X__text__TEXT,"__data__DATA,__const__TEXT@__cstring__TEXT@ __picsymbolstub2__TEXTM?) L0__la_sym_ptr2__DATA\h"4__nl_symbol_ptr__DATA".__textcoal_nt__TEXT" @6I< Ptt }"T50UVS Eǀ?}~HUDŽ 7UDŽ;E6@0ED$D$$D$D$$D$D$0$D$D$1$hD$D$2$BD$D$3$D$D$4$D$D$5$6D$0$,?,?u3D$S$Z,?t$%fF,?tB,?@ ,?@ 6t$?6$?6$ ?6$y$?6$](?3D$$& [^]US4ED$#D$ 3D$D$$>D$$E}t @D$E$]E$94[]US4|ED$D$ D$D$h$?D$h$ E}tE$EEE4[]ÐUS$EU􃼐 7uoE@D$U􋄐 7$Du<E6x1u/E@$xE6@1 Ez$[]ÐUWVSU䃼 7u|ED$>U䋄 7$uLD$D$>U䋄;$^U E>U䋄;E&Em>6}E$ 7 7uD$$ED$qD$ D$D$>$;>6}䍃D$>$;>U䃼;>6}䍃D$>$;>U䃼;tF>U䋄;$P>6}䍃D$>$];>U䃼;u]>D$D$$>U䋄 7$T>UDŽ 7EjD$D$>U䋄;$VU EE$Bt>E6@1>U䋄;EE<[^_]ÐUVSEED$E@$E}u3D$$l?E)l0?D$E$ u$D$@$5E ED$D$l$u l8 tl8#tl0?D$E$D$ l$IE}u:D$$l0?D$E$=BEEE8!u\D$ E$E}u:D$$"l0?D$E$EE$rEE(EE8 u EEED$E$ t"l0?D$E$mrlEEE D$E$u E! E8!u;EE8!u*EE8!uEE8?uE}~l}~C}~hxt E l,?l ?fBDl,?l?fB!l,?l?fBl0?D$E$ED$$#D$D$E$uED$E@dD$E D$}t}~ E?E+EEE!ED$}~ E!E+ED$ D$!D$E$<E$E 8-u`E 81uUl,?l(?fBED$ D$D$l$lE8-u`E81uUl,?l$?fBED$ 8D$D$l$EEEEEEEEEEEEEEEE܋E ED$:E$ED$:E $Eȃ}r}hEẼEEȃD$:Ẻ$ED$:Eȉ$EЃ}}EEEԃEЃD$:Eԉ$OED$:EЉ$9E}}EEEăED$:Eĉ$ED$:E$E}tn}thEEEED$:E$ED$:E$E}t}tEEEE}t"}tEȉ$EẺ$E}t}tE؉D$E܉$ulƀ06E؉D$E܉D$ `D$D$l0$E;Eulƀ1}}Et ExE-ED$PEt EwE-ED$LEt ErE-ED$HEt ExE-ED$DEt EwE-ED$@E t ErE-ED$?[\]^`{|}~ossec-analysisd%s(1102): Memory error. Exiting.syscheck_integrity_changedsyscheck_integrity_changed_2ndsyscheck_integrity_changed_3rdsyscheck_new_entrysyscheck_deleted%s: SyscheckInit completed./queue/syscheck%s/.%s.cptw#!Xr%s/%sr+%s: Unable to open '%s'%s: Error handling integrity database.%s: Error handling integrity database (fgetpos).%s: Invalid integrity message in the database.%s: Invalid integrity message in the database%c%c%c%s !%d %s File '%.756s' was deleted. Unable to retrieve checksum.File '%.756s' was re-added.Size changed from '%s' to '%s' Permissions changed from '%c%c%c%c%c%c%c%c%c' to '%c%c%c%c%c%c%c%c%c' Ownership was '%s', now it is '%s' Group ownership was '%s', now it is '%s' Old md5sum was: '%s' New md5sum is : '%s' Old sha1sum was: '%s' New sha1sum is : '%s' Integrity checksum changed for: '%.756s' %s%s%s%s%s%s+++%s !%d %s New file '%.756s' added to the file system.syscheck-db-completed%s(1755): Invalid syscheck message received.:⍀:P%⍀%P|⍀Phc⍀POJ⍀P61⍀P⍀P⍀P⍀P}⍀}Ph⍀hPS⍀SP>⍀>Pni)⍀)PUP⍀P<7⍀P#⍀P ⍀P⍀P⍀P⍀P⍀Pl⍀lPtZs ";Tm5Ng$Ë$x n@\M<-z `@nTF,`@zqcSA`( }_O=}k`LB$N8    N 8   Z J 8          u n       w b T :      T > ' !  @ @ @|eVI:0@@|z P<2 K@|rhH]WC.! :HB|`r@ZJ%z z tT J6  z @/z ncT<E;1:+!/z  @       sk c WO G 2      ` @   yi SC -     _ I 3  z ; 5x-x'y " __y  FFy  --y  y  y  y  ~xy s me_y Z TLFy A ;~3~-y ( "eey  LLy  33y  y  y  y  ~y y skey ` ZRLy G A93y . (k ky  RRy XTPLHD@<840,($  ~~}d:dE<T@DDDE DGDI&DK1DLGDM]DIqDQyDRDTDUDV DW1DXWDY}D]D^D_D`Da0DcEDdaDe}DfDgDiDkb$D|E $DtDxDz/D{LD}RD~gDr$tsu". STbqy(x$DxDDDDDDD$x$DD DD*DRDhDjDxDDD$(PHb' 8 V6lL}Q1d;tY$h!)