My name is Felipe Piedez and today we're going to talk about malware hunting, discovering techniques in malware, no, malware in malicious PDF, right? So this is my contact at Twitter, at FlipPiris. My contact and social media, so we can find here some in my web page. We can find there some talks that are made in some events in English, Spanish and Portuguese language. My GitHub here, Felipe86 in my LinkedIn, so if you'd like to exchange something with me or send some questions, I'm generally available, right? So let me introduce myself. So I'm security research at Sapporo, Sapporo, it's a company from Switzerland and I'm responsible for creating attack modules for this company, actually for the product of this company and I create this, I create the design of the attack and send to the developer team and this team putting this in our product, right? I'm a founder of the Black and White Technology, it's my own company. I'm an advisor and CEO of this company, it's a consulting company responsible for provide services, consulting services actually and for a pen, privilege, access management, talk, security, security operations center, our analysis and tests and so on and so on. I'm a developer advocate in different projects, first is Hacking Sonora Crime, very known in U.S. and not only U.S. but in Europe and I'm a developer of this project, the idea behind of this project is to talk more about this concept and calling Hacking and how important it is to spread the message for many people because the idea is the hacking is how you can use your creative money to help organization, to help companies protect their solutions, their organization, the product and not only that but using your creative mind to be a hacker is to using a lifestyle, right?  Not how the TVs or the newspaper using this word or to a bad guy, right? So that's the idea behind of this project and I'm advocate of the Sena Segura, Sena Segura, it's a global company from Brazil by the way, responsible for provide different solutions for a pan, a privileged access management and different authentication process actually and I'm ambassador of the ISNIC open source project, right? So this is a solution to protect the company actually producing a SAST solution, a strategic analysis coding for the developer process actually and not only that but SCA analysis composition actually, looking from the libraries inside of the code and I'm ambassador of this project, right? And I'm a structure writer and a reviewer of those at three magazines in Europe, the 10th magazine in Hacking Island and Neporazic. And by the way, I am a structure of the specifically course about the malware attack with the Q chain in the testing magazine. So if you'd like to know more about that, so you can send them a message, right? So this is some information about me and before to talk more about technical stuff, so it's important to put all those people in the same patient. First of all, I would like to just to simple explanation what is a threat is according to this ISO is defined as a potential cause of an incident that may cause harm to the system and organization. But what does that mean, Philip? Basically, maybe is a software attack or a specific exploitation about attack in software is a kind of a tech intellectual property. So if you are if you produce some code or some product, or if you have some intellectual property or some attacker or threat actor, try to test this intellectual property, so it's it is a threat. Another is identity death. So, for example, if you have an organization and some user hasn't specifically authentication process or identity to authenticate something, so it's something about the death of this specific identity. It's a kind of threat sabotage. It's another another part of this threat because if someone talk about your organization on Twitter or other social media, for example, try, you know, pull some damage in the image of your company. It's a kind of sabotage is it is a threat. OK, and information distortion are example of information security threat. It's just a simple definition. Why is it important to understand that because we are talking today about the malware and how you need to looking from these and how you can look in more deep level that so malware is basically its acronym of the malicious software. So it's a potential threat. So because of that, it's important to clarify what is a threat. Not definition from flip is definition from these eyes. OK, so let's talk about this simple flow about the malware analysis. OK, so first of all, we have a possible threat or artifact or a sample. So this is the first step that identification is that right. So as you can see here, we have a malware. It's acronym of the malware malicious software or or more dog malicious document. Right. So remember, you receive to analyze and specifically artifact or sample. So you need to understand if he is a malware or it's a mall dog. Depends of the binary or the station, not only that, but many of the factors, not factors, but points that you need to analyze after that. You need to choose what the best methodology you use when you analyze something like you can use in a statistical analysis and dynamic analysis, two different approaches. OK, so my recommendations to you when you perform something like these, it's important you write this like, you know, about all those steps that you are analyzing when you make something for example, you have received this artifact, you need to register all those steps because when you do that, you can understand about the steps that possible attack using this attack. And not only that, but you can produce something like a report. And this report you can present, for example, your manager, your coordinator, your tech lead, or you can produce some article, for example, about your studies, for example, it's