a:$a1: mining.set_target 0x64a095:$a2: XMRIG_HOSTNAME 0x64dd80:$a3: Usage: xmrig [OPTIONS] 0x64a076:$a4: XMRIG_VERSION
Process Memory Space: .report_system.elf PID: 5435	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: .report_system.elf PID: 5435	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x148ca6:$a1: mining.set_target 0x143445:$a2: XMRIG_HOSTNAME 0x145ff1:$a3: Usage: xmrig [OPTIONS] 0x143426:$a4: XMRIG_VERSION
Process Memory Space: .report_system.elf PID: 5436	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: .report_system.elf PID: 5436	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x147173:$a1: mining.set_target 0x141912:$a2: XMRIG_HOSTNAME 0x1444be:$a3: Usage: xmrig [OPTIONS] 0x1418f3:$a4: XMRIG_VERSION
Click to see the 9 entries

Suricata Signatures

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:41:28.949957+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.13	45378	91.184.240.129	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: .report_system.elf

ReversingLabs: Detection: 50%

Machine Learning detection for sample

Source: .report_system.elf

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: .report_system.elf, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: .report_system.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: .report_system.elf PID: 5436, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.13:45378 -> 91.184.240.129:80 payload: data raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 62 75 6e 72 61 75 22 2c 22 70 61 73 73 22 3a 22 62 75 6e 72 61 75 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 32 31 2e 30 20 28 4c 69 6e 75 78 20 78 38 36 5f 36 34 29 20 6c 69 62 75 76 2f 31 2e 34 34 2e 32 20 67 63 63 2f 37 2e 33 2e 31 22 2c 22 61 6c 67 6f 22 3a 5b 22 72 78 2f 30 22 2c 22 63 6e 2f 32 22 2c 22 63 6e 2f 72 22 2c 22 63 6e 2f 66 61 73 74 22 2c 22 63 6e 2f 68 61 6c 66 22 2c 22 63 6e 2f 78 61 6f 22 2c 22 63 6e 2f 72 74 6f 22 2c 22 63 6e 2f 72 77 7a 22 2c 22 63 6e 2f 7a 6c 73 22 2c 22 63 6e 2f 64 6f 75 62 6c 65 22 2c 22 63 6e 2f 63 63 78 22 2c 22 63 6e 2d 6c 69 74 65 2f 31 22 2c 22 63 6e 2d 68 65 61 76 79 2f 30 22 2c 22 63 6e 2d 68 65 61 76 79 2f 74 75 62 65 22 2c 22 63 6e 2d 68 65 61 76 79 2f 78 68 76 22 2c 22 63 6e 2d 70 69 63 6f 22 2c 22 63 6e 2d 70 69 63 6f 2f 74 6c 6f 22 2c 22 63 6e 2f 75 70 78 32 22 2c 22 63 6e 2f 31 22 2c 22 72 78 2f 77 6f 77 22 2c 22 72 78 2f 61 72 71 22 2c 22 72 78 2f 67 72 61 66 74 22 2c 22 72 78 2f 73 66 78 22 2c 22 72 78 2f 6b 65 76 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 76 32 22 2c 22 61 72 67 6f 6e 32 2f 6e 69 6e 6a 61 22 2c 22 67 68 6f 73 74 72 69 64 65 72 22 5d 7d 7d 0a data ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"bunrau","pass":"bunrau","agent":"xmrig/6.21.0 (linux x86_64) libuv/1.44.2 gcc/7.3.1","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}

Found strings related to Crypto-Mining

Source: .report_system.elf, 5435.1.0000000000400000.0000000000c29000.r-x.sdmp	String found in binary or memory: stratum+ssl://randomx.xmrig.com:443
Source: .report_system.elf, 5435.1.0000000000400000.0000000000c29000.r-x.sdmp	String found in binary or memory: CryptonightR_instruction_mov105
Source: .report_system.elf, 5435.1.0000000000400000.0000000000c29000.r-x.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: .report_system.elf, 5435.1.0000000000400000.0000000000c29000.r-x.sdmp	String found in binary or memory: stratum+tcp://
Source: .report_system.elf, 5435.1.0000000000400000.0000000000c29000.r-x.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: .report_system.elf, 5435.1.0000000000400000.0000000000c29000.r-x.sdmp	String found in binary or memory: XMRig 6.21.0

Stdout / stderr contain strings indicative of a mining client

Source: /tmp/.report_system.elf

Stdout: xmrig

Tries to load the MSR kernel module used for reading/writing to CPUs model specific register

Source: /bin/sh (PID: 5443)

Modprobe: /sbin/modprobe -> /sbin/modprobe msr allow_writes=on

Jump to behavior

Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher)

Source: /tmp/.report_system.elf (PID: 5436)	MSR open for writing: /dev/cpu/0/msr			Jump to behavior
Source: /tmp/.report_system.elf (PID: 5436)	MSR open for writing: /dev/cpu/1/msr			Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/possible	Jump to behavior

Source: /tmp/.report_system.elf (PID: 5436)

Reads hosts file: /etc/hosts

Jump to behavior

Source: Network traffic

Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.13:45378 -> 91.184.240.129:80

Source: global traffic	DNS traffic detected: DNS query: xkobeproxy.xkobeimparatu.net
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: .report_system.elf	String found in binary or memory: https://gcc.gnu.org/bugsterminate
Source: .report_system.elf	String found in binary or memory: https://xmrig.com/benchmark/%s
Source: .report_system.elf	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: .report_system.elf	String found in binary or memory: https://xmrig.com/wizard
Source: .report_system.elf	String found in binary or memory: https://xmrig.com/wizard%s

System Summary

Malicious sample detected (through community Yara rule)

Source: .report_system.elf, type: SAMPLE	Matched rule: Linux_Cryptominer_Camelot_cdd631c1 Author: unknown
Source: .report_system.elf, type: SAMPLE	Matched rule: Linux_Cryptominer_Malxmr_979160f6 Author: unknown
Source: .report_system.elf, type: SAMPLE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: .report_system.elf, type: SAMPLE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Camelot_cdd631c1 Author: unknown
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Malxmr_979160f6 Author: unknown
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Camelot_cdd631c1 Author: unknown
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Malxmr_979160f6 Author: unknown
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: .report_system.elf PID: 5435, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: .report_system.elf PID: 5436, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction0
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction1
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction10
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction100
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction101
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction102
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction103
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction104
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction105
Source: ELF static info symbol of initial sample	Name: CryptonightR_instruction106

Source: ELF static info symbol of initial sample

.symtab present: no

Source: .report_system.elf, type: SAMPLE	Matched rule: Linux_Cryptominer_Camelot_cdd631c1 reference_sample = 91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897, os = linux, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Camelot, fingerprint = fa174ac25467ab6e0f11cf1f0a5c6bf653737e9bbdc9411aabeae460a33faa5e, id = cdd631c1-2c03-47dd-b50a-e8c0b9f67271, last_modified = 2021-09-16
Source: .report_system.elf, type: SAMPLE	Matched rule: Linux_Cryptominer_Malxmr_979160f6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Malxmr, fingerprint = fb933702578e2cf7e8ad74554ef93c07b610d6da8bc5743cbf86c363c1615f40, id = 979160f6-402a-4e4b-858a-374c9415493b, last_modified = 2021-09-16
Source: .report_system.elf, type: SAMPLE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: .report_system.elf, type: SAMPLE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Camelot_cdd631c1 reference_sample = 91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897, os = linux, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Camelot, fingerprint = fa174ac25467ab6e0f11cf1f0a5c6bf653737e9bbdc9411aabeae460a33faa5e, id = cdd631c1-2c03-47dd-b50a-e8c0b9f67271, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Malxmr_979160f6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Malxmr, fingerprint = fb933702578e2cf7e8ad74554ef93c07b610d6da8bc5743cbf86c363c1615f40, id = 979160f6-402a-4e4b-858a-374c9415493b, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 5435.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Camelot_cdd631c1 reference_sample = 91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897, os = linux, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Camelot, fingerprint = fa174ac25467ab6e0f11cf1f0a5c6bf653737e9bbdc9411aabeae460a33faa5e, id = cdd631c1-2c03-47dd-b50a-e8c0b9f67271, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Cryptominer_Malxmr_979160f6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Malxmr, fingerprint = fb933702578e2cf7e8ad74554ef93c07b610d6da8bc5743cbf86c363c1615f40, id = 979160f6-402a-4e4b-858a-374c9415493b, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 5436.1.0000000000400000.0000000000c29000.r-x.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: .report_system.elf PID: 5435, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: .report_system.elf PID: 5436, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal96.troj.mine.linELF@0/1@4/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/.report_system.elf (PID: 5435)

File: /proc/5435/mounts

Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)

Directory: /root/.xmrig.json

Jump to behavior

Source: /tmp/.report_system.elf (PID: 5442)

Shell command executed: sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"

Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)	Reads from proc file: /proc/cpuinfo	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5436)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /bin/sh (PID: 5443)

Modprobe: /sbin/modprobe -> /sbin/modprobe msr allow_writes=on

Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpus	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_map	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/level	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/type	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/id	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_size	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_sets	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partition	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5435)	Reads CPU info from /sys: /sys/devices/system/cpu/possible	Jump to behavior

Source: /tmp/.report_system.elf (PID: 5435)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/.report_system.elf (PID: 5436)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/modprobe (PID: 5443)	Queries kernel information via 'uname':	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Kernel Modules and Extensions	1 Kernel Modules and Extensions	1 Hidden Files and Directories	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
.report_system.elf	50%	ReversingLabs	Linux.Trojan.Miner
.report_system.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		unknown
xkobeproxy.xkobeimparatu.net	91.184.240.129	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://xmrig.com/benchmark/%s	.report_system.elf	false	unknown
https://xmrig.com/wizard	.report_system.elf	false	unknown
https://gcc.gnu.org/bugsterminate	.report_system.elf	false	unknown
https://xmrig.com/wizard%s	.report_system.elf	false	unknown
https://xmrig.com/docs/algorithms	.report_system.elf	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.184.240.129	xkobeproxy.xkobeimparatu.net	Russian Federation		41745	IPNET-RUSSIA-ASRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.184.240.129	.main.elf	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	j66VB9153M.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	belks.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	belks.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	belks.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
xkobeproxy.xkobeimparatu.net	.main.elf	Get hash	malicious	Xmrig	Browse	91.184.240.129

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IPNET-RUSSIA-ASRU	.main.elf	Get hash	malicious	Xmrig	Browse	91.184.240.129

Process:	/tmp/.report_system.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:MRV:Mz
MD5:	537D9B6C927223C796CAC288CCED29DF
SHA1:	EA10E810F96FCA6858E37FDA9832ACE147EED87C
SHA-256:	0D21AE129A64E1D19E4A94DFCA3A67C777E17374E9D4CA2F74B65647A88119EA
SHA-512:	6D4B04576201F789368F251EA231F5D2C0AE4CF17E95851D3AE10A1825724502732289F830E06247465F0284D4E33A9A120F6D730E62483515556DC1FD9CD120
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1040

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=8afd33b2af62232440a91e62c1990b7361563967, stripped
Entropy (8bit):	6.5592983789649235
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	.report_system.elf
File size:	8'825'184 bytes
MD5:	1271e6e82b344df1c7960230ec449af7
SHA1:	7fe3253d34cae21facc8c445c3620b9e8566988b
SHA256:	fff96ad553f916da4eb0d55b1075b9b4aea7b93249663aefbc0310e53c7498ba
SHA512:	786f8ae08f8cdb892c1d67b216d26ce8db464e445c4884ab23bdfb642d7cc52862ceb77c51b38a2f77c6ae38541ea83f6eaeb2d2c2337a2d96f61738de4ff39c
SSDEEP:	196608:WZnq0MCLhe6WB49j0uDIHUJ92SyMsWy+N4fqvxh+0s:WZnq0MCLhe6Wa9j0uaUJ92u5oivxh+
TLSH:	DB969E07F99318BDC5DAD870872BD2A7AE30BC1442257D7B3694DA302E53FA05B2EB51
File Content Preview:	.ELF..............>.......Q.....@...................@.8...@.............@.......@.@.....@.@.....0.......0.......................p.......p.@.....p.@...............................................@.......@....................... ............................