-5 67$DDDDDDD#D=DHDDDDD,DAD[DDDDDDD#D+D:DNDc8$GT emnco$DpDDDD D D DDDDDGD cD!D&D'D)D*D+D-D.D2D4D5 D7 D8% D9B D;G D@M DA[ DBa DCl DGu DJ DK DO DS DW DX D\ D^ D_ Da Db Dc Dd De Dk& Dm, Do2 DrF DuR Dzu D D D D D D D D D D D D/ Dc Dq D D D D D D D D D D D D D D# D) D? DU Di Do Du D{ D D D D D D D D D DDDDD#D)D?DUDaDgDmDsDyDDDDDD  D D&D:D*(D,JD0[D6D8D<DBDDDH-DNcDPDTD[DngDouDsDvD|D~DDDDeDDDDDDp$p  -=MZgtc g$DDD4D:DUD`DlDDDDDDDDDDDD $ $  &@O -^ "r %  8 & ' ( <8;d,W`pFk7x'0{$*YR2bx9h@?JpB_SyscheckInit___i686.get_pc_thunk.bx___setcompleted___iscompleted_DB_SetCompleted_DB_File_DB_Search_DecodeSyscheck___local_name_ar_flag_ar_commands_active_responses_currently_rule_Config__eflog__aflog__fflog_sdb___i686.get_pc_thunk.axdyld_stub_binding_helper_strncasecmp_atoi_fflush_fputc_fsetpos_strlen_strchr_fgets_fgetpos_free_merror_strdup_fseek_strcmp_fclose_fprintf_fopen_snprintf_debug1_getDecoderfromlist_ErrorExit_calloc_memset/mnt/gmirror/ports/security/ossec-hids-server/work/ossec-hids-1.3/src/analysisd/decoders/syscheck.cgcc2_compiled._hostname_mapSyscheckInit:F(0,1)=(0,1)void:t(0,1)i:(0,2)=r(0,2);-2147483648;2147483647;int:t(0,2)__setcompleted:F(0,1)agent:p(0,3)=*(0,4)=r(0,4);0;127;char:t(0,4)fp:(0,5)=*(0,6)=(0,7)=xs__sFILE:FILE:t(0,6)__sFILE:T(0,7)=s88_p:(0,8)=*(0,9)=@s8;r(0,9);0;255;,0,32;_r:(0,2),32,32;_w:(0,2),64,32;_flags:(0,10)=@s16;r(0,10);-32768;32767;,96,16;_file:(0,10),112,16;_bf:(0,11)=xs__sbuf:,128,64;_lbfsize:(0,2),192,32;_cookie:(0,12)=*(0,1),224,32;_close:(0,13)=*(0,14)=f(0,2),256,32;_read:(0,15)=*(0,16)=f(0,2),288,32;_seek:(0,17)=*(0,18)=f(0,19)=(0,20)=(0,21)=(0,22)=@s64;r(0,22);01000000000000000000000;0777777777777777777777;,320,32;_write:(0,23)=*(0,24)=f(0,2),352,32;_ub:(0,11),384,64;_extra:(0,25)=*(0,26)=xs__sFILEX:,448,32;_ur:(0,2),480,32;_ubuf:(0,27)=ar(0,28)=r(0,28);0000000000000;0037777777777;;0;2;(0,9),512,24;_nbuf:(0,29)=ar(0,28);0;0;(0,9),536,8;_lb:(0,11),544,64;_blksize:(0,2),608,32;_offset:(0,19),640,64;;unsigned char:t(0,9)short int:t(0,10)__sbuf:T(0,11)=s8_base:(0,8),0,32;_size:(0,2),32,32;;fpos_t:t(0,19)__darwin_off_t:t(0,20)__int64_t:t(0,21)long long int:t(0,22)long unsigned