another interesting point. And not only that, but you can create a specifically improvement, not create, but you can help your organization, your company to improve the defense's mechanism, because when you understand what kind of technique they use it by the attacker, you can understand what kind of technique these threat actor or this attacker using to bypass the security sensor in your organization, like a firewall, like IBS, like IDS, like a possible sandbox or other tools that you have in your environment virus, EGR, so you can understand the technique using by the attacker to bypass those solutions. And not only that, but you can suggest that there's improvement for your defense's mechanism and you can creating this good word called CTI or cyber threat intelligence. You can build it in your organization. I know that it's not too easy to create this if you are a small company, but nowadays we have many tools to help you to give this information. Like, for example, MISP, it's our sharing platform that you can use in an open source product, by the way, using, for example, Elasticsearch to correlate in the logs or other things like this, so you can create these intelligence in your organization. And you need to be strengthening cyber resilience. You need to have this resilience because the threats are changing all the time, so we need to calculate, of course, it's difficult. Probably you can use some tools to help you to calculate the resistance against the threat in your environment. But remember, this is a defensive approach to understand how you can use in the offensive mindset. Okay, so this is the simple flow using in our analysis, in our studies. So remember, this is the first step, the statistical analysis and the dynamic analysis. Probably you already heard about that, but if you are new here, it's important you understand those different. So, simple like this, what is the statistical analysis? When you talk about the moral analysis, usually is the first step in using in the moral studies. Why? Because of the statistical analysis, describe the process of analyzing the program code. It means that you will look more deeply about the structure of this specific code. When you receive the binary, we need to look more deeply about that, or you can find in specifically functioning the data that is important by the DLL, using this attack, or what kind of DLL, this specifically binary, we're using your system operation to execute in this attack in this specific environment. So the program itself doesn't run in this time. So because of that, it's more safe when you analyze, because you're looking from the behavior, not behavior, but you're looking the code, the program code. So maybe you are thinking about the reversal engineers or where is the reversal engineering here, Philippe? Basically, reversal engineering, if you are new here again, is a technique that you can use inside of the statistical analysis. Not only that, but you can use it in dynamic analysis. And I will explain what the difference between statistical and dynamic, but it's important to understand. Before looking deeply about the reversal engineering, you need to understand those bases, right? So what is the statistical analysis? What is the dynamic analysis? How the tools can help you? How the structure of the binary works? And after that, you can look in more about the reversal engineering through looking for the buggers, looking for assembly code, and so on and so on, okay? So let's talk about the dynamic analysis. This is the second methodology that you can use in more studies, right? So dynamic analysis based on behavior, in this case, basically is the interactions that the malware or Modoc has when it's executed in this environment. Basically, it's the runtime analysis. Remember, so you have two approaches, no runtime and runtime analysis. One is the statistical analysis that you can look in from, the structure of the code, the functions, the DLLs, libraries, and another, it's a runtime. So you pick up the malware, you put in a specifically environment, control of the environment, remember that, and it was a good itself inside of this control of the environment, you will see the behavior, and after that, you will check if it's malicious or not. And by the way, it can be easily automated. And basically, we have a specific concept calling send box, that call it send box, actually. Maybe you already heard about what is exactly send box. Send box is a specific environment, basically is a virtual machine. When you talk about the malware analysis or to analyze or investigate it, ready hunting, so on and so on. Basically, you have the malware here, you will use a code inside of this specific environment, and you will see the behavior, but it's not only virtual machine. To see if this is, if this binary is malicious or not, you need to have inside of this send box, engines to see the behavior. Basically, it means, probably you already heard about what is virus total, is antivirus scanning. You have the binary, you're putting this inside of this antivirus scanning, and based on many engines inside of this antivirus scanning, you can see if this malware is malicious or this is the sample, actually, is malicious or not. So based on this engine inside of that, right? So send box, you need to have the same concept. The same concept. You need to have this engine inside of that. For example, you have many different open source projects like KUKO and like other, so I will show you during this presentation, right? So remember, send box is not only virtual machine, you need to have this engines inside of that, right? So, okay, before to talk about the structure of the PDF files, we need to see more about the structure of the binary. It's important to clarify those difference, okay? So let's talk about that now in my virtual