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x51f713
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	10
Section Header Offset:	8823200
Section Header Size:	64
Number of Section Headers:	31
Header String Table Index:	30

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x400270	0x270	0x1c	0x0	0x2	A	0	0	1
.note.ABI-tag	NOTE	0x40028c	0x28c	0x20	0x0	0x2	A	0	0	4
.note.gnu.build-id	NOTE	0x4002ac	0x2ac	0x24	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x4002d0	0x2d0	0x1afc8	0x0	0x2	A	5	0	8
.dynsym	DYNSYM	0x41b298	0x1b298	0x5be48	0x18	0x2	A	6	1	8
.dynstr	STRTAB	0x4770e0	0x770e0	0x99ac7	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x510ba8	0x110ba8	0x7a86	0x2	0x2	A	5	0	2
.gnu.version_r	VERNEED	0x518630	0x118630	0x1a0	0x0	0x2	A	6	6	8
.rela.dyn	RELA	0x5187d0	0x1187d0	0x1e0	0x18	0x2	A	5	0	8
.rela.plt	RELA	0x5189b0	0x1189b0	0x2268	0x18	0x42	AI	5	26	8
.init	PROGBITS	0x51ac18	0x11ac18	0x1a	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x51ac40	0x11ac40	0x1700	0x10	0x6	AX	0	0	16
.plt.got	PROGBITS	0x51c340	0x11c340	0x20	0x0	0x6	AX	0	0	8
.text	PROGBITS	0x51c380	0x11c380	0x52c6ca	0x0	0x6	AX	0	0	64
.fini	PROGBITS	0xa48a4c	0x648a4c	0x9	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0xa48a80	0x648a80	0x10e708	0x0	0x2	A	0	0	64
.eh_frame_hdr	PROGBITS	0xb57188	0x757188	0x1c6f4	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0xb73880	0x773880	0xa79fc	0x0	0x2	A	0	0	8
.gcc_except_table	PROGBITS	0xc1b27c	0x81b27c	0xd204	0x0	0x2	A	0	0	4
.tbss	NOBITS	0xe292d0	0x8292d0	0x20	0x0	0x403	WAT	0	0	16
.init_array	INIT_ARRAY	0xe292d0	0x8292d0	0x1c0	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0xe29490	0x829490	0x10	0x8	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0xe294a0	0x8294a0	0x338d8	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0xe5cd78	0x85cd78	0x220	0x10	0x3	WA	6	0	8
.got	PROGBITS	0xe5cf98	0x85cf98	0x68	0x8	0x3	WA	0	0	8
.got.plt	PROGBITS	0xe5d000	0x85d000	0xb90	0x8	0x3	WA	0	0	8
.data	PROGBITS	0xe5dba0	0x85dba0	0xc488	0x0	0x3	WA	0	0	32
.bss	NOBITS	0xe6a040	0x86a028	0x9cc28	0x0	0x3	WA	0	0	64
.comment	PROGBITS	0x0	0x86a028	0x59	0x1	0x30	MS	0	0	1
.shstrtab	STRTAB	0x0	0x86a081	0x11c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x400040	0x400040	0x230	0x230	2.1119	0x5	R E	0x8
INTERP	0x270	0x400270	0x400270	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x400000	0x400000	0x828480	0x828480	6.6320	0x5	R E	0x200000		.interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame .gcc_except_table
LOAD	0x8292d0	0xe292d0	0xe292d0	0x40d58	0xdd998	2.9351	0x6	RW	0x200000		.tbss .init_array .fini_array .data.rel.ro .dynamic .got .got.plt .data .bss
DYNAMIC	0x85cd78	0xe5cd78	0xe5cd78	0x220	0x220	1.7046	0x6	RW	0x8		.dynamic
NOTE	0x28c	0x40028c	0x40028c	0x44	0x44	3.4924	0x4	R	0x4		.note.ABI-tag .note.gnu.build-id
TLS	0x8292d0	0xe292d0	0xe292d0	0x0	0x20	0.0000	0x4	R	0x10		.tbss
GNU_EH_FRAME	0x757188	0xb57188	0xb57188	0x1c6f4	0x1c6f4	6.4284	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x8292d0	0xe292d0	0xe292d0	0x33d30	0x33d30	2.6439	0x4	R	0x1		.tbss .init_array .fini_array .data.rel.ro .dynamic .got

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libpthread.so.0	0x1
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	librt.so.1	0x1
DT_NEEDED	sharedlib	libm.so.6	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_NEEDED	sharedlib	ld-linux-x86-64.so.2	0x1
DT_INIT	value	0x51ac18	0xc
DT_FINI	value	0xa48a4c	0xd
DT_INIT_ARRAY	value	0xe292d0	0x19
DT_INIT_ARRAYSZ	bytes	448	0x1b
DT_FINI_ARRAY	value	0xe29490	0x1a
DT_FINI_ARRAYSZ	bytes	16	0x1c
DT_GNU_HASH	value	0x4002d0	0x6ffffef5
DT_STRTAB	value	0x4770e0	0x5
DT_SYMTAB	value	0x41b298	0x6
DT_STRSZ	bytes	629447	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0xe5d000	0x3
DT_PLTRELSZ	bytes	8808	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x5189b0	0x17
DT_RELA	value	0x5187d0	0x7
DT_RELASZ	bytes	480	0x8
DT_RELAENT	bytes	24	0x9
DT_VERNEED	value	0x518630	0x6ffffffe
DT_VERNEEDNUM	value	6	0x6fffffff
DT_VERSYM	value	0x510ba8	0x6ffffff0
DT_NULL	value	0x0	0x0