int:t(0,30)=r(0,30);0000000000000;0037777777777;__iscompleted:F(0,2)agent:p(0,3)fp:(0,5)DB_SetCompleted:F(0,1)lf:p(0,31)=*(0,32)=(0,33)=xs_Eventinfo:Eventinfo:t(0,32)_Eventinfo:T(0,33)=s128log:(0,3),0,32;full_log:(0,3),32,32;location:(0,3),64,32;hostname:(0,3),96,32;program_name:(0,3),128,32;srcip:(0,3),160,32;dstip:(0,3),192,32;srcport:(0,3),224,32;dstport:(0,3),256,32;protocol:(0,3),288,32;action:(0,3),320,32;user:(0,3),352,32;dstuser:(0,3),384,32;id:(0,3),416,32;status:(0,3),448,32;command:(0,3),480,32;url:(0,3),512,32;data:(0,3),544,32;systemname:(0,3),576,32;generated_rule:(0,34)=*(0,35)=(0,36)=xs_RuleInfo:,608,32;decoder_info:(0,37)=*(0,38)=(0,39)=s48get_next:(0,40)=(0,9),0,8;type:(0,40),8,8;use_own_name:(0,40),16,8;id:(0,41)=(0,42)=@s16;r(0,42);0;65535;,32,16;regex_offset:(0,41),48,16;prematch_offset:(0,41),64,16;fts:(0,2),96,32;parent:(0,3),128,32;name:(0,3),160,32;ftscomment:(0,3),192,32;regex:(0,43)=*(0,44)=(0,45)=xs_OSRegex:,224,32;prematch:(0,43),256,32;program_name:(0,46)=*(0,47)=(0,48)=xs_OSMatch:,288,32;plugindecoder:(0,49)=*(0,50)=f(0,1),320,32;order:(0,51)=*(0,52)=*(0,53)=f(0,1),352,32;;,640,32;sid_node_to_delete:(0,54)=*(0,55)=(0,56)=xs_OSListNode:,672,32;size:(0,2),704,32;p_name_size:(0,2),736,32;matched:(0,10),768,16;time:(0,2),800,32;day:(0,2),832,32;year:(0,2),864,32;hour:(0,57)=ar(0,28);0;8;(0,4),896,72;mon:(0,58)=ar(0,28);0;3;(0,4),968,32;;RuleInfo:t(0,35)_RuleInfo:T(0,36)=s192sigid:(0,2),0,32;level:(0,2),32,32;maxsize:(0,2),64,32;frequency:(0,2),96,32;timeframe:(0,2),128,32;context:(0,40),160,8;firedtimes:(0,2),192,32;time_ignored:(0,2),224,32;ignore_time:(0,2),256,32;ignore:(0,2),288,32;ckignore:(0,2),320,32;group_prev_matched_sz:(0,2),352,32;__frequency:(0,2),384,32;last_events:(0,59)=*(0,3),416,32;alert_opts:(0,41),448,16;context_opts:(0,41),464,16;category:(0,40),480,8;decoded_as:(0,41),496,16;sid_prev_matched:(0,60)=*(0,61)=(0,62)=xs_OSList:,512,32;sid_search:(0,60),544,32;group_prev_matched:(0,63)=*(0,60),576,32;group_search:(0,60),608,32;event_search:(0,64)=*(0,65)=f(0,12),640,32;group:(0,3),672,32;match:(0,46),704,32;regex:(0,43),736,32;day_time:(0,3),768,32;week_day:(0,3),800,32;srcip:(0,66)=*(0,67)=*(0,68)=(0,69)=xs_os_ip:,832,32;dstip:(0,66),864,32;srcport:(0,46),896,32;dstport:(0,46),928,32;user:(0,46),960,32;url:(0,46),992,32;id:(0,46),1024,32;status:(0,46),1056,32;hostname:(0,46),1088,32;program_name:(0,46),1120,32;extra_data:(0,46),1152,32;action:(0,3),1184,32;comment:(0,3),1216,32;info:(0,3),1248,32;cve:(0,3),1280,32;if_sid:(0,3),1312,32;if_level:(0,3),1344,32;if_group:(0,3),1376,32;if_matched_regex:(0,43),1408,32;if_matched_group:(0,46),1440,32;if_matched_sid:(0,2),1472,32;ar:(0,70)=*(0,71)=*(0,72)=(0,73)=xs_ar:,1504,32;;OSDecoderInfo:t(0,38)u_int8_t:t(0,40)u_int16_t:t(0,41)short unsigned