machine, in live code here to you. Okay, so, sorry for that. So I have here many different samples. And some samples of this probably is malicious and other not malicious. So we need to check these and to see the difference between in one file or another. So let's check first of all, remember the flow identification step, you receive this binary, you need to analyze that. So I have here the Amazon file. So I will using file command to see what kind of type of this file is, right? The second file that we're using, I will check is Amazon doc.x, X, sorry, is a Microsoft Word is almost the same. Let me check my friend bill here. I have on a file bill is a PDF file. Let me check here, our doc Python. Maybe it's a Python script. Yes, it's a Python script. Let me check the sample, PDF is a sample and doc text is not a, is a text but it's a Python script but with a difference and another is a tar PDF is a PDF file. Okay. So take a look at this. We have a different binaries here, different files. So remember you receive this in your position.  So we need to look in more deep level of that. So, sorry, this is my point here. So what is important to see here in this conversation? Right. So first we need to understand if this file is really a malware or not. Let me check here, the file malware doc Python here, for example. Okay. Let me read first, not, I will not is a good thing self but it's not a malware actually. Let's check here. So let me try to as a good here, like a Python nine and malware. Let's see here. Okay. So it's a simple code in Python. Take a look this. It's a Python script. And if you see here, basically this is a some information that we have in the beginning and here we have another file. And by the way, if I change here, let me manipulate something here in this file. Okay. Let me cut here and I will save once again and I will try to as a good again, the same Python 39, not 39, Python three, block nine actually malware Python and take a look. This is the same. You see? So if you're using once again file, take a look the difference. So here we have a malware. We have this Python script. And we have here ASCII text as a curable. But here I changed something in the beginning. I cut this part as you can see here and we changing this information. So file identify the type of the file in a different way if you see here. So let me change the other thing here in this file. If I try to let me manipulate once again. Okay. Let me put here put here PDF or actually not PDF percent PDF. I think it's better. 1.7 maybe or I can use dash here. I think it's more. And then you save. Yes. And let's check if what happened here. Wow. Take a look this. So now we have a PDF document. And if I try to as a good once again in Python, we have a problem here because I have a distinct problem. Okay. Because now the file types is different is PDF. So take a look this. I have here PDF ID is a tool from the day Stevens. And I have a view here. And I will perform this. Sorry. Perform these tools as a cutting here analyze and specifically to search for some simple or some information inside of this PDF ID. So if you see here, I have a difference object. I will explain the difference between this during this conversation. But just to show you something, let me using this the same PDF ID or a Maurer doc Python. But Philip is not a Python is a next station. And I as a good thing something, but take a look this. Now this PDF ID identified this sample has a PDF. Even this binary having another extension, you see and take a look this. And let me check other, let me change something. Move Maurer doc to Maurer doc PDF. I will change the next station PDF ID. And I will try to see is the same. But if you see, I as a good in Python once again I will show you the content of this is continue to be the same is the same content, right? But when I try to use in PDF ID, this tools identified has a really a PDF file, you see? And file, the same case is a PDF document. I manipulate something inside of the binary. So my question to you is what exactly information I am manipulating inside of this binary? So think about that, okay? So let me change other things here. So nano Maurer PDF again, and I will cut here and I will save once again. And now I have the same content. I just cut in the first beginning of the information. Let me try to executing Python once again. Probably we will have some problem, but I will try our doc PDF. Let me try to as a good, probably I received some error. No, we don't ever, we ever hear why? Because the extension is different. So what happened here? So if I try once again, oh Jesus, now we have an ASCII text. And let me manipulate other thing here in the beginning of this file. Let me return here once again, sorry. And this is specifically being Python. I will copy here, let's check here. I will copy this as you can see, okay? And I will manipulate once again this file. Enter, I will pass here as you can see. I will save once again. File Maurer, take a look this. Wow, it's a Python script binary. Let me try using Python once again. So probably works now. Continue works because I need to write the correct way. So works here. So I change in here something and I will try again. Works again. So let me use in PDF ID because it's a Maurer, it's a PDF once again. And take a look this. Wow, it's not a PDF document. Take a look this. So something happened here. That's the point here of this object of this conversation today. So I am using different tools to investigate and to see the, remember I received this, remember in your situation. So you work in your company, you receive this file and you need to analyze that. You need to use any, I suggest you need to use, you should use these two in your analysis but you need to understand how each tool works. So here, let me explain about the file command. What kind of