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
ACCESS_DESCRIPTION_free	.dynsym	0x8640b0	12	FUNC	<unknown>	DEFAULT	14
ACCESS_DESCRIPTION_it	.dynsym	0xe42ba0	56	OBJECT	<unknown>	DEFAULT	23
ACCESS_DESCRIPTION_new	.dynsym	0x8640e0	12	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_free	.dynsym	0x8c78b0	12	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_get0_admissionAuthority	.dynsym	0x8c80b0	4	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_get0_namingAuthority	.dynsym	0x8c80e0	5	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_get0_professionInfos	.dynsym	0x8c8110	5	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_it	.dynsym	0xe482a0	56	OBJECT	<unknown>	DEFAULT	23
ADMISSIONS_new	.dynsym	0x8c7f60	12	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_set0_admissionAuthority	.dynsym	0x8c80c0	30	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_set0_namingAuthority	.dynsym	0x8c80f0	32	FUNC	<unknown>	DEFAULT	14
ADMISSIONS_set0_professionInfos	.dynsym	0x8c8120	39	FUNC	<unknown>	DEFAULT	14
ADMISSION_SYNTAX_free	.dynsym	0x8c7fa0	12	FUNC	<unknown>	DEFAULT	14
ADMISSION_SYNTAX_get0_admissionAuthority	.dynsym	0x8c8040	4	FUNC	<unknown>	DEFAULT	14
ADMISSION_SYNTAX_get0_contentsOfAdmissions	.dynsym	0x8c8070	5	FUNC	<unknown>	DEFAULT	14
ADMISSION_SYNTAX_it	.dynsym	0xe48260	56	OBJECT	<unknown>	DEFAULT	23
ADMISSION_SYNTAX_new	.dynsym	0x8c7f90	12	FUNC	<unknown>	DEFAULT	14
ADMISSION_SYNTAX_set0_admissionAuthority	.dynsym	0x8c8050	30	FUNC	<unknown>	DEFAULT	14
ADMISSION_SYNTAX_set0_contentsOfAdmissions	.dynsym	0x8c8080	39	FUNC	<unknown>	DEFAULT	14
AES_cbc_encrypt	.dynsym	0x86c0f0	36	FUNC	<unknown>	DEFAULT	14
AES_decrypt	.dynsym	0x86d2e0	1019	FUNC	<unknown>	DEFAULT	14
AES_encrypt	.dynsym	0x86cec0	1051	FUNC	<unknown>	DEFAULT	14
AES_set_decrypt_key	.dynsym	0x86ccd0	486	FUNC	<unknown>	DEFAULT	14
AES_set_encrypt_key	.dynsym	0x86c120	2982	FUNC	<unknown>	DEFAULT	14
ASIdOrRange_free	.dynsym	0x85f790	12	FUNC	<unknown>	DEFAULT	14
ASIdOrRange_it	.dynsym	0xe42620	56	OBJECT	<unknown>	DEFAULT	23
ASIdOrRange_new	.dynsym	0x85f780	12	FUNC	<unknown>	DEFAULT	14
ASIdentifierChoice_free	.dynsym	0x85fb90	12	FUNC	<unknown>	DEFAULT	14
ASIdentifierChoice_it	.dynsym	0xe425e0	56	OBJECT	<unknown>	DEFAULT	23
ASIdentifierChoice_new	.dynsym	0x85fb80	12	FUNC	<unknown>	DEFAULT	14
ASIdentifiers_free	.dynsym	0x85fbd0	12	FUNC	<unknown>	DEFAULT	14
ASIdentifiers_it	.dynsym	0xe425a0	56	OBJECT	<unknown>	DEFAULT	23
ASIdentifiers_new	.dynsym	0x85fbc0	12	FUNC	<unknown>	DEFAULT	14
ASN1_ANY_it	.dynsym	0xe2ec80	56	OBJECT	<unknown>	DEFAULT	23
ASN1_BIT_STRING_check	.dynsym	0x86f130	100	FUNC	<unknown>	DEFAULT	14
ASN1_BIT_STRING_free	.dynsym	0x7cc7d0	5	FUNC	<unknown>	DEFAULT	14
ASN1_BIT_STRING_get_bit	.dynsym	0x86f0f0	62	FUNC	<unknown>	DEFAULT	14
ASN1_BIT_STRING_it	.dynsym	0xe2efc0	56	OBJECT	<unknown>	DEFAULT	23
ASN1_BIT_STRING_new	.dynsym	0x7cc7c0	10	FUNC	<unknown>	DEFAULT	14
ASN1_BIT_STRING_set	.dynsym	0x86ebf0	5	FUNC	<unknown>	DEFAULT	14
ASN1_BIT_STRING_set_bit	.dynsym	0x86ef80	357	FUNC	<unknown>	DEFAULT	14
ASN1_BMPSTRING_free	.dynsym	0x7cca50	5	FUNC	<unknown>	DEFAULT	14
ASN1_BMPSTRING_it	.dynsym	0xe2ed40	56	OBJECT	<unknown>	DEFAULT	23
ASN1_BMPSTRING_new	.dynsym	0x7cca40	10	FUNC	<unknown>	DEFAULT	14
ASN1_BOOLEAN_it	.dynsym	0xe2eb40	56	OBJECT	<unknown>	DEFAULT	23
ASN1_ENUMERATED_free	.dynsym	0x7cc790	5	FUNC	<unknown>	DEFAULT	14
ASN1_ENUMERATED_get	.dynsym	0x7c3600	82	FUNC	<unknown>	DEFAULT	14
ASN1_ENUMERATED_get_int64	.dynsym	0x7c3370	491	FUNC	<unknown>	DEFAULT	14
ASN1_ENUMERATED_it	.dynsym	0xe2f000	56	OBJECT	<unknown>	DEFAULT	23
ASN1_ENUMERATED_new	.dynsym	0x7cc780	10	FUNC	<unknown>	DEFAULT	14
ASN1_ENUMERATED_set	.dynsym	0x7c35f0	5	FUNC	<unknown>	DEFAULT	14
ASN1_ENUMERATED_set_int64	.dynsym	0x7c3560	129	FUNC	<unknown>	DEFAULT	14
ASN1_ENUMERATED_to_BN	.dynsym	0x7c37b0	170	FUNC	<unknown>	DEFAULT	14
ASN1_FBOOLEAN_it	.dynsym	0xe2eac0	56	OBJECT	<unknown>	DEFAULT	23
ASN1_GENERALIZEDTIME_adj	.dynsym	0x86fa90	109	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALIZEDTIME_check	.dynsym	0x86fa20	10	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALIZEDTIME_free	.dynsym	0x7cc990	5	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALIZEDTIME_it	.dynsym	0xe2ee00	56	OBJECT	<unknown>	DEFAULT	23
ASN1_GENERALIZEDTIME_new	.dynsym	0x7cc980	10	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALIZEDTIME_print	.dynsym	0x86fb10	21	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALIZEDTIME_set	.dynsym	0x86fb00	9	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALIZEDTIME_set_string	.dynsym	0x86fa30	96	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALSTRING_free	.dynsym	0x7cc910	5	FUNC	<unknown>	DEFAULT	14
ASN1_GENERALSTRING_it	.dynsym	0xe2ee80	56	OBJECT	<unknown>	DEFAULT	23
ASN1_GENERALSTRING_new	.dynsym	0x7cc900	10	FUNC	<unknown>	DEFAULT	14
ASN1_IA5STRING_free	.dynsym	0x7cc8d0	5	FUNC	<unknown>	DEFAULT	14
ASN1_IA5STRING_it	.dynsym	0xe2eec0	56	OBJECT	<unknown>	DEFAULT	23
ASN1_IA5STRING_new	.dynsym	0x7cc8c0	10	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_cmp	.dynsym	0x7c1e80	56	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_dup	.dynsym	0x7c1e70	5	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_free	.dynsym	0x7cc750	5	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_get	.dynsym	0x7c3120	65	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_get_int64	.dynsym	0x7c2c90	491	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_get_uint64	.dynsym	0x7c2f10	421	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_it	.dynsym	0xe2f040	56	OBJECT	<unknown>	DEFAULT	23
ASN1_INTEGER_new	.dynsym	0x7cc740	10	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_set	.dynsym	0x7c3110	5	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_set_int64	.dynsym	0x7c2e80	129	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_set_uint64	.dynsym	0x7c30c0	74	FUNC	<unknown>	DEFAULT	14
ASN1_INTEGER_to_BN	.dynsym	0x7c32c0	170	FUNC	<unknown>	DEFAULT	14
ASN1_NULL_free	.dynsym	0x7cca90	12	FUNC	<unknown>	DEFAULT	14
ASN1_NULL_it	.dynsym	0xe2ed00	56	OBJECT	<unknown>	DEFAULT	23
ASN1_NULL_new	.dynsym	0x7cca80	12	FUNC	<unknown>	DEFAULT	14
ASN1_OBJECT_create	.dynsym	0x870980	64	FUNC	<unknown>	DEFAULT	14
ASN1_OBJECT_free	.dynsym	0x8705d0	178	FUNC	<unknown>	DEFAULT	14
ASN1_OBJECT_it	.dynsym	0xe2ecc0	56	OBJECT	<unknown>	DEFAULT	23
ASN1_OBJECT_new	.dynsym	0x870570	90	FUNC	<unknown>	DEFAULT	14
ASN1_OCTET_STRING_NDEF_it	.dynsym	0xe2ea80	56	OBJECT	<unknown>	DEFAULT	23
ASN1_OCTET_STRING_cmp	.dynsym	0x8709d0	5	FUNC	<unknown>	DEFAULT	14
ASN1_OCTET_STRING_dup	.dynsym	0x8709c0	5	FUNC	<unknown>	DEFAULT	14
ASN1_OCTET_STRING_free	.dynsym	0x7cc710	5	FUNC	<unknown>	DEFAULT	14
ASN1_OCTET_STRING_it	.dynsym	0xe2f080	56	OBJECT	<unknown>	DEFAULT	23
ASN1_OCTET_STRING_new	.dynsym	0x7cc700	10	FUNC	<unknown>	DEFAULT	14
ASN1_OCTET_STRING_set	.dynsym	0x8709e0	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_free	.dynsym	0x87a6c0	14	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_get_cert_flags	.dynsym	0x87a710	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_get_flags	.dynsym	0x87a6d0	4	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_get_nm_flags	.dynsym	0x87a6f0	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_get_oid_flags	.dynsym	0x87a730	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_get_str_flags	.dynsym	0x87a750	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_new	.dynsym	0x87a660	82	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_set_cert_flags	.dynsym	0x87a720	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_set_flags	.dynsym	0x87a6e0	4	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_set_nm_flags	.dynsym	0x87a700	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_set_oid_flags	.dynsym	0x87a740	5	FUNC	<unknown>	DEFAULT	14
ASN1_PCTX_set_str_flags	.dynsym	0x87a760	5	FUNC	<unknown>	DEFAULT	14
ASN1_PRINTABLESTRING_free	.dynsym	0x7cc850	5	FUNC	<unknown>	DEFAULT	14
ASN1_PRINTABLESTRING_it	.dynsym	0xe2ef40	56	OBJECT	<unknown>	DEFAULT	23
ASN1_PRINTABLESTRING_new	.dynsym	0x7cc840	10	FUNC	<unknown>	DEFAULT	14
ASN1_PRINTABLE_free	.dynsym	0x7ccb10	12	FUNC	<unknown>	DEFAULT	14
ASN1_PRINTABLE_it	.dynsym	0xe2ec00	56	OBJECT	<unknown>	DEFAULT	23
ASN1_PRINTABLE_new	.dynsym	0x7ccb00	12	FUNC	<unknown>	DEFAULT	14
ASN1_PRINTABLE_type	.dynsym	0x8709f0	158	FUNC	<unknown>	DEFAULT	14
ASN1_SEQUENCE_ANY_it	.dynsym	0xe2ea40	56	OBJECT	<unknown>	DEFAULT	23
ASN1_SEQUENCE_it	.dynsym	0xe2ec40	56	OBJECT	<unknown>	DEFAULT	23
ASN1_SET_ANY_it	.dynsym	0xe2ea00	56	OBJECT	<unknown>	DEFAULT	23
ASN1_STRING_TABLE_add	.dynsym	0x874c30	419	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_TABLE_cleanup	.dynsym	0x874de0	42	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_TABLE_get	.dynsym	0x874b00	100	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_clear_free	.dynsym	0x7c5510	65	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_cmp	.dynsym	0x7c5560	82	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_copy	.dynsym	0x7c5320	99	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_data	.dynsym	0x7c5600	5	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_dup	.dynsym	0x7c54c0	76	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_free	.dynsym	0x7c54a0	26	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_get0_data	.dynsym	0x7c55f0	5	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_get_default_mask	.dynsym	0x874a00	8	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_length	.dynsym	0x7c55c0	3	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_length_set	.dynsym	0x7c55d0	3	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_new	.dynsym	0x7c5420	10	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_print	.dynsym	0x870b60	275	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_print_ex	.dynsym	0x874900	14	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_print_ex_fp	.dynsym	0x874910	14	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_set	.dynsym	0x7c5210	266	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_set0	.dynsym	0x7c5390	41	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_set_by_NID	.dynsym	0x874b70	180	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_set_default_mask	.dynsym	0x8749f0	8	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_set_default_mask_asc	.dynsym	0x874a10	226	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_to_UTF8	.dynsym	0x874920	135	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_type	.dynsym	0x7c55e0	4	FUNC	<unknown>	DEFAULT	14
ASN1_STRING_type_new	.dynsym	0x7c53c0	90	FUNC	<unknown>	DEFAULT	14
ASN1_T61STRING_free	.dynsym	0x7cc890	5	FUNC	<unknown>	DEFAULT	14
ASN1_T61STRING_it	.dynsym	0xe2ef00	56	OBJECT	<unknown>	DEFAULT	23
ASN1_T61STRING_new	.dynsym	0x7cc880	10	FUNC	<unknown>	DEFAULT	14
ASN1_TBOOLEAN_it	.dynsym	0xe2eb00	56	OBJECT	<unknown>	DEFAULT	23
ASN1_TIME_adj	.dynsym	0x8756a0	146	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_check	.dynsym	0x875750	29	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_cmp_time_t	.dynsym	0x875c00	151	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_compare	.dynsym	0x875ce0	87	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_diff	.dynsym	0x8759a0	114	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_free	.dynsym	0x874e40	12	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_it	.dynsym	0xe42f20	56	OBJECT	<unknown>	DEFAULT	23
ASN1_TIME_new	.dynsym	0x874e30	12	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_normalize	.dynsym	0x875ca0	56	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_print	.dynsym	0x875a20	476	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_set	.dynsym	0x875740	9	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_set_string	.dynsym	0x875770	57	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_set_string_X509	.dynsym	0x8757b0	277	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_to_generalizedtime	.dynsym	0x875930	100	FUNC	<unknown>	DEFAULT	14
ASN1_TIME_to_tm	.dynsym	0x8758d0	95	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_cmp	.dynsym	0x7c4540	94	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_free	.dynsym	0x7ccad0	12	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_get	.dynsym	0x7c4430	27	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_get_int_octetstring	.dynsym	0x878a60	193	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_get_octetstring	.dynsym	0x878980	125	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_new	.dynsym	0x7ccac0	12	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_pack_sequence	.dynsym	0x7c45a0	132	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_set	.dynsym	0x7c4450	101	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_set1	.dynsym	0x7c44c0	120	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_set_int_octetstring	.dynsym	0x878a00	85	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_set_octetstring	.dynsym	0x878900	119	FUNC	<unknown>	DEFAULT	14
ASN1_TYPE_unpack_sequence	.dynsym	0x7c4630	35	FUNC	<unknown>	DEFAULT	14
ASN1_UNIVERSALSTRING_free	.dynsym	0x7cca10	5	FUNC	<unknown>	DEFAULT	14
ASN1_UNIVERSALSTRING_it	.dynsym	0xe2ed80	56	OBJECT	<unknown>	DEFAULT	23
ASN1_UNIVERSALSTRING_new	.dynsym	0x7cca00	10	FUNC	<unknown>	DEFAULT	14
ASN1_UNIVERSALSTRING_to_string	.dynsym	0x870a90	195	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_adj	.dynsym	0x875dd0	109	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_check	.dynsym	0x875d60	10	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_cmp_time_t	.dynsym	0x875e50	151	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_free	.dynsym	0x7cc950	5	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_it	.dynsym	0xe2ee40	56	OBJECT	<unknown>	DEFAULT	23
ASN1_UTCTIME_new	.dynsym	0x7cc940	10	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_print	.dynsym	0x875ef0	21	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_set	.dynsym	0x875e40	9	FUNC	<unknown>	DEFAULT	14
ASN1_UTCTIME_set_string	.dynsym	0x875d70	96	FUNC	<unknown>	DEFAULT	14
ASN1_UTF8STRING_free	.dynsym	0x7cc810	5	FUNC	<unknown>	DEFAULT	14
ASN1_UTF8STRING_it	.dynsym	0xe2ef80	56	OBJECT	<unknown>	DEFAULT	23
ASN1_UTF8STRING_new	.dynsym	0x7cc800	10	FUNC	<unknown>	DEFAULT	14
ASN1_VISIBLESTRING_free	.dynsym	0x7cc9d0	5	FUNC	<unknown>	DEFAULT	14
ASN1_VISIBLESTRING_it	.dynsym	0xe2edc0	56	OBJECT	<unknown>	DEFAULT	23
ASN1_VISIBLESTRING_new	.dynsym	0x7cc9c0	10	FUNC	<unknown>	DEFAULT	14
ASN1_add_oid_module	.dynsym	0x8da930	26	FUNC	<unknown>	DEFAULT	14
ASN1_add_stable_module	.dynsym	0x8dad30	26	FUNC	<unknown>	DEFAULT	14
ASN1_bn_print	.dynsym	0x8791f0	499	FUNC	<unknown>	DEFAULT	14
ASN1_buf_print	.dynsym	0x8790e0	267	FUNC	<unknown>	DEFAULT	14
ASN1_check_infinite_end	.dynsym	0x7c4db0	46	FUNC	<unknown>	DEFAULT	14
ASN1_const_check_infinite_end	.dynsym	0x7c4de0	46	FUNC	<unknown>	DEFAULT	14
ASN1_d2i_bio	.dynsym	0x86f500	87	FUNC	<unknown>	DEFAULT	14
ASN1_d2i_fp	.dynsym	0x86f560	138	FUNC	<unknown>	DEFAULT	14
ASN1_digest	.dynsym	0x86f6f0	274	FUNC	<unknown>	DEFAULT	14
ASN1_dup	.dynsym	0x86f8b0	161	FUNC	<unknown>	DEFAULT	14
ASN1_generate_nconf	.dynsym	0x877c10	43	FUNC	<unknown>	DEFAULT	14
ASN1_generate_v3	.dynsym	0x877bc0	72	FUNC	<unknown>	DEFAULT	14
ASN1_get_object	.dynsym	0x7c4e10	605	FUNC	<unknown>	DEFAULT	14
ASN1_i2d_bio	.dynsym	0x86fb30	213	FUNC	<unknown>	DEFAULT	14
ASN1_i2d_fp	.dynsym	0x86fc10	141	FUNC	<unknown>	DEFAULT	14
ASN1_item_d2i	.dynsym	0x7ca320	84	FUNC	<unknown>	DEFAULT	14
ASN1_item_d2i_bio	.dynsym	0x86f5f0	100	FUNC	<unknown>	DEFAULT	14
ASN1_item_d2i_fp	.dynsym	0x86f660	138	FUNC	<unknown>	DEFAULT	14
ASN1_item_digest	.dynsym	0x86f810	146	FUNC	<unknown>	DEFAULT	14
ASN1_item_dup	.dynsym	0x86f960	146	FUNC	<unknown>	DEFAULT	14
ASN1_item_ex_d2i	.dynsym	0x7c9950	2508	FUNC	<unknown>	DEFAULT	14
ASN1_item_ex_free	.dynsym	0x7cb920	7	FUNC	<unknown>	DEFAULT	14
ASN1_item_ex_i2d	.dynsym	0x7ca880	1024	FUNC	<unknown>	DEFAULT	14
ASN1_item_ex_new	.dynsym	0x7cc1d0	1217	FUNC	<unknown>	DEFAULT	14
ASN1_item_free	.dynsym	0x7cb900	26	FUNC	<unknown>	DEFAULT	14
ASN1_item_i2d	.dynsym	0x7cb3e0	216	FUNC	<unknown>	DEFAULT	14
ASN1_item_i2d_bio	.dynsym	0x86fca0	179	FUNC	<unknown>	DEFAULT	14
ASN1_item_i2d_fp	.dynsym	0x86fd60	141	FUNC	<unknown>	DEFAULT	14
ASN1_item_ndef_i2d	.dynsym	0x7cac80	216	FUNC	<unknown>	DEFAULT	14
ASN1_item_new	.dynsym	0x7cc6a0	52	FUNC	<unknown>	DEFAULT	14
ASN1_item_pack	.dynsym	0x7c5610	320	FUNC	<unknown>	DEFAULT	14
ASN1_item_print	.dynsym	0x87a770	1998	FUNC	<unknown>	DEFAULT	14
ASN1_item_sign	.dynsym	0x8713e0	191	FUNC	<unknown>	DEFAULT	14
ASN1_item_sign_ctx	.dynsym	0x8710b0	812	FUNC	<unknown>	DEFAULT	14
ASN1_item_unpack	.dynsym	0x7c5750	93	FUNC	<unknown>	DEFAULT	14
ASN1_item_verify	.dynsym	0x876660	702	FUNC	<unknown>	DEFAULT	14
ASN1_mbstring_copy	.dynsym	0x8cae00	19	FUNC	<unknown>	DEFAULT	14
ASN1_mbstring_ncopy	.dynsym	0x8ca3a0	2653	FUNC	<unknown>	DEFAULT	14
ASN1_object_size	.dynsym	0x7c51a0	110	FUNC	<unknown>	DEFAULT	14
ASN1_parse	.dynsym	0x8788a0	38	FUNC	<unknown>	DEFAULT	14
ASN1_parse_dump	.dynsym	0x8788d0	38	FUNC	<unknown>	DEFAULT	14
ASN1_put_eoc	.dynsym	0x7c5180	21	FUNC	<unknown>	DEFAULT	14
ASN1_put_object	.dynsym	0x7c5070	272	FUNC	<unknown>	DEFAULT	14
ASN1_sign	.dynsym	0x870c80	1066	FUNC	<unknown>	DEFAULT	14
ASN1_str2mask	.dynsym	0x877c40	32	FUNC	<unknown>	DEFAULT	14
ASN1_tag2bit	.dynsym	0x7c6f50	23	FUNC	<unknown>	DEFAULT	14
ASN1_tag2str	.dynsym	0x877c60	47	FUNC	<unknown>	DEFAULT	14
ASN1_verify	.dynsym	0x876450	528	FUNC	<unknown>	DEFAULT	14
ASRange_free	.dynsym	0x85f750	12	FUNC	<unknown>	DEFAULT	14
ASRange_it	.dynsym	0xe42660	56	OBJECT	<unknown>	DEFAULT	23
ASRange_new	.dynsym	0x85f740	12	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_clear_fd	.dynsym	0x7ce5b0	160	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_free	.dynsym	0x7ce350	130	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_get_all_fds	.dynsym	0x7ce4d0	60	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_get_changed_fds	.dynsym	0x7ce510	153	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_get_fd	.dynsym	0x7ce480	69	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_new	.dynsym	0x7ce330	19	FUNC	<unknown>	DEFAULT	14
ASYNC_WAIT_CTX_set_wait_fd	.dynsym	0x7ce3e0	145	FUNC	<unknown>	DEFAULT	14
ASYNC_block_pause	.dynsym	0x7ce2a0	64	FUNC	<unknown>	DEFAULT	14
ASYNC_cleanup_thread	.dynsym	0x7ce220	41	FUNC	<unknown>	DEFAULT	14
ASYNC_get_current_job	.dynsym	0x7ce250	55	FUNC	<unknown>	DEFAULT	14
ASYNC_get_wait_ctx	.dynsym	0x7ce290	8	FUNC	<unknown>	DEFAULT	14
ASYNC_init_thread	.dynsym	0x7cd9b0	636	FUNC	<unknown>	DEFAULT	14
ASYNC_is_capable	.dynsym	0x87b470	31	FUNC	<unknown>	DEFAULT	14
ASYNC_pause_job	.dynsym	0x7cd8a0	148	FUNC	<unknown>	DEFAULT	14
ASYNC_start_job	.dynsym	0x7cdc30	1286	FUNC	<unknown>	DEFAULT	14
ASYNC_unblock_pause	.dynsym	0x7ce2e0	76	FUNC	<unknown>	DEFAULT	14
AUTHORITY_INFO_ACCESS_free	.dynsym	0x864330	12	FUNC	<unknown>	DEFAULT	14
AUTHORITY_INFO_ACCESS_it	.dynsym	0xe42b60	56	OBJECT	<unknown>	DEFAULT	23
AUTHORITY_INFO_ACCESS_new	.dynsym	0x864320	12	FUNC	<unknown>	DEFAULT	14
AUTHORITY_KEYID_free	.dynsym	0x85f0d0	12	FUNC	<unknown>	DEFAULT	14
AUTHORITY_KEYID_it	.dynsym	0xe42560	56	OBJECT	<unknown>	DEFAULT	23
AUTHORITY_KEYID_new	.dynsym	0x85f0c0	12	FUNC	<unknown>	DEFAULT	14
BASIC_CONSTRAINTS_free	.dynsym	0x8c9ac0	12	FUNC	<unknown>	DEFAULT	14
BASIC_CONSTRAINTS_it	.dynsym	0xe48360	56	OBJECT	<unknown>	DEFAULT	23
BASIC_CONSTRAINTS_new	.dynsym	0x8c9ab0	12	FUNC	<unknown>	DEFAULT	14
BF_cbc_encrypt	.dynsym	0x8cca50	1291	FUNC	<unknown>	DEFAULT	14
BF_cfb64_encrypt	.dynsym	0x8cc070	433	FUNC	<unknown>	DEFAULT	14
BF_decrypt	.dynsym	0x8cc680	976	FUNC	<unknown>	DEFAULT	14
BF_ecb_encrypt	.dynsym	0x8cc240	111	FUNC	<unknown>	DEFAULT	14
BF_encrypt	.dynsym	0x8cc2b0	976	FUNC	<unknown>	DEFAULT	14
BF_ofb64_encrypt	.dynsym	0x8ccf60	397	FUNC	<unknown>	DEFAULT	14
BF_options	.dynsym	0x8cc230	8	FUNC	<unknown>	DEFAULT	14
BF_set_key	.dynsym	0x8cd0f0	311	FUNC	<unknown>	DEFAULT	14
BIGNUM_it	.dynsym	0xe43480	56	OBJECT	<unknown>	DEFAULT	23
BIO_ADDRINFO_address	.dynsym	0x7cee40	19	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_family	.dynsym	0x7cedb0	12	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_free	.dynsym	0x7cee60	98	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_next	.dynsym	0x7ced90	19	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_protocol	.dynsym	0x7cedd0	55	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_sockaddr	.dynsym	0x7cee20	19	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_sockaddr_size	.dynsym	0x7cee10	12	FUNC	<unknown>	DEFAULT	14
BIO_ADDRINFO_socktype	.dynsym	0x7cedc0	12	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_clear	.dynsym	0x7ce760	48	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_family	.dynsym	0x7ce920	4	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_free	.dynsym	0x7ce750	14	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_hostname_string	.dynsym	0x7cecf0	73	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_make	.dynsym	0x7ce790	155	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_new	.dynsym	0x7ce6f0	90	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_path_string	.dynsym	0x7ce9d0	35	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_rawaddress	.dynsym	0x7ce930	118	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_rawmake	.dynsym	0x7ce830	235	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_rawport	.dynsym	0x7ce9b0	29	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_service_string	.dynsym	0x7ced40	73	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_sockaddr	.dynsym	0x7cea00	4	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_sockaddr_noconst	.dynsym	0x7cea10	4	FUNC	<unknown>	DEFAULT	14
BIO_ADDR_sockaddr_size	.dynsym	0x7cea20	40	FUNC	<unknown>	DEFAULT	14
BIO_accept	.dynsym	0x7d28e0	411	FUNC	<unknown>	DEFAULT	14
BIO_accept_ex	.dynsym	0x7d3230	195	FUNC	<unknown>	DEFAULT	14
BIO_bind	.dynsym	0x7d2e10	331	FUNC	<unknown>	DEFAULT	14
BIO_callback_ctrl	.dynsym	0x7d5520	352	FUNC	<unknown>	DEFAULT	14
BIO_clear_flags	.dynsym	0x7d4600	6	FUNC	<unknown>	DEFAULT	14
BIO_closesocket	.dynsym	0x7d3300	19	FUNC	<unknown>	DEFAULT	14
BIO_connect	.dynsym	0x7d2c40	459	FUNC	<unknown>	DEFAULT	14
BIO_copy_next_retry	.dynsym	0x7d59a0	40	FUNC	<unknown>	DEFAULT	14
BIO_ctrl	.dynsym	0x7d5370	331	FUNC	<unknown>	DEFAULT	14
BIO_ctrl_pending	.dynsym	0x7d5680	14	FUNC	<unknown>	DEFAULT	14
BIO_ctrl_wpending	.dynsym	0x7d5690	14	FUNC	<unknown>	DEFAULT	14
BIO_dump	.dynsym	0x87b910	20	FUNC	<unknown>	DEFAULT	14
BIO_dump_cb	.dynsym	0x87b8c0	8	FUNC	<unknown>	DEFAULT	14
BIO_dump_fp	.dynsym	0x87b8d0	20	FUNC	<unknown>	DEFAULT	14
BIO_dump_indent	.dynsym	0x87b930	23	FUNC	<unknown>	DEFAULT	14
BIO_dump_indent_cb	.dynsym	0x87b580	819	FUNC	<unknown>	DEFAULT	14
BIO_dump_indent_fp	.dynsym	0x87b8f0	23	FUNC	<unknown>	DEFAULT	14
BIO_dup_chain	.dynsym	0x7d58a0	241	FUNC	<unknown>	DEFAULT	14
BIO_f_buffer	.dynsym	0x7d42d0	8	FUNC	<unknown>	DEFAULT	14
BIO_f_cipher	.dynsym	0x8ac6e0	8	FUNC	<unknown>	DEFAULT	14
BIO_f_md	.dynsym	0x8acc70	8	FUNC	<unknown>	DEFAULT	14
BIO_find_type	.dynsym	0x7d57d0	84	FUNC	<unknown>	DEFAULT	14
BIO_free	.dynsym	0x7d4490	218	FUNC	<unknown>	DEFAULT	14
BIO_free_all	.dynsym	0x7d5860	50	FUNC	<unknown>	DEFAULT	14
BIO_get_accept_socket	.dynsym	0x7d27b0	304	FUNC	<unknown>	DEFAULT	14
BIO_get_callback	.dynsym	0x7d4630	5	FUNC	<unknown>	DEFAULT	14
BIO_get_callback_arg	.dynsym	0x7d4680	5	FUNC	<unknown>	DEFAULT	14
BIO_get_callback_ex	.dynsym	0x7d4650	5	FUNC	<unknown>	DEFAULT	14
BIO_get_data	.dynsym	0x7d4580	5	FUNC	<unknown>	DEFAULT	14
BIO_get_ex_data	.dynsym	0x7d59e0	9	FUNC	<unknown>	DEFAULT	14
BIO_get_host_ip	.dynsym	0x7d2530	269	FUNC	<unknown>	DEFAULT	14
BIO_get_init	.dynsym	0x7d45a0	4	FUNC	<unknown>	DEFAULT	14
BIO_get_new_index	.dynsym	0x7d5b00	101	FUNC	<unknown>	DEFAULT	14
BIO_get_port	.dynsym	0x7d2640	274	FUNC	<unknown>	DEFAULT	14
BIO_get_retry_BIO	.dynsym	0x7d5760	68	FUNC	<unknown>	DEFAULT	14
BIO_get_retry_reason	.dynsym	0x7d57b0	4	FUNC	<unknown>	DEFAULT	14
BIO_get_shutdown	.dynsym	0x7d45c0	4	FUNC	<unknown>	DEFAULT	14
BIO_gethostbyname	.dynsym	0x7d2510	5	FUNC	<unknown>	DEFAULT	14
BIO_gets	.dynsym	0x7d50c0	589	FUNC	<unknown>	DEFAULT	14
BIO_hex_string	.dynsym	0x87b950	262	FUNC	<unknown>	DEFAULT	14
BIO_indent	.dynsym	0x7d5310	87	FUNC	<unknown>	DEFAULT	14
BIO_int_ctrl	.dynsym	0x7d54c0	23	FUNC	<unknown>	DEFAULT	14
BIO_listen	.dynsym	0x7d2f60	710	FUNC	<unknown>	DEFAULT	14