int:t(0,42)OSRegex:t(0,44)_OSRegex:T(0,45)=s24error:(0,2),0,32;flags:(0,74)=*(0,2),32,32;patterns:(0,59),64,32;sub_strings:(0,59),96,32;prts_closure:(0,75)=*(0,59),128,32;prts_str:(0,75),160,32;;OSMatch:t(0,47)_OSMatch:T(0,48)=s16error:(0,2),0,32;size:(0,74),32,32;patterns:(0,59),64,32;match_fp:(0,76)=*(0,77)=*(0,78)=f(0,2),96,32;;OSListNode:t(0,55)_OSListNode:T(0,56)=s12next:(0,79)=*(0,56),0,32;prev:(0,79),32,32;data:(0,12),64,32;;OSList:t(0,61)_OSList:T(0,62)=s24first_node:(0,54),0,32;last_node:(0,54),32,32;cur_node:(0,54),64,32;currently_size:(0,2),96,32;max_size:(0,2),128,32;free_data_function:(0,49),160,32;;os_ip:t(0,68)_os_ip:T(0,69)=s12ip:(0,3),0,32;ip_address:(0,80)=r(0,80);0000000000000;0037777777777;,32,32;netmask:(0,80),64,32;;active_response:t(0,72)_ar:T(0,73)=s36timeout:(0,2),0,32;location:(0,2),32,32;level:(0,2),64,32;name:(0,3),96,32;command:(0,3),128,32;agent_id:(0,3),160,32;rules_id:(0,3),192,32;rules_group:(0,3),224,32;ar_cmd:(0,81)=*(0,82)=(0,83)=xs_ar_command:,256,32;;unsigned int:t(0,80)ar_command:t(0,82)_ar_command:T(0,83)=s16expect:(0,2),0,32;timeout_allowed:(0,2),32,32;name:(0,3),64,32;executable:(0,3),96,32;;i:(0,2)DB_File:F(0,5)agent:p(0,3)agent_id:p(0,74)i:(0,2)DB_Search:F(0,2)f_name:p(0,3)c_sum:p(0,3)lf:p(0,31)p:(0,2)sn_size:(0,2)agent_id:(0,2)saved_sum:(0,3)saved_name:(0,3)fp:(0,5)oldsize:(0,3)newsize:(0,3)olduid:(0,3)newuid:(0,3)c_oldperm:(0,3)c_newperm:(0,3)oldgid:(0,3)newgid:(0,3)oldmd5:(0,3)newmd5:(0,3)oldsha1:(0,3)newsha1:(0,3)oldperm:(0,2)newperm:(0,2)DecodeSyscheck:F(0,2)lf:p(0,31)c_sum:(0,3)f_name:(0,3)ff_ig:(0,59)__local_name:G(0,3)hostname_map:S(0,84)=ar(0,28);0;255;(0,85)=k(0,9)ar_flag:G(0,2)ar_commands:G(0,60)active_responses:G(0,60)currently_rule:G(0,34)Config:G(0,86)=(0,87)=xs__Config:_Config:t(0,86)__Config:T(0,87)=s36logall:(0,40),0,8;stats:(0,40),8,8;integrity:(0,40),16,8;syscheck_auto_ignore:(0,40),24,8;syscheck_alert_new:(0,40),32,8;rootcheck:(0,40),40,8;hostinfo:(0,40),48,8;mailbylevel:(0,40),56,8;logbylevel:(0,40),64,8;keeplogdate:(0,40),72,8;mailnotify:(0,10),80,16;ar:(0,2),96,32;memorysize:(0,2),128,32;syscheck_ignore:(0,59),160,32;white_list:(0,66),192,32;hostname_white_list:(0,88)=*(0,46),224,32;includes:(0,59),256,32;;_eflog:G(0,5)_aflog:G(0,5)_fflog:G(0,5)sdb:G(0,89)=(0,90)=xs__sdb:_sdb:t(0,89)__sdb:T(0,90)=s16184buf:(0,91)=ar(0,28);0;6144;(0,4),0,49160;comment:(0,91),49160,49160;size:(0,92)=ar(0,28);0;256;(0,4),98320,2056;perm:(0,92),100376,2056;owner:(0,92),102432,2056;gowner:(0,92),104488,2056;md5:(0,92),106544,2056;sha1:(0,92),108600,2056;agent_cp:(0,93)=ar(0,28);0;256;(0,94)=ar(0,28);0;0;(0,4),110656,2056;agent_ips:(0,95)=ar(0,28);0;256;(0,3),112736,8224;agent_fps:(0,96)=ar(0,28);0;256;(0,5),120960,8224;db_err:(0,2),129184,32;id1:(0,2),129216,32;id2:(0,2),129248,32;id3:(0,2),129280,32;idn:(0,2),129312,32;idd:(0,2),129344,32;syscheck_dec:(0,37),129376,32;init_pos:(0,19),129408,64;;