information, remember about my question, what information file you use, uses to collect this information inside of the binary. Here is the information collected by the file, okay? So this file have a magic number, probably if you are, you know, if not a beginner, if you are a senior, a plan, a medium guy, a medium analyst, or if you are a senior specialist, or you know, I don't know, principle, obviously you know about that about what is exactly magic number and each binary has a specifically magic number. It's some binary is difficult to manipulate. I made some manipulations actually in Python code and PDF it's easier in this case but file C in the each binary, the magic number, basically this is important information, they looking for this. And basically the magic, the file tools, actually this binary, this is a codeable inside of the system operation, the file using specifically database to find those information. And those databases is here inside of this specifically that inside of the system operation but of course it's compiling because of that you cannot see this information inside of that. But I download this information, this explanation I using by another researcher, my friend Fernanda Mercês, he has a specifically video explain many details about the file but in Portuguese language importantly but probably you can use in subscribe, subscription to see but I collect the idea behind of this from this video basically from Fernanda Mercês and I download the file database to share with you about how this works. So if you see here, I have many different database used by Unix platform. So if I cut here PDF for example, you can see here how many, sorry, how many information rules and strings the file comment using for a magic number. Okay, that's important thing here. Okay, as you can see here in the beginning, if you see here percent PDF dash, this is the string that you can see in the beginning. So if you read for a Python for example, take a look this, we can see here the beginning of the information. You see some information you can see in the beginning of the code strings and other things like this. For example, like user being Python and others and others, of course not only one but more than one that you can find in the specifically database that you can see here. So that's very interesting. So let me see for example, our JavaScript, what a very interesting thing. So if you see here in the beginning, dash being node, let me copy here and manipulate the last time here our document here. So let me return here in the mower folder, nano mower PDF, and I will cut here and I will paste and let's see what happened if I can do this the last one, file mower, take a look this and bow we have as a codeable. In this case, they using a different way but if you see now we have a JavaScript in different way because a script is a codeable. It's very, very interesting. So if you see here, other is a root, mower, a file, magic, and what is another, mag, mag, mag, dear, oops, mag, dear and JavaScript. Yeah, JavaScript. And you can see here, node JS for example, let me copy, manipulate once again, paste here and I will cut low just to put the JS in the end, actually file mower. You see is a node JS script. So it's very important thing. Other thing interesting here is about this informations about the structure of the binder. Of course I will talk more about the PDF but I will explain more about that, about the structure. If you see here in the manual, take a look this information is interesting here about the elf. We don't have a time to talk about the elf structure or PE portable executable but here we have a specific information about the format of the elf, the structure actually. So how is the difference or how you can find the array inside of these, how the information you can find these for example, let me copy here just to show you here in this presentation. So let me locate here. Now you pass here. Let me find here is the headers is what is located here is okay. It's here user, it's here. So I will copy here and I will show you simple this one. Better. Best. And take a look this, this file defining standard elf types is structure and macros. You see very, very interesting and useful information. Sorry. And here you can see how many bytes you have it you know divided in specifically a structure of the elf. This is the first one, the first array called for example, e identity is a first array that you have the 16 bytes and this specific array, you can find the magic number and others information. Again, we don't have a time to explain many things here but it's a top key for another talk. Okay, just to show it. So, oops, let me, oh, here, no, okay. So let's talk about the PDF structure because it's really important part of our presentation. So we have a physical and logical structure of the PDF. So usually you have a full parts when you talk about the PDF, okay? So we have a rather, it's very commonly in many different binary. We have a body and cross reference table and trader. Let's look more deeply about the four parts inside of the PDF, okay? So we have a specifically version header here. We have a, inside of the body, we have a page, image and fonts, like a shiny thing is inside of the PDF. In cross reference table, we have a specific locations of the object, either in the file for our random access, okay? It means that we have a specifically structure of this PDF. Let me share with you here. Oh, this is my GitHub basically. So let me, let's go to the DDA here, the Stevens, okay? This is the guy, the researcher, DDA Stevens, sorry. Here's the blog, his blog. We can find many formations about PDF and other structure. I would like to share specifically a picture. Okay, you can find here, but I think it's more easy. So here you can see PDF tools. It's a small ladder, but it's very nice. Tools