BIO_lookup	.dynsym	0x7cf410	19	FUNC	<unknown>	DEFAULT	14
BIO_lookup_ex	.dynsym	0x7cf140	720	FUNC	<unknown>	DEFAULT	14
BIO_meth_free	.dynsym	0x7d5c00	50	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_callback_ctrl	.dynsym	0x7d5da0	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_create	.dynsym	0x7d5d60	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_ctrl	.dynsym	0x7d5d40	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_destroy	.dynsym	0x7d5d80	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_gets	.dynsym	0x7d5d20	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_puts	.dynsym	0x7d5d00	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_read	.dynsym	0x7d5ca0	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_read_ex	.dynsym	0x7d5cb0	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_write	.dynsym	0x7d5c40	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_get_write_ex	.dynsym	0x7d5c50	5	FUNC	<unknown>	DEFAULT	14
BIO_meth_new	.dynsym	0x7d5b70	131	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_callback_ctrl	.dynsym	0x7d5db0	10	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_create	.dynsym	0x7d5d70	10	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_ctrl	.dynsym	0x7d5d50	10	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_destroy	.dynsym	0x7d5d90	10	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_gets	.dynsym	0x7d5d30	10	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_puts	.dynsym	0x7d5d10	10	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_read	.dynsym	0x7d5cc0	21	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_read_ex	.dynsym	0x7d5ce0	18	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_write	.dynsym	0x7d5c60	21	FUNC	<unknown>	DEFAULT	14
BIO_meth_set_write_ex	.dynsym	0x7d5c80	18	FUNC	<unknown>	DEFAULT	14
BIO_method_name	.dynsym	0x7d4690	8	FUNC	<unknown>	DEFAULT	14
BIO_method_type	.dynsym	0x7d46a0	6	FUNC	<unknown>	DEFAULT	14
BIO_new	.dynsym	0x7d4330	340	FUNC	<unknown>	DEFAULT	14
BIO_new_file	.dynsym	0x7d6350	317	FUNC	<unknown>	DEFAULT	14
BIO_new_fp	.dynsym	0x7d6490	67	FUNC	<unknown>	DEFAULT	14
BIO_new_mem_buf	.dynsym	0x7d6d60	146	FUNC	<unknown>	DEFAULT	14
BIO_new_socket	.dynsym	0x7d6f90	57	FUNC	<unknown>	DEFAULT	14
BIO_next	.dynsym	0x7d5830	19	FUNC	<unknown>	DEFAULT	14
BIO_number_read	.dynsym	0x7d59f0	13	FUNC	<unknown>	DEFAULT	14
BIO_number_written	.dynsym	0x7d5a00	13	FUNC	<unknown>	DEFAULT	14
BIO_parse_hostserv	.dynsym	0x7ceed0	613	FUNC	<unknown>	DEFAULT	14
BIO_pop	.dynsym	0x7d56f0	100	FUNC	<unknown>	DEFAULT	14
BIO_printf	.dynsym	0x7d1730	143	FUNC	<unknown>	DEFAULT	14
BIO_ptr_ctrl	.dynsym	0x7d54e0	52	FUNC	<unknown>	DEFAULT	14
BIO_push	.dynsym	0x7d56a0	68	FUNC	<unknown>	DEFAULT	14
BIO_puts	.dynsym	0x7d4eb0	520	FUNC	<unknown>	DEFAULT	14
BIO_read	.dynsym	0x7d46b0	537	FUNC	<unknown>	DEFAULT	14
BIO_read_ex	.dynsym	0x7d48d0	520	FUNC	<unknown>	DEFAULT	14
BIO_s_file	.dynsym	0x7d6340	8	FUNC	<unknown>	DEFAULT	14
BIO_s_mem	.dynsym	0x7d6d40	8	FUNC	<unknown>	DEFAULT	14
BIO_s_null	.dynsym	0x87bae0	8	FUNC	<unknown>	DEFAULT	14
BIO_s_secmem	.dynsym	0x7d6d50	8	FUNC	<unknown>	DEFAULT	14
BIO_s_socket	.dynsym	0x7d6f80	8	FUNC	<unknown>	DEFAULT	14
BIO_set_callback	.dynsym	0x7d4640	5	FUNC	<unknown>	DEFAULT	14
BIO_set_callback_arg	.dynsym	0x7d4670	5	FUNC	<unknown>	DEFAULT	14
BIO_set_callback_ex	.dynsym	0x7d4660	5	FUNC	<unknown>	DEFAULT	14
BIO_set_cipher	.dynsym	0x8ac6f0	263	FUNC	<unknown>	DEFAULT	14
BIO_set_data	.dynsym	0x7d4570	5	FUNC	<unknown>	DEFAULT	14
BIO_set_ex_data	.dynsym	0x7d59d0	9	FUNC	<unknown>	DEFAULT	14
BIO_set_flags	.dynsym	0x7d4620	4	FUNC	<unknown>	DEFAULT	14
BIO_set_init	.dynsym	0x7d4590	4	FUNC	<unknown>	DEFAULT	14
BIO_set_next	.dynsym	0x7d5850	5	FUNC	<unknown>	DEFAULT	14
BIO_set_retry_reason	.dynsym	0x7d57c0	4	FUNC	<unknown>	DEFAULT	14
BIO_set_shutdown	.dynsym	0x7d45b0	4	FUNC	<unknown>	DEFAULT	14
BIO_set_tcp_ndelay	.dynsym	0x7d2a80	47	FUNC	<unknown>	DEFAULT	14
BIO_snprintf	.dynsym	0x7d2430	138	FUNC	<unknown>	DEFAULT	14
BIO_sock_error	.dynsym	0x7d24c0	76	FUNC	<unknown>	DEFAULT	14
BIO_sock_info	.dynsym	0x7d2ae0	208	FUNC	<unknown>	DEFAULT	14
BIO_sock_init	.dynsym	0x7d2520	6	FUNC	<unknown>	DEFAULT	14
BIO_sock_non_fatal_error	.dynsym	0x7d6fd0	45	FUNC	<unknown>	DEFAULT	14
BIO_sock_should_retry	.dynsym	0x7d7000	36	FUNC	<unknown>	DEFAULT	14
BIO_socket	.dynsym	0x7d2bb0	130	FUNC	<unknown>	DEFAULT	14
BIO_socket_ioctl	.dynsym	0x7d2770	60	FUNC	<unknown>	DEFAULT	14
BIO_socket_nbio	.dynsym	0x7d2ab0	36	FUNC	<unknown>	DEFAULT	14
BIO_test_flags	.dynsym	0x7d4610	6	FUNC	<unknown>	DEFAULT	14
BIO_up_ref	.dynsym	0x7d45e0	19	FUNC	<unknown>	DEFAULT	14
BIO_vfree	.dynsym	0x7d45d0	5	FUNC	<unknown>	DEFAULT	14
BIO_vprintf	.dynsym	0x7d0920	3587	FUNC	<unknown>	DEFAULT	14
BIO_vsnprintf	.dynsym	0x7d17c0	3179	FUNC	<unknown>	DEFAULT	14
BIO_write	.dynsym	0x7d4ae0	475	FUNC	<unknown>	DEFAULT	14
BIO_write_ex	.dynsym	0x7d4cc0	492	FUNC	<unknown>	DEFAULT	14
BLAKE2b_Final	.dynsym	0x8dc5c0	151	FUNC	<unknown>	DEFAULT	14
BLAKE2b_Init	.dynsym	0x8dc3d0	286	FUNC	<unknown>	DEFAULT	14
BLAKE2b_Update	.dynsym	0x8dc4f0	205	FUNC	<unknown>	DEFAULT	14
BLAKE2s_Final	.dynsym	0x8dd940	169	FUNC	<unknown>	DEFAULT	14
BLAKE2s_Init	.dynsym	0x8dd800	119	FUNC	<unknown>	DEFAULT	14
BLAKE2s_Update	.dynsym	0x8dd880	179	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_convert	.dynsym	0x880a90	13	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_convert_ex	.dynsym	0x8809b0	220	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_create_param	.dynsym	0x880630	501	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_free	.dynsym	0x880330	82	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_get_flags	.dynsym	0x880610	5	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_invert	.dynsym	0x880470	13	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_invert_ex	.dynsym	0x880390	211	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_is_current_thread	.dynsym	0x880480	22	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_lock	.dynsym	0x8805f0	9	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_new	.dynsym	0x8804b0	310	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_set_current_thread	.dynsym	0x8804a0	15	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_set_flags	.dynsym	0x880620	5	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_unlock	.dynsym	0x880600	9	FUNC	<unknown>	DEFAULT	14
BN_BLINDING_update	.dynsym	0x880830	371	FUNC	<unknown>	DEFAULT	14
BN_CTX_end	.dynsym	0x880d10	141	FUNC	<unknown>	DEFAULT	14
BN_CTX_free	.dynsym	0x880b40	172	FUNC	<unknown>	DEFAULT	14
BN_CTX_get	.dynsym	0x880da0	429	FUNC	<unknown>	DEFAULT	14
BN_CTX_new	.dynsym	0x880aa0	122	FUNC	<unknown>	DEFAULT	14
BN_CTX_secure_new	.dynsym	0x880b20	26	FUNC	<unknown>	DEFAULT	14
BN_CTX_start	.dynsym	0x880bf0	276	FUNC	<unknown>	DEFAULT	14
BN_GENCB_call	.dynsym	0x886fa0	83	FUNC	<unknown>	DEFAULT	14
BN_GENCB_free	.dynsym	0x7d7db0	26	FUNC	<unknown>	DEFAULT	14
BN_GENCB_get_arg	.dynsym	0x7d80f0	5	FUNC	<unknown>	DEFAULT	14
BN_GENCB_new	.dynsym	0x7d7d50	82	FUNC	<unknown>	DEFAULT	14
BN_GENCB_set	.dynsym	0x7d80e0	15	FUNC	<unknown>	DEFAULT	14
BN_GENCB_set_old	.dynsym	0x7d80d0	15	FUNC	<unknown>	DEFAULT	14
BN_GF2m_add	.dynsym	0x8cd380	639	FUNC	<unknown>	DEFAULT	14
BN_GF2m_arr2poly	.dynsym	0x8d1050	92	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod	.dynsym	0x8d04d0	113	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_arr	.dynsym	0x8cd600	918	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_div	.dynsym	0x8d0cc0	134	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_div_arr	.dynsym	0x8d1120	120	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_exp	.dynsym	0x8d0e10	192	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_exp_arr	.dynsym	0x8cfe80	343	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_inv	.dynsym	0x8d0610	1699	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_inv_arr	.dynsym	0x8d10b0	101	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_mul	.dynsym	0x8d0550	192	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_mul_arr	.dynsym	0x8ceca0	4571	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_solve_quad	.dynsym	0x8d0f90	192	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_solve_quad_arr	.dynsym	0x8d0080	927	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_sqr	.dynsym	0x8d0d50	192	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_sqr_arr	.dynsym	0x8cd9a0	4856	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_sqrt	.dynsym	0x8d0ed0	192	FUNC	<unknown>	DEFAULT	14
BN_GF2m_mod_sqrt_arr	.dynsym	0x8cffe0	152	FUNC	<unknown>	DEFAULT	14
BN_GF2m_poly2arr	.dynsym	0x8d0420	175	FUNC	<unknown>	DEFAULT	14
BN_MONT_CTX_copy	.dynsym	0x7d9280	108	FUNC	<unknown>	DEFAULT	14
BN_MONT_CTX_free	.dynsym	0x7d8f70	74	FUNC	<unknown>	DEFAULT	14
BN_MONT_CTX_init	.dynsym	0x7d8ee0	62	FUNC	<unknown>	DEFAULT	14
BN_MONT_CTX_new	.dynsym	0x7d8f20	80	FUNC	<unknown>	DEFAULT	14
BN_MONT_CTX_set	.dynsym	0x7d8fc0	702	FUNC	<unknown>	DEFAULT	14
BN_MONT_CTX_set_locked	.dynsym	0x7d92f0	170	FUNC	<unknown>	DEFAULT	14
BN_RECP_CTX_free	.dynsym	0x889980	58	FUNC	<unknown>	DEFAULT	14
BN_RECP_CTX_init	.dynsym	0x8898f0	38	FUNC	<unknown>	DEFAULT	14
BN_RECP_CTX_new	.dynsym	0x889920	96	FUNC	<unknown>	DEFAULT	14
BN_RECP_CTX_set	.dynsym	0x8899c0	67	FUNC	<unknown>	DEFAULT	14
BN_abs_is_word	.dynsym	0x7d7a60	47	FUNC	<unknown>	DEFAULT	14
BN_add	.dynsym	0x87bcf0	170	FUNC	<unknown>	DEFAULT	14
BN_add_word	.dynsym	0x7db380	245	FUNC	<unknown>	DEFAULT	14
BN_asc2bn	.dynsym	0x8886d0	142	FUNC	<unknown>	DEFAULT	14
BN_bin2bn	.dynsym	0x7d8300	314	FUNC	<unknown>	DEFAULT	14
BN_bn2bin	.dynsym	0x7d7b90	186	FUNC	<unknown>	DEFAULT	14
BN_bn2binpad	.dynsym	0x7d8640	288	FUNC	<unknown>	DEFAULT	14
BN_bn2dec	.dynsym	0x888060	596	FUNC	<unknown>	DEFAULT	14
BN_bn2hex	.dynsym	0x887da0	698	FUNC	<unknown>	DEFAULT	14
BN_bn2lebinpad	.dynsym	0x7d8760	286	FUNC	<unknown>	DEFAULT	14
BN_bntest_rand	.dynsym	0x889320	121	FUNC	<unknown>	DEFAULT	14
BN_clear	.dynsym	0x7d7500	50	FUNC	<unknown>	DEFAULT	14
BN_clear_bit	.dynsym	0x7d8580	66	FUNC	<unknown>	DEFAULT	14
BN_clear_free	.dynsym	0x7d7df0	143	FUNC	<unknown>	DEFAULT	14
BN_cmp	.dynsym	0x7d75e0	176	FUNC	<unknown>	DEFAULT	14
BN_consttime_swap	.dynsym	0x7d77f0	458	FUNC	<unknown>	DEFAULT	14
BN_copy	.dynsym	0x7d8120	116	FUNC	<unknown>	DEFAULT	14
BN_dec2bn	.dynsym	0x8884f0	466	FUNC	<unknown>	DEFAULT	14
BN_div	.dynsym	0x881530	237	FUNC	<unknown>	DEFAULT	14
BN_div_recp	.dynsym	0x889a90	600	FUNC	<unknown>	DEFAULT	14
BN_div_word	.dynsym	0x7db080	284	FUNC	<unknown>	DEFAULT	14
BN_dup	.dynsym	0x7d81a0	108	FUNC	<unknown>	DEFAULT	14
BN_exp	.dynsym	0x881ca0	443	FUNC	<unknown>	DEFAULT	14
BN_free	.dynsym	0x7d8040	139	FUNC	<unknown>	DEFAULT	14
BN_from_montgomery	.dynsym	0x7d8e90	33	FUNC	<unknown>	DEFAULT	14
BN_gcd	.dynsym	0x884b50	773	FUNC	<unknown>	DEFAULT	14
BN_generate_dsa_nonce	.dynsym	0x889660	654	FUNC	<unknown>	DEFAULT	14
BN_generate_prime_ex	.dynsym	0x8874b0	2266	FUNC	<unknown>	DEFAULT	14
BN_get0_nist_prime_192	.dynsym	0x886eb0	8	FUNC	<unknown>	DEFAULT	14
BN_get0_nist_prime_224	.dynsym	0x886ec0	8	FUNC	<unknown>	DEFAULT	14
BN_get0_nist_prime_256	.dynsym	0x886ed0	8	FUNC	<unknown>	DEFAULT	14
BN_get0_nist_prime_384	.dynsym	0x886ee0	8	FUNC	<unknown>	DEFAULT	14
BN_get0_nist_prime_521	.dynsym	0x886ef0	8	FUNC	<unknown>	DEFAULT	14
BN_get_flags	.dynsym	0x7d7de0	6	FUNC	<unknown>	DEFAULT	14
BN_get_params	.dynsym	0x7d72e0	71	FUNC	<unknown>	DEFAULT	14
BN_get_rfc2409_prime_1024	.dynsym	0x7d71a0	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc2409_prime_768	.dynsym	0x7d7180	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc3526_prime_1536	.dynsym	0x7d71c0	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc3526_prime_2048	.dynsym	0x7d71e0	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc3526_prime_3072	.dynsym	0x7d7200	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc3526_prime_4096	.dynsym	0x7d7220	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc3526_prime_6144	.dynsym	0x7d7240	20	FUNC	<unknown>	DEFAULT	14
BN_get_rfc3526_prime_8192	.dynsym	0x7d7260	20	FUNC	<unknown>	DEFAULT	14
BN_get_word	.dynsym	0x7d7540	39	FUNC	<unknown>	DEFAULT	14
BN_hex2bn	.dynsym	0x8882c0	549	FUNC	<unknown>	DEFAULT	14
BN_is_bit_set	.dynsym	0x7d7690	36	FUNC	<unknown>	DEFAULT	14
BN_is_negative	.dynsym	0x7d7cf0	11	FUNC	<unknown>	DEFAULT	14
BN_is_odd	.dynsym	0x7d7cd0	20	FUNC	<unknown>	DEFAULT	14
BN_is_one	.dynsym	0x7d7c80	30	FUNC	<unknown>	DEFAULT	14
BN_is_prime_ex	.dynsym	0x887d90	10	FUNC	<unknown>	DEFAULT	14
BN_is_prime_fasttest_ex	.dynsym	0x887000	1186	FUNC	<unknown>	DEFAULT	14
BN_is_word	.dynsym	0x7d7ca0	48	FUNC	<unknown>	DEFAULT	14
BN_is_zero	.dynsym	0x7d7a90	11	FUNC	<unknown>	DEFAULT	14
BN_kronecker	.dynsym	0x885230	601	FUNC	<unknown>	DEFAULT	14
BN_lebin2bn	.dynsym	0x7d8440	320	FUNC	<unknown>	DEFAULT	14
BN_lshift	.dynsym	0x7daa00	81	FUNC	<unknown>	DEFAULT	14
BN_lshift1	.dynsym	0x7da6d0	201	FUNC	<unknown>	DEFAULT	14
BN_mask_bits	.dynsym	0x7d85d0	106	FUNC	<unknown>	DEFAULT	14
BN_mod_add	.dynsym	0x885500	53	FUNC	<unknown>	DEFAULT	14
BN_mod_add_quick	.dynsym	0x885760	39	FUNC	<unknown>	DEFAULT	14
BN_mod_exp	.dynsym	0x883400	197	FUNC	<unknown>	DEFAULT	14
BN_mod_exp2_mont	.dynsym	0x8838e0	1920	FUNC	<unknown>	DEFAULT	14
BN_mod_exp_mont	.dynsym	0x8828f0	1667	FUNC	<unknown>	DEFAULT	14
BN_mod_exp_mont_consttime	.dynsym	0x881f00	2538	FUNC	<unknown>	DEFAULT	14
BN_mod_exp_mont_word	.dynsym	0x882f80	1144	FUNC	<unknown>	DEFAULT	14
BN_mod_exp_recp	.dynsym	0x881e60	149	FUNC	<unknown>	DEFAULT	14
BN_mod_exp_simple	.dynsym	0x8834d0	1029	FUNC	<unknown>	DEFAULT	14
BN_mod_inverse	.dynsym	0x884aa0	176	FUNC	<unknown>	DEFAULT	14
BN_mod_lshift	.dynsym	0x885c80	140	FUNC	<unknown>	DEFAULT	14
BN_mod_lshift1	.dynsym	0x885ae0	53	FUNC	<unknown>	DEFAULT	14
BN_mod_lshift1_quick	.dynsym	0x885b20	84	FUNC	<unknown>	DEFAULT	14
BN_mod_lshift_quick	.dynsym	0x885b80	251	FUNC	<unknown>	DEFAULT	14
BN_mod_mul	.dynsym	0x8859f0	163	FUNC	<unknown>	DEFAULT	14
BN_mod_mul_montgomery	.dynsym	0x7d8df0	33	FUNC	<unknown>	DEFAULT	14
BN_mod_mul_reciprocal	.dynsym	0x889cf0	173	FUNC	<unknown>	DEFAULT	14
BN_mod_sqr	.dynsym	0x885aa0	55	FUNC	<unknown>	DEFAULT	14
BN_mod_sqrt	.dynsym	0x889da0	2054	FUNC	<unknown>	DEFAULT	14
BN_mod_sub	.dynsym	0x885790	53	FUNC	<unknown>	DEFAULT	14
BN_mod_sub_quick	.dynsym	0x8859a0	68	FUNC	<unknown>	DEFAULT	14
BN_mod_word	.dynsym	0x7db1a0	220	FUNC	<unknown>	DEFAULT	14
BN_mul	.dynsym	0x7da4a0	33	FUNC	<unknown>	DEFAULT	14
BN_mul_word	.dynsym	0x7db480	139	FUNC	<unknown>	DEFAULT	14
BN_new	.dynsym	0x7d7420	90	FUNC	<unknown>	DEFAULT	14
BN_nist_mod_192	.dynsym	0x885d10	648	FUNC	<unknown>	DEFAULT	14
BN_nist_mod_224	.dynsym	0x885fa0	1007	FUNC	<unknown>	DEFAULT	14
BN_nist_mod_256	.dynsym	0x886390	906	FUNC	<unknown>	DEFAULT	14
BN_nist_mod_384	.dynsym	0x886720	1056	FUNC	<unknown>	DEFAULT	14
BN_nist_mod_521	.dynsym	0x886b40	880	FUNC	<unknown>	DEFAULT	14
BN_nist_mod_func	.dynsym	0x886f00	160	FUNC	<unknown>	DEFAULT	14
BN_nnmod	.dynsym	0x885490	105	FUNC	<unknown>	DEFAULT	14
BN_num_bits	.dynsym	0x7d7aa0	231	FUNC	<unknown>	DEFAULT	14
BN_num_bits_word	.dynsym	0x7d7340	189	FUNC	<unknown>	DEFAULT	14
BN_options	.dynsym	0x888ce0	87	FUNC	<unknown>	DEFAULT	14
BN_print	.dynsym	0x888760	1305	FUNC	<unknown>	DEFAULT	14
BN_print_fp	.dynsym	0x888c80	91	FUNC	<unknown>	DEFAULT	14
BN_priv_rand	.dynsym	0x8893a0	442	FUNC	<unknown>	DEFAULT	14
BN_priv_rand_range	.dynsym	0x8895d0	102	FUNC	<unknown>	DEFAULT	14
BN_pseudo_rand	.dynsym	0x889640	5	FUNC	<unknown>	DEFAULT	14
BN_pseudo_rand_range	.dynsym	0x889650	5	FUNC	<unknown>	DEFAULT	14
BN_rand	.dynsym	0x889160	442	FUNC	<unknown>	DEFAULT	14
BN_rand_range	.dynsym	0x889560	99	FUNC	<unknown>	DEFAULT	14
BN_reciprocal	.dynsym	0x889a10	120	FUNC	<unknown>	DEFAULT	14
BN_rshift	.dynsym	0x7dab70	81	FUNC	<unknown>	DEFAULT	14
BN_rshift1	.dynsym	0x7da7a0	252	FUNC	<unknown>	DEFAULT	14
BN_secure_new	.dynsym	0x7d7480	23	FUNC	<unknown>	DEFAULT	14
BN_security_bits	.dynsym	0x7d79c0	135	FUNC	<unknown>	DEFAULT	14
BN_set_bit	.dynsym	0x7d8210	163	FUNC	<unknown>	DEFAULT	14
BN_set_flags	.dynsym	0x7d7dd0	4	FUNC	<unknown>	DEFAULT	14
BN_set_negative	.dynsym	0x7d7c50	34	FUNC	<unknown>	DEFAULT	14
BN_set_params	.dynsym	0x7d7280	86	FUNC	<unknown>	DEFAULT	14
BN_set_word	.dynsym	0x7d7fe0	86	FUNC	<unknown>	DEFAULT	14
BN_sqr	.dynsym	0x7db050	33	FUNC	<unknown>	DEFAULT	14
BN_sub	.dynsym	0x87bda0	168	FUNC	<unknown>	DEFAULT	14
BN_sub_word	.dynsym	0x7db280	255	FUNC	<unknown>	DEFAULT	14
BN_swap	.dynsym	0x7d74a0	94	FUNC	<unknown>	DEFAULT	14
BN_to_ASN1_ENUMERATED	.dynsym	0x7c3660	331	FUNC	<unknown>	DEFAULT	14
BN_to_ASN1_INTEGER	.dynsym	0x7c3170	331	FUNC	<unknown>	DEFAULT	14
BN_to_montgomery	.dynsym	0x7d7d00	18	FUNC	<unknown>	DEFAULT	14
BN_uadd	.dynsym	0x87baf0	220	FUNC	<unknown>	DEFAULT	14
BN_ucmp	.dynsym	0x7d7570	108	FUNC	<unknown>	DEFAULT	14
BN_usub	.dynsym	0x87bbd0	282	FUNC	<unknown>	DEFAULT	14
BN_value_one	.dynsym	0x7d7330	8	FUNC	<unknown>	DEFAULT	14
BN_with_flags	.dynsym	0x7d7d20	47	FUNC	<unknown>	DEFAULT	14
BN_zero_ex	.dynsym	0x7d7a50	15	FUNC	<unknown>	DEFAULT	14
BUF_MEM_free	.dynsym	0x7db590	82	FUNC	<unknown>	DEFAULT	14
BUF_MEM_grow	.dynsym	0x7db5f0	310	FUNC	<unknown>	DEFAULT	14
BUF_MEM_grow_clean	.dynsym	0x7db730	363	FUNC	<unknown>	DEFAULT	14
BUF_MEM_new	.dynsym	0x7db510	82	FUNC	<unknown>	DEFAULT	14
BUF_MEM_new_ex	.dynsym	0x7db570	20	FUNC	<unknown>	DEFAULT	14
BUF_reverse	.dynsym	0x7db8a0	92	FUNC	<unknown>	DEFAULT	14
CAST_S_table0	.dynsym	0xaf9fe0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table1	.dynsym	0xaf9be0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table2	.dynsym	0xaf97e0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table3	.dynsym	0xaf93e0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table4	.dynsym	0xaf8fe0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table5	.dynsym	0xaf8be0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table6	.dynsym	0xaf87e0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_S_table7	.dynsym	0xaf83e0	1024	OBJECT	<unknown>	DEFAULT	16
CAST_cbc_encrypt	.dynsym	0x8d31d0	1291	FUNC	<unknown>	DEFAULT	14
CAST_cfb64_encrypt	.dynsym	0x8d2840	433	FUNC	<unknown>	DEFAULT	14
CAST_decrypt	.dynsym	0x8d2e00	961	FUNC	<unknown>	DEFAULT	14
CAST_ecb_encrypt	.dynsym	0x8d2a00	111	FUNC	<unknown>	DEFAULT	14
CAST_encrypt	.dynsym	0x8d2a70	897	FUNC	<unknown>	DEFAULT	14
CAST_ofb64_encrypt	.dynsym	0x8d36e0	397	FUNC	<unknown>	DEFAULT	14
CAST_set_key	.dynsym	0x8d3870	3439	FUNC	<unknown>	DEFAULT	14
CBIGNUM_it	.dynsym	0xe43440	56	OBJECT	<unknown>	DEFAULT	23
CERTIFICATEPOLICIES_free	.dynsym	0x861c60	12	FUNC	<unknown>	DEFAULT	14
CERTIFICATEPOLICIES_it	.dynsym	0xe427e0	56	OBJECT	<unknown>	DEFAULT	23
CERTIFICATEPOLICIES_new	.dynsym	0x861c50	12	FUNC	<unknown>	DEFAULT	14
CMAC_CTX_cleanup	.dynsym	0x7db9b0	80	FUNC	<unknown>	DEFAULT	14
CMAC_CTX_copy	.dynsym	0x7dba50	154	FUNC	<unknown>	DEFAULT	14
CMAC_CTX_free	.dynsym	0x7dba10	50	FUNC	<unknown>	DEFAULT	14
CMAC_CTX_get0_cipher_ctx	.dynsym	0x7dba00	4	FUNC	<unknown>	DEFAULT	14
CMAC_CTX_new	.dynsym	0x7db930	117	FUNC	<unknown>	DEFAULT	14
CMAC_Final	.dynsym	0x7dbe90	1591	FUNC	<unknown>	DEFAULT	14
CMAC_Init	.dynsym	0x7dbaf0	593	FUNC	<unknown>	DEFAULT	14
CMAC_Update	.dynsym	0x7dbd50	319	FUNC	<unknown>	DEFAULT	14
CMAC_resume	.dynsym	0x7dc4d0	35	FUNC	<unknown>	DEFAULT	14
CONF_dump_bio	.dynsym	0x88b6b0	41	FUNC	<unknown>	DEFAULT	14
CONF_dump_fp	.dynsym	0x88b6e0	105	FUNC	<unknown>	DEFAULT	14
CONF_free	.dynsym	0x88b080	33	FUNC	<unknown>	DEFAULT	14
CONF_get1_default_config_file	.dynsym	0x7dce20	144	FUNC	<unknown>	DEFAULT	14
CONF_get_number	.dynsym	0x88b5e0	134	FUNC	<unknown>	DEFAULT	14
CONF_get_section	.dynsym	0x88b340	51	FUNC	<unknown>	DEFAULT	14
CONF_get_string	.dynsym	0x88b430	76	FUNC	<unknown>	DEFAULT	14
CONF_imodule_get_flags	.dynsym	0x7dcde0	5	FUNC	<unknown>	DEFAULT	14
CONF_imodule_get_module	.dynsym	0x7dcdd0	4	FUNC	<unknown>	DEFAULT	14
CONF_imodule_get_name	.dynsym	0x7dcd90	5	FUNC	<unknown>	DEFAULT	14
CONF_imodule_get_usr_data	.dynsym	0x7dcdb0	5	FUNC	<unknown>	DEFAULT	14
CONF_imodule_get_value	.dynsym	0x7dcda0	5	FUNC	<unknown>	DEFAULT	14
CONF_imodule_set_flags	.dynsym	0x7dcdf0	5	FUNC	<unknown>	DEFAULT	14
CONF_imodule_set_usr_data	.dynsym	0x7dcdc0	5	FUNC	<unknown>	DEFAULT	14
CONF_load	.dynsym	0x88b180	106	FUNC	<unknown>	DEFAULT	14
CONF_load_bio	.dynsym	0x88b130	68	FUNC	<unknown>	DEFAULT	14
CONF_load_fp	.dynsym	0x88b1f0	98	FUNC	<unknown>	DEFAULT	14
CONF_module_add	.dynsym	0x7dcc50	288	FUNC	<unknown>	DEFAULT	14
CONF_module_get_usr_data	.dynsym	0x7dce00	5	FUNC	<unknown>	DEFAULT	14
CONF_module_set_usr_data	.dynsym	0x7dce10	5	FUNC	<unknown>	DEFAULT	14
CONF_modules_finish	.dynsym	0x7dcaa0	151	FUNC	<unknown>	DEFAULT	14
CONF_modules_load	.dynsym	0x7dc500	1431	FUNC	<unknown>	DEFAULT	14
CONF_modules_load_file	.dynsym	0x7dceb0	226	FUNC	<unknown>	DEFAULT	14
CONF_modules_unload	.dynsym	0x7dcb40	267	FUNC	<unknown>	DEFAULT	14
CONF_parse_list	.dynsym	0x7dcfa0	375	FUNC	<unknown>	DEFAULT	14
CONF_set_default_method	.dynsym	0x88afd0	13	FUNC	<unknown>	DEFAULT	14
CONF_set_nconf	.dynsym	0x88af90	62	FUNC	<unknown>	DEFAULT	14
CRL_DIST_POINTS_free	.dynsym	0x863600	12	FUNC	<unknown>	DEFAULT	14
CRL_DIST_POINTS_it	.dynsym	0xe42860	56	OBJECT	<unknown>	DEFAULT	23
CRL_DIST_POINTS_new	.dynsym	0x8635f0	12	FUNC	<unknown>	DEFAULT	14
CRYPTO_128_unwrap	.dynsym	0x81e820	115	FUNC	<unknown>	DEFAULT	14
CRYPTO_128_unwrap_pad	.dynsym	0x81e9b0	338	FUNC	<unknown>	DEFAULT	14
CRYPTO_128_wrap	.dynsym	0x81e6c0	347	FUNC	<unknown>	DEFAULT	14
CRYPTO_128_wrap_pad	.dynsym	0x81e8a0	267	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_cleanup_local	.dynsym	0x848e50	24	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_compare_id	.dynsym	0x848e80	9	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_get_current_id	.dynsym	0x848e70	5	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_get_local	.dynsym	0x848e20	7	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_init_local	.dynsym	0x848e00	22	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_lock_free	.dynsym	0x848db0	34	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_lock_new	.dynsym	0x848d00	69	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_read_lock	.dynsym	0x848d50	22	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_run_once	.dynsym	0x848de0	22	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_set_local	.dynsym	0x848e30	24	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_unlock	.dynsym	0x848d90	22	FUNC	<unknown>	DEFAULT	14
CRYPTO_THREAD_write_lock	.dynsym	0x848d70	22	FUNC	<unknown>	DEFAULT	14
CRYPTO_atomic_add	.dynsym	0x848e90	16	FUNC	<unknown>	DEFAULT	14
CRYPTO_cbc128_decrypt	.dynsym	0x817480	888	FUNC	<unknown>	DEFAULT	14
CRYPTO_cbc128_encrypt	.dynsym	0x817250	560	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_aad	.dynsym	0x817960	396	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_decrypt	.dynsym	0x818120	1243	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_decrypt_ccm64	.dynsym	0x818d30	1550	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_encrypt	.dynsym	0x817af0	1570	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_encrypt_ccm64	.dynsym	0x818600	1839	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_init	.dynsym	0x817800	44	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_setiv	.dynsym	0x817830	302	FUNC	<unknown>	DEFAULT	14
CRYPTO_ccm128_tag	.dynsym	0x819340	158	FUNC	<unknown>	DEFAULT	14
CRYPTO_cfb128_1_encrypt	.dynsym	0x819a60	578	FUNC	<unknown>	DEFAULT	14
CRYPTO_cfb128_8_encrypt	.dynsym	0x819cb0	194	FUNC	<unknown>	DEFAULT	14
CRYPTO_cfb128_encrypt	.dynsym	0x8193e0	1650	FUNC	<unknown>	DEFAULT	14
CRYPTO_clear_free	.dynsym	0x815950	66	FUNC	<unknown>	DEFAULT	14
CRYPTO_clear_realloc	.dynsym	0x8159a0	176	FUNC	<unknown>	DEFAULT	14
CRYPTO_ctr128_encrypt	.dynsym	0x819d80	1083	FUNC	<unknown>	DEFAULT	14
CRYPTO_ctr128_encrypt_ctr32	.dynsym	0x81a1c0	1166	FUNC	<unknown>	DEFAULT	14
CRYPTO_dup_ex_data	.dynsym	0x80eee0	678	FUNC	<unknown>	DEFAULT	14
CRYPTO_free	.dynsym	0x8157c0	37	FUNC	<unknown>	DEFAULT	14
CRYPTO_free_ex_data	.dynsym	0x80f190	610	FUNC	<unknown>	DEFAULT	14
CRYPTO_free_ex_index	.dynsym	0x80e880	287	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_aad	.dynsym	0x81af10	537	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_decrypt	.dynsym	0x81b740	1555	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_decrypt_ctr32	.dynsym	0x81c260	1282	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_encrypt	.dynsym	0x81b130	1544	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_encrypt_ctr32	.dynsym	0x81bd60	1276	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_finish	.dynsym	0x81c770	396	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_init	.dynsym	0x81a930	577	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_new	.dynsym	0x81c9c0	67	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_release	.dynsym	0x81ca10	19	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_setiv	.dynsym	0x81ab80	898	FUNC	<unknown>	DEFAULT	14
CRYPTO_gcm128_tag	.dynsym	0x81c900	190	FUNC	<unknown>	DEFAULT	14
CRYPTO_get_ex_data	.dynsym	0x80ec60	57	FUNC	<unknown>	DEFAULT	14
CRYPTO_get_ex_new_index	.dynsym	0x80e9a0	505	FUNC	<unknown>	DEFAULT	14
CRYPTO_get_mem_functions	.dynsym	0x8158f0	47	FUNC	<unknown>	DEFAULT	14
CRYPTO_malloc	.dynsym	0x8157f0	67	FUNC	<unknown>	DEFAULT	14
CRYPTO_mem_ctrl	.dynsym	0x8b38f0	3	FUNC	<unknown>	DEFAULT	14
CRYPTO_memcmp	.dynsym	0x7dd6d0	51	FUNC	<unknown>	DEFAULT	14
CRYPTO_memdup	.dynsym	0x81f2b0	115	FUNC	<unknown>	DEFAULT	14
CRYPTO_new_ex_data	.dynsym	0x80eca0	564	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_aad	.dynsym	0x81d7c0	498	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_cleanup	.dynsym	0x81e260	58	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_copy_ctx	.dynsym	0x81d390	265	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_decrypt	.dynsym	0x81dd80	975	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_encrypt	.dynsym	0x81d9c0	953	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_finish	.dynsym	0x81e150	125	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_init	.dynsym	0x81cc20	1762	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_new	.dynsym	0x81d310	125	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_setiv	.dynsym	0x81d4a0	798	FUNC	<unknown>	DEFAULT	14
CRYPTO_ocb128_tag	.dynsym	0x81e1d0	130	FUNC	<unknown>	DEFAULT	14
CRYPTO_ofb128_encrypt	.dynsym	0x81e2a0	641	FUNC	<unknown>	DEFAULT	14
CRYPTO_realloc	.dynsym	0x815840	90	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_actual_size	.dynsym	0x817220	44	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_allocated	.dynsym	0x817080	97	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_clear_free	.dynsym	0x817170	154	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_free	.dynsym	0x8170f0	122	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_malloc	.dynsym	0x816a00	1632	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_malloc_done	.dynsym	0x816920	199	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_malloc_init	.dynsym	0x8164e0	1074	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_malloc_initialized	.dynsym	0x8169f0	7	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_used	.dynsym	0x817210	8	FUNC	<unknown>	DEFAULT	14
CRYPTO_secure_zalloc	.dynsym	0x817060	21	FUNC	<unknown>	DEFAULT	14
CRYPTO_set_ex_data	.dynsym	0x80eba0	183	FUNC	<unknown>	DEFAULT	14
CRYPTO_set_mem_debug	.dynsym	0x8158e0	14	FUNC	<unknown>	DEFAULT	14
CRYPTO_set_mem_functions	.dynsym	0x8158a0	53	FUNC	<unknown>	DEFAULT	14
CRYPTO_strdup	.dynsym	0x81f260	78	FUNC	<unknown>	DEFAULT	14
CRYPTO_strndup	.dynsym	0x81f370	102	FUNC	<unknown>	DEFAULT	14
CRYPTO_xts128_encrypt	.dynsym	0x81eb10	1415	FUNC	<unknown>	DEFAULT	14
CRYPTO_zalloc	.dynsym	0x815920	38	FUNC	<unknown>	DEFAULT	14
CTLOG_STORE_free	.dynsym	0x7dd950	50	FUNC	<unknown>	DEFAULT	14
CTLOG_STORE_get0_log_by_id	.dynsym	0x7ddc70	87	FUNC	<unknown>	DEFAULT	14
CTLOG_STORE_load_default_file	.dynsym	0x7ddad0	42	FUNC	<unknown>	DEFAULT	14
CTLOG_STORE_load_file	.dynsym	0x7dd990	318	FUNC	<unknown>	DEFAULT	14
CTLOG_STORE_new	.dynsym	0x7dd8e0	101	FUNC	<unknown>	DEFAULT	14
CTLOG_free	.dynsym	0x7dd740	58	FUNC	<unknown>	DEFAULT	14
CTLOG_get0_log_id	.dynsym	0x7ddc50	15	FUNC	<unknown>	DEFAULT	14
CTLOG_get0_name	.dynsym	0x7ddc40	4	FUNC	<unknown>	DEFAULT	14
CTLOG_get0_public_key	.dynsym	0x7ddc60	5	FUNC	<unknown>	DEFAULT	14
CTLOG_new	.dynsym	0x7ddb00	312	FUNC	<unknown>	DEFAULT	14
CTLOG_new_from_base64	.dynsym	0x88bc40	452	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_free	.dynsym	0x7de840	50	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_get0_cert	.dynsym	0x7de900	4	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_get0_issuer	.dynsym	0x7de910	5	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_get0_log_store	.dynsym	0x7de920	5	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_get_time	.dynsym	0x7de930	5	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_new	.dynsym	0x7de7e0	96	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_set1_cert	.dynsym	0x7de880	40	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_set1_issuer	.dynsym	0x7de8b0	40	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE	.dynsym	0x7de8e0	5	FUNC	<unknown>	DEFAULT	14
CT_POLICY_EVAL_CTX_set_time	.dynsym	0x7de8f0	5	FUNC	<unknown>	DEFAULT	14
Camellia_DecryptBlock	.dynsym	0x8d2820	19	FUNC	<unknown>	DEFAULT	14
Camellia_DecryptBlock_Rounds	.dynsym	0x8d2360	1213	FUNC	<unknown>	DEFAULT	14
Camellia_Ekeygen	.dynsym	0x8d11f0	3223	FUNC	<unknown>	DEFAULT	14
Camellia_EncryptBlock	.dynsym	0x8d2340	19	FUNC	<unknown>	DEFAULT	14
Camellia_EncryptBlock_Rounds	.dynsym	0x8d1e90	1192	FUNC	<unknown>	DEFAULT	14
Camellia_cbc_encrypt	.dynsym	0x88a5b0	36	FUNC	<unknown>	DEFAULT	14
Camellia_decrypt	.dynsym	0x88a650	20	FUNC	<unknown>	DEFAULT	14
Camellia_encrypt	.dynsym	0x88a630	20	FUNC	<unknown>	DEFAULT	14
Camellia_set_key	.dynsym	0x88a5e0	78	FUNC	<unknown>	DEFAULT	14
ChaCha20_ctr32	.dynsym	0x88a670	1605	FUNC	<unknown>	DEFAULT	14
CryptonightR_instruction0	.dynsym	0x777880	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction1	.dynsym	0x777884	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction10	.dynsym	0x7778a8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction100	.dynsym	0x777a16	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction101	.dynsym	0x777a19	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction102	.dynsym	0x777a1b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction103	.dynsym	0x777a1d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction104	.dynsym	0x777a20	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction105	.dynsym	0x777a24	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction106	.dynsym	0x777a28	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction107	.dynsym	0x777a2c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction108	.dynsym	0x777a36	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction109	.dynsym	0x777a39	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction11	.dynsym	0x7778ac	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction110	.dynsym	0x777a3b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction111	.dynsym	0x777a3d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction112	.dynsym	0x777a40	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction113	.dynsym	0x777a44	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction114	.dynsym	0x777a48	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction115	.dynsym	0x777a4c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction116	.dynsym	0x777a56	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction117	.dynsym	0x777a59	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction118	.dynsym	0x777a5b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction119	.dynsym	0x777a5d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction12	.dynsym	0x7778b6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction120	.dynsym	0x777a60	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction121	.dynsym	0x777a64	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction122	.dynsym	0x777a68	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction123	.dynsym	0x777a6c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction124	.dynsym	0x777a76	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction125	.dynsym	0x777a79	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction126	.dynsym	0x777a7b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction127	.dynsym	0x777a7d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction128	.dynsym	0x777a80	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction129	.dynsym	0x777a84	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction13	.dynsym	0x7778b9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction130	.dynsym	0x777a88	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction131	.dynsym	0x777a8c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction132	.dynsym	0x777a96	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction133	.dynsym	0x777a99	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction134	.dynsym	0x777a9b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction135	.dynsym	0x777a9d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction136	.dynsym	0x777aa0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction137	.dynsym	0x777aa4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction138	.dynsym	0x777aa8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction139	.dynsym	0x777aac	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction14	.dynsym	0x7778bb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction140	.dynsym	0x777ab6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction141	.dynsym	0x777ab9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction142	.dynsym	0x777abb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction143	.dynsym	0x777abd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction144	.dynsym	0x777ac0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction145	.dynsym	0x777ac4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction146	.dynsym	0x777ac8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction147	.dynsym	0x777acc	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction148	.dynsym	0x777ad6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction149	.dynsym	0x777ad9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction15	.dynsym	0x7778bd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction150	.dynsym	0x777adb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction151	.dynsym	0x777add	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction152	.dynsym	0x777ae0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction153	.dynsym	0x777ae4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction154	.dynsym	0x777ae8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction155	.dynsym	0x777aec	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction156	.dynsym	0x777af6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction157	.dynsym	0x777af9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction158	.dynsym	0x777afb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction159	.dynsym	0x777afd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction16	.dynsym	0x7778c0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction160	.dynsym	0x777b00	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction161	.dynsym	0x777b04	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction162	.dynsym	0x777b08	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction163	.dynsym	0x777b0c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction164	.dynsym	0x777b16	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction165	.dynsym	0x777b19	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction166	.dynsym	0x777b1b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction167	.dynsym	0x777b1d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction168	.dynsym	0x777b20	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction169	.dynsym	0x777b24	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction17	.dynsym	0x7778c4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction170	.dynsym	0x777b28	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction171	.dynsym	0x777b2c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction172	.dynsym	0x777b36	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction173	.dynsym	0x777b39	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction174	.dynsym	0x777b3b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction175	.dynsym	0x777b3d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction176	.dynsym	0x777b40	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction177	.dynsym	0x777b44	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction178	.dynsym	0x777b48	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction179	.dynsym	0x777b4c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction18	.dynsym	0x7778c8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction180	.dynsym	0x777b56	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction181	.dynsym	0x777b59	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction182	.dynsym	0x777b5b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction183	.dynsym	0x777b5d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction184	.dynsym	0x777b60	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction185	.dynsym	0x777b64	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction186	.dynsym	0x777b68	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction187	.dynsym	0x777b6c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction188	.dynsym	0x777b76	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction189	.dynsym	0x777b79	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction19	.dynsym	0x7778cc	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction190	.dynsym	0x777b7b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction191	.dynsym	0x777b7d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction192	.dynsym	0x777b80	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction193	.dynsym	0x777b84	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction194	.dynsym	0x777b88	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction195	.dynsym	0x777b8c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction196	.dynsym	0x777b96	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction197	.dynsym	0x777b99	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction198	.dynsym	0x777b9b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction199	.dynsym	0x777b9d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction2	.dynsym	0x777888	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction20	.dynsym	0x7778d6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction200	.dynsym	0x777ba0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction201	.dynsym	0x777ba4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction202	.dynsym	0x777ba8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction203	.dynsym	0x777bac	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction204	.dynsym	0x777bb6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction205	.dynsym	0x777bb9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction206	.dynsym	0x777bbb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction207	.dynsym	0x777bbd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction208	.dynsym	0x777bc0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction209	.dynsym	0x777bc4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction21	.dynsym	0x7778d9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction210	.dynsym	0x777bc8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction211	.dynsym	0x777bcc	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction212	.dynsym	0x777bd6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction213	.dynsym	0x777bd9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction214	.dynsym	0x777bdb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction215	.dynsym	0x777bdd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction216	.dynsym	0x777be0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction217	.dynsym	0x777be4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction218	.dynsym	0x777be8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction219	.dynsym	0x777bec	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction22	.dynsym	0x7778db	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction220	.dynsym	0x777bf6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction221	.dynsym	0x777bf9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction222	.dynsym	0x777bfb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction223	.dynsym	0x777bfd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction224	.dynsym	0x777c00	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction225	.dynsym	0x777c04	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction226	.dynsym	0x777c08	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction227	.dynsym	0x777c0c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction228	.dynsym	0x777c16	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction229	.dynsym	0x777c19	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction23	.dynsym	0x7778dd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction230	.dynsym	0x777c1b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction231	.dynsym	0x777c1d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction232	.dynsym	0x777c20	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction233	.dynsym	0x777c24	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction234	.dynsym	0x777c28	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction235	.dynsym	0x777c2c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction236	.dynsym	0x777c36	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction237	.dynsym	0x777c39	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction238	.dynsym	0x777c3b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction239	.dynsym	0x777c3d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction24	.dynsym	0x7778e0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction240	.dynsym	0x777c40	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction241	.dynsym	0x777c44	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction242	.dynsym	0x777c48	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction243	.dynsym	0x777c4c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction244	.dynsym	0x777c56	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction245	.dynsym	0x777c59	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction246	.dynsym	0x777c5b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction247	.dynsym	0x777c5d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction248	.dynsym	0x777c60	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction249	.dynsym	0x777c64	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction25	.dynsym	0x7778e4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction250	.dynsym	0x777c68	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction251	.dynsym	0x777c6c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction252	.dynsym	0x777c76	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction253	.dynsym	0x777c79	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction254	.dynsym	0x777c7b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction255	.dynsym	0x777c7d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction256	.dynsym	0x777c80	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction26	.dynsym	0x7778e8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction27	.dynsym	0x7778ec	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction28	.dynsym	0x7778f6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction29	.dynsym	0x7778f9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction3	.dynsym	0x77788c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction30	.dynsym	0x7778fb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction31	.dynsym	0x7778fd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction32	.dynsym	0x777900	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction33	.dynsym	0x777904	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction34	.dynsym	0x777908	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction35	.dynsym	0x77790c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction36	.dynsym	0x777916	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction37	.dynsym	0x777919	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction38	.dynsym	0x77791b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction39	.dynsym	0x77791d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction4	.dynsym	0x777896	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction40	.dynsym	0x777920	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction41	.dynsym	0x777924	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction42	.dynsym	0x777928	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction43	.dynsym	0x77792c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction44	.dynsym	0x777936	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction45	.dynsym	0x777939	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction46	.dynsym	0x77793b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction47	.dynsym	0x77793d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction48	.dynsym	0x777940	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction49	.dynsym	0x777944	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction5	.dynsym	0x777899	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction50	.dynsym	0x777948	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction51	.dynsym	0x77794c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction52	.dynsym	0x777956	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction53	.dynsym	0x777959	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction54	.dynsym	0x77795b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction55	.dynsym	0x77795d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction56	.dynsym	0x777960	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction57	.dynsym	0x777964	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction58	.dynsym	0x777968	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction59	.dynsym	0x77796c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction6	.dynsym	0x77789b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction60	.dynsym	0x777976	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction61	.dynsym	0x777979	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction62	.dynsym	0x77797b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction63	.dynsym	0x77797d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction64	.dynsym	0x777980	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction65	.dynsym	0x777984	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction66	.dynsym	0x777988	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction67	.dynsym	0x77798c	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction68	.dynsym	0x777996	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction69	.dynsym	0x777999	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction7	.dynsym	0x77789d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction70	.dynsym	0x77799b	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction71	.dynsym	0x77799d	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction72	.dynsym	0x7779a0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction73	.dynsym	0x7779a4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction74	.dynsym	0x7779a8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction75	.dynsym	0x7779ac	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction76	.dynsym	0x7779b6	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction77	.dynsym	0x7779b9	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction78	.dynsym	0x7779bb	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction79	.dynsym	0x7779bd	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction8	.dynsym	0x7778a0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction80	.dynsym	0x7779c0	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction81	.dynsym	0x7779c4	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction82	.dynsym	0x7779c8	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction83	.dynsym	0x7779cc	0	NOTYPE	<unknown>	DEFAULT	14
CryptonightR_instruction84	.dynsym	0x7779d6	0	NOTYPE	<unknown>	DEFAULT	14