that I'm using here in our conversation. Here is the fundamental elements. I think we can find here the information that I'd like to share with you. Fundamental elements, let's see if it's here. And I think yes, yes, it's here. So it's old, but the structure is the same, you see? So take a look at this, the header. So remember, the magic number is the header, percent PDF dash. So here is the old version that you can read. Here is the different objects that you have inside of this specifically PDF and cross reference table, okay? Four parts, and here is the most important to see how the structure works on the PDF. Take a look at this specifically picture because it's important. So here is how the object PDF works. So we have here the root object is the main object and you have a two trial object, right? Object two and object three. So if you've seen this picture, for example, those, these two objects, it's totally linked or referring this specific object one. You see like a three, okay? And this is specific object, object four. It's not related on this object, this reference object two, but only reference three, like object three, like again, like a big three, if you think about that, okay? So you see how this referencing which object in another object. So this is very important, you understand why? Because for example, let me explain about the PDF ID, in this case, BU is a one of these, because take a look at this, we have here 44 objects. So let's check PDF at four. It's another. How many objects is a PDF ID? How many objects we have here? So in this case, we have a six, no, 16. We have a 18 objects. So remember this picture. So each object is connected in the root object and other child object. Remember that it's very important you understand that because it depends on the specifically PDF, we have more than one object, one allies, okay? So that's the point here of this specifically is structured is a locations of the object eaten the fire. Not only that, but you have a specifically streaming. It's important part as you can see here. So we have here 16 or streaming to analyze. So if you see, for example, PDF ID in BU, I think we don't have any, in this case, we have eight streaming. Usually streaming in part of important that attacker using to putting something malicious inside of that. So that's, oops, that's important thing. Interesting. So, and the trailer basically is a locations of certain object eaten the body. Okay, so we have a part of this object eaten the body. That's a shine things like a faulty image, but usually you have some links like URLs, okay? So to, when you receive some PDF, you click in this URL, you redirected these access in a specific web page. For example, it's the part of the trailer information. Okay, so let's go to the specifically investigation that I made when I received specifically PDF. Let's go through this step by step. So I receive a specific object and I will receive the CDE ID. It's a, you know, resume actually. So it's very common for a recruiter, recruiters, okay? So remember, this is a part of important to identify if this object is a PDF or not. Of course, just to show you that's the important part. Remember, in the beginning of this conversation, explaining about how important you understand these bases. Again, probably you are a senior. If you are a senior or a specialist, you know about that. But if you are a beginner or starting to a studies of the malware analysis, you need to understand those base. This is very important, okay? So first of all, I check the PDF ID to see how many objects I have inside of this PDF, how many streams I could have and some possible special behavior. Okay, so I have here 15 objects, two streams, not only that, but take a look at this. Very interesting. If find reference of JavaScript, two in JS, three in JavaScript in one open access, but we don't know what is exactly open access, right? But you need to check this. Okay, cool. So the second tool that I'm using here is a PDF-parcel. It's another true from the DA Stevens. So we can use in here the dash S to see a possible specific information that you can find here. So I set dash Ash dash S JavaScript to check. Remember, we have three reference. So first of all, in object one, the second reference object seven, and third object is object 12. Remember, three JavaScript. And JS, remember, two reference. So if you see here, object 12 and object one, others two. So I'm using two different tools to check the same information you see. So my idea here is to show you those two different, the same informations in two different tools to check how important it is to understand how the tools works and how, what kind of information you can find this. The second flag or comment that I'm using here, using PDF-parcels is dash, I think it's W, or yeah, W, is to find for a round output data. Because my idea here is to look more deeply about the datas, not only, but about the possible streaming, right? Or to see more information about that, to read our raw data. Okay, first of all, we have an object one and take a look at these interesting informations. Remember that, so object one, the root, and you have a reference in object two, three, four, five, six, and seven. Remember this, not this, but this picture, object one referring seven until object, sorry, until object seven, exactly, that's correct. So remember this picture, object one, two, three, four, five, six, seven. Seven objects totally refer, reference it, or not reference, but link it on a specific object one, as you can see here in this demo, okay? So because of that, it's important to understand this flow. Sorry, this flow about that, sorry for this cough, but because I have a COVID in two weeks ago and I still have some problem, two weeks ago, no, in the last week actually. And okay, let's continue. So if you see