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T11:41:28.949957+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.13	45378	91.184.240.129	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 11:32:56.274152994 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:32:56.279525995 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:32:56.279705048 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:32:56.280515909 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:32:56.285801888 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:32:57.153527021 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:32:57.153785944 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:00.321100950 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:00.321304083 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:13.299763918 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:13.299989939 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:23.689595938 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:23.689722061 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:30.701211929 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:30.701358080 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:34.553015947 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:34.553210974 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:44.636380911 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:44.636519909 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:33:54.705070019 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:33:54.705254078 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:34:04.372679949 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:34:04.372829914 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:34:15.801723003 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:34:15.801855087 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:34:27.813416958 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:34:27.813585997 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:34:30.772315025 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:34:30.772454977 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:34:37.817331076 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:34:37.817472935 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:34:53.617873907 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:34:53.618032932 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:04.760031939 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:04.760217905 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:04.760416031 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:04.760467052 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:17.332751036 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:17.332874060 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:27.382428885 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:27.382564068 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:30.858824015 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:30.858968019 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:40.258557081 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:40.258703947 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:35:55.999938011 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:35:56.000073910 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:36:06.289289951 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:36:06.289413929 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:36:20.515032053 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:36:20.515162945 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:36:30.850310087 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:36:30.850420952 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:36:37.433931112 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:36:37.434065104 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:36:47.474801064 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:36:47.474932909 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:36:57.530100107 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:36:57.530267000 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:37:07.571432114 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:37:07.571559906 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:37:17.647109032 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:37:17.647244930 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:37:30.452049017 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:37:30.452182055 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:37:30.906299114 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:37:30.906411886 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:37:41.938462973 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:37:41.938615084 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:37:53.569547892 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:37:53.569655895 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:06.218396902 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:06.218502045 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:06.218568087 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:06.218622923 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:06.220247984 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:06.220292091 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:16.255990982 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:16.256099939 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:27.453845978 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:27.453939915 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:30.966502905 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:30.966622114 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:38:48.162345886 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:38:48.162509918 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:07.032164097 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:07.032296896 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:17.844702005 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:17.844821930 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:28.711472988 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:28.711584091 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:28.711618900 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:28.711704016 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:28.954514027 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:28.954629898 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:31.053328037 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:31.053443909 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:41.410948992 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:41.411077023 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:39:56.407815933 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:39:56.407928944 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:07.424118042 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:07.424233913 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:17.807929039 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:17.808049917 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:27.957848072 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:27.957998991 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:31.126605988 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:31.126737118 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:38.487066031 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:38.487189054 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:46.759970903 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:46.760086060 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:40:59.450561047 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:40:59.450879097 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:41:09.459351063 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:41:09.459475040 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:41:24.126193047 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:41:24.126322985 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:41:28.949956894 CET	45378	80	192.168.2.13	91.184.240.129
Oct 30, 2024 11:41:28.955818892 CET	80	45378	91.184.240.129	192.168.2.13
Oct 30, 2024 11:41:28.955869913 CET	45378	80	192.168.2.13	91.184.240.129