here all those objects, so we need to analyze each object to see. And take a look at this, we have a specifically open action link it with this specifically JavaScript. And here it's not a JavaScript because we don't have an, we don't use now the correct tools to looking from this specifically information. And if you see here below, take a look this, we still have the information about open action, but Philip, what that means open action. So let's check if I have this information here. I think I don't have this information here. Yeah, we don't have her here, but I don't know if we have this information here. I would like to share with you this information in more details. Let me check it here. If I have here this information for, oh yeah, I have here, take a look this, what that means. Okay, nice. Oh, AA or open action, indicate an automatic actions to be performed when the page or document is view it. Take a look this important information. So indicate an automatic action to be performed when the page or document is view it. So now take a look this, the user or the recruiter or the talent accession person receive this resume or the CV or if you, of the people of the foundation receiving specifically invoice, when they receive it by email, so they need to check this email. They need to open this PDF. So this is the action, open the page, view document, right? So this is the action, the normal action, view document. But after that, when you find this open action, it means that an automatic action will be performed when this page is open, okay? So it means that something will be happened after this view. And the combination of the automatic action and JavaScript makes a PDF document very suspicious. So what we have here, an open action is a JavaScript link it, means it's a suspicious, it's malicious probably, right? So if you are an analyst here, so we can check this information, we can agree with me that is totally malicious, but let's continue our investigation, okay? So now we know what that means the open action and we need to find where or is where this JavaScript. So take a look at this other object, take a look at this font and research and image on here, other research, other reference, object eight and nine, remember the picture, okay? Reference, link it, other objects. So let me up here, the video. Remember this image here, okay? It's not this image, yeah, remember this image. Object four, link it with another object. You see an object seven is referring object 10, you see the image. So many childs for the specifically object, you see how important to understand this, nice. So in this reference, we have an object inside of this object 10, we have a possible JavaScript. So let's go more deeply, another information of the body, other information is about the body. So let's see, object 11. So remember we have a 15 objects. So inside of the object 10, we have another reference, object 12 here. And here is the first streaming, contain is streaming, not only that, but we have here the flat the code. So it means that we need to decode the content inside of this stream. And here as you can see the last is 36. In this case, it's not too big, it's small. So maybe we don't have any important information here, but we have two streaming here. So we need to find what other streaming or what kind of information we can find here. So here we have another object, take a look this. In the object 11, referring an object 13. Inside of this object 13, we have a what? We have an streaming. So inside of this streaming, we have a what? We have a JavaScript. So and as you can see here, the last, when you compare to another is too high. So it means that the JavaScript, probably malicious, we can find here in this specifically object. So this is, this should be our main object to investigate, okay? So we need to look more about that. So let's go to this specifically object, okay? So then another tool that I'm using here, it's PDF.tk. What is a PDF.tk? Is a handle tool for a manipulating PDF, okay? Or it means you can use it to, you know, creating a PDF, a merge of different PDFs, collating PDF and compress streaming pages and then compress or re-compress. Uncompress actually or re-compress. Remember, I have a content here inside of this streaming. So I need to uncompress this information. So that's my action here. So I have a PDF, CDE, the file, set the output or I will copy this information I passed here in the .txt and I will set the uncompress activity because my idea is to looking for the deep information, the content inside of this specifically streaming. Remember that in object 13, and here is the information is important. We find object 13, the left, we have a content. This is the first technique used by the attacker, the JavaScript obfuscated. So here is the JavaScript, but this JavaScript is obfuscated. So you need this obfuscated code. Basically it's the second action. So remember, we have PDF. This PDF has a JavaScript. Inside this JavaScript, we have a specifically open actions. Remember, when the user viewed this information, attacker will be using a JavaScript and here is the first technique using by the attacker, obfuscation technique using this specific. If you see here inside of this parenthesis, you can see specifically standard number like a, you see numbers and more below or not below, but if you see here inside of the parenthesis, as you can see here, ladders, numbers, other informations, as you can see here, so kind of standard information. So after that, I need to this obfuscate this code. Remember, so if they using obfuscation, I need to this obfuscate here. So I found here some specifically evil parameter and my idea here, if I have a JavaScript, I will try to rewrite this information using HTML. Basically this is the idea here. So I using this specifically open basic here to facilitate our demo, okay? So I will copy here and I pass here the document right. So you see, I will this obfuscate this JavaScript as you can see here. So this is the second action. So remember the attacker using the obfuscation technique, I will this obfuscate this code and let's see now what kind of information we can find here inside of this specifically code. So basically I will rewrite in the HTML file, I save and after that, I give the permission to execute itself in a web browser because my idea is to open here in the web browser, check what kind of information we can find here, okay? So I using Firefox to call this sample and let's see what happened now. Take a look this and bam, we have a payload. You know what that means? So probably if you again, probably if you know no problem but the payload is a part of code is a package responsible to download or to just download in the victim machine actually. And this package is responsible to execute the callback to the CNC commanding controller to make a response to the attacker, okay? So remember inside of this streaming, remember we have a JavaScript obfuscated inside of the JavaScript, we have a payload. This payload basically is the package that it will explore the victim machine. And after that, what I'm using here, I will see the standard, you know, ladders and percent. I will copy and paste here and I put in here in specifically file. And my idea here is to try or to find in specifically information. So I using set to cut this information because here we have now a pure code using by the attacker, the attacker using a specific unique code technique to encode information here. So and not only that, but I using here in Unix platform, but I using here in Windows too because I'd like to show you difference approach not only in Unix, but using Linux. So here's the same Maurer, the same artifact as you can see here. Take a look at this, the JavaScript obfuscated. And I will be using here another platform in use in Windows platform to show you those different. Okay, so here is the real payload. Remember, I will cop and I use set and when I using the Linux platform but here are you using mouse dealer, okay? So I will cop here and I will paste and I will share with you here what kind of technique using by the attacker. Remember I mentioned about specifically encode technique using by the attacker because remember we have a payload and the attacker using specifically encoding technique to encode this content inside of this payload. And this encoding, this technique using by the attacker is using by UCS2, okay? It's not new, it's old. Now the evolution actually we have a new UTF-16, UTF-32 and so on and so on. But before that we had UCS2, it's old, okay? So I using here UCS2 to generate here. So I will basically to decode this information to generate a exa decimal information as you can see here. And now I have an exa decimal file, okay? So after that I generate this exa decimal file in a binary. Why do that? Because remember this, not remember but usually the most of our more than 90% is for the Windows platform. So I generate this specifically binary to execute itself inside of the Windows machine. And after that I call, I use insure to search for a possible HTTP protocol inside of this binary to see if this binary will call something and take a look what I found here. I found the commanding controller from the attacker. So now we have an CNC, the attacker. Remember about the payload? Yes, the payload will be a callback or this is specifically CNC. You see how interesting it is? So if you pass here the IP address, you see this IP address is from Estonia, Europe, okay? So here as you can see, this is the information we found in this specifically file. So let me just to finalize this information. So if you see here, so many URLs related to this specifically attack. And if you see here, so they have a many victims machine explored by this specifically attack using PDF malicious, okay? So just to summarize this demo, actually remember the user received this PDF. This PDF has a specifically JavaScript side of that. This PDF is or was in this case obfuscated or JavaScript obfuscated inside of this JavaScript. Remember this JavaScript is eaten, the streaming, this content is inside of this streaming and we disobfuscated this information inside of that the attacker using specifically encoding techniques. Actually inside of the JavaScript, we have a payload, remember? The payload is a package responsible for this callback that is information actually this information, you know? So the victim machine to the attacker, remember that? Side of this payload, we have another technique using by the attack is encoding technique using ECU CS2. And side of that, we have a CNC possible for this explanation, okay? So here I can suggest you some books you'd like to read and study more about tomorrow analysis. So here are four books that I can recommend, right? About tomorrow analysis, our analysis techniques, ReadyHunt with Elastiki Stack and Practical Practical Intelligence and Data Driven 3ID Hunting. So four very nice books that I can recommend you if you would like to read and study more about that. And that's it, that's it. So I finished my presentation here. I hope that I can help you during this journey in our conversation. So if you have any question, so please let me know and see you in the next.


Welcome So yeah, I Hope you are all here to contribute to Cento Vestin Colonel And maybe not maybe you just like get inspiration Or maybe get scared away by what we have and what we have built Anyway today, I will explain how people external to to the rail or Red Hat Colonel teams can contribute to the Cento Vestin and by means of Rail taking the Cento Vestin to the rail colonel So first I will spend few words about what is the Colonel package in Cento