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 11:32:56.231530905 CET	50800	53	192.168.2.13	8.8.8.8
Oct 30, 2024 11:32:56.231530905 CET	37114	53	192.168.2.13	8.8.8.8
Oct 30, 2024 11:32:56.243676901 CET	53	50800	8.8.8.8	192.168.2.13
Oct 30, 2024 11:32:56.268616915 CET	53	37114	8.8.8.8	192.168.2.13
Oct 30, 2024 11:35:42.324717045 CET	48100	53	192.168.2.13	8.8.8.8
Oct 30, 2024 11:35:42.325368881 CET	35457	53	192.168.2.13	8.8.8.8
Oct 30, 2024 11:35:42.332484007 CET	53	48100	8.8.8.8	192.168.2.13
Oct 30, 2024 11:35:42.332503080 CET	53	35457	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 11:32:56.231530905 CET	192.168.2.13	8.8.8.8	0x195b	Standard query (0)	xkobeproxy.xkobeimparatu.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:32:56.231530905 CET	192.168.2.13	8.8.8.8	0x7abe	Standard query (0)	xkobeproxy.xkobeimparatu.net	28	IN (0x0001)	false
Oct 30, 2024 11:35:42.324717045 CET	192.168.2.13	8.8.8.8	0x1399	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:35:42.325368881 CET	192.168.2.13	8.8.8.8	0xae6e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 11:32:56.243676901 CET	8.8.8.8	192.168.2.13	0x195b	No error (0)	xkobeproxy.xkobeimparatu.net	91.184.240.129	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:35:42.332484007 CET	8.8.8.8	192.168.2.13	0x1399	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:35:42.332484007 CET	8.8.8.8	192.168.2.13	0x1399	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	45378	91.184.240.129	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 11:32:56.280515909 CET	473	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 62 75 6e 72 61 75 22 2c 22 70 61 73 73 22 3a 22 62 75 6e 72 61 75 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"bunrau","pass":"bunrau","agent":"XMRig/6.21.0 (Linux x86_64) libuv/1.44.2 gcc/7.3.1","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","
Oct 30, 2024 11:32:57.153527021 CET	500	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 69 64 22 3a 31 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 61 37 66 64 65 66 38 38 36 61 32 32 35 30 62 36 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f Data Ascii: {"jsonrpc":"2.0","id":1,"error":null,"result":{"id":"a7fdef886a2250b6","job":{"blob":"1010d29688b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c401b5e366fd95452992ee74847d84822145cdfd686f90215409bef561ca2a9b7744","jo
Oct 30, 2024 11:33:00.321100950 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 64 63 39 36 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010dc9688b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c45174c23b7441a6e8f7f932c584203f1322ca35376fe4923f838206ed5e2383fc4c","job_id":"ksGLtjWpYe92KujlZqNE+XvHc80v"
Oct 30, 2024 11:33:13.299763918 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 39 39 36 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010e99688b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c431326643323d9a49d0c9074484bfbed40536168e721fb198ccd025a8cbeae9bd4d","job_id":"3q0Eh2GJhNaDhFGTdG6xTHZKeKlt"
Oct 30, 2024 11:33:23.689595938 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 33 39 36 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010f39688b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c47078a2077b2f11bc2bbbb2e66a3d832d7ccefc247cebfc63d078a180650bb3e953","job_id":"9/1XJtzCNHCwqTUJ0bDFkDRH6d93"
Oct 30, 2024 11:33:30.701211929 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 33 39 36 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010f39688b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c462bdc049e73a193141651245d05e8e9073e644bd8951af707d16c61488c3465353","job_id":"yEKUx/5/5dxgV7loWj4uMYDfy1aR"
Oct 30, 2024 11:33:34.553015947 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 65 39 36 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010fe9688b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c45cc13e5caf7f53fa48d95e47994852202e64ae9292cd9265be9de7a5aea7f6ef58","job_id":"JGHi/vSTPJLJsofE4qJ+Y9eI4SsY"
Oct 30, 2024 11:33:44.636380911 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 38 39 37 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010889788b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c42138a8ab20438d5ef12211e4fd3bbab2e34a4913dd2803a54b7a5bd647f70ed55b","job_id":"f3JDrYAP/hSPTFldBHQ8pvBkjkIX"
Oct 30, 2024 11:33:54.705070019 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 32 39 37 38 38 62 39 30 36 38 31 35 37 65 35 65 37 34 62 35 61 66 36 36 64 33 36 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010929788b9068157e5e74b5af66d36ffd4c1454ba0876a0c75feec8d0217c4491f264c50cefd000000c4e06743d70e32eb5b372a58967c608df2a65450ec0abcdde56367f18cb28cfe1e5d","job_id":"SsSdiWF8cDSh5TcUcK41rS0rLU/s"
Oct 30, 2024 11:34:04.372679949 CET	388	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 63 39 37 38 38 62 39 30 36 64 31 32 65 39 31 38 30 38 37 66 39 30 33 32 30 33 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10109c9788b906d12e918087f903203adc36dd1dd152f360dbadc3a0f8d7b365b43e183b7c129c000000c42a88c907b73ed7dad6a15a663b7a104440b97330c0c6ae4fd90ac1f1799ad18203","job_id":"b6+KLeOmMSFocF2D1Gn3xkPE9YNU"

System Behavior

Analysis Process: .report_system.elf PID: 5435, Parent PID: 5358

General

Start time (UTC):	10:32:55
Start date (UTC):	30/10/2024
Path:	/tmp/.report_system.elf
Arguments:	/tmp/.report_system.elf
File size:	8825184 bytes
MD5 hash:	1271e6e82b344df1c7960230ec449af7

Start time (UTC):	10:32:55
Start date (UTC):	30/10/2024
Path:	/tmp/.report_system.elf
Arguments:	-
File size:	8825184 bytes
MD5 hash:	1271e6e82b344df1c7960230ec449af7

Start time (UTC):	10:32:56
Start date (UTC):	30/10/2024
Path:	/tmp/.report_system.elf
Arguments:	-
File size:	8825184 bytes
MD5 hash:	1271e6e82b344df1c7960230ec449af7

Start time (UTC):	10:32:56
Start date (UTC):	30/10/2024
Path:	/bin/sh
Arguments:	sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	10:32:56
Start date (UTC):	30/10/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	10:32:56
Start date (UTC):	30/10/2024
Path:	/sbin/modprobe
Arguments:	/sbin/modprobe msr allow_writes=on
File size:	174424 bytes
MD5 hash:	0b44462b1a40df8039d6d61cfff7ea84

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Kernel: Kernel Module Load, Process: Process Creation
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report .report_system.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: .report_system.elf PID: 5435, Parent PID: 5358

General

Chronological Activities

Analysis Process: .report_system.elf PID: 5436, Parent PID: 5435

General

Chronological Activities

Analysis Process: .report_system.elf PID: 5442, Parent PID: 5436

General

Chronological Activities

Analysis Process: sh PID: 5442, Parent PID: 5436

General

Linux Analysis Report
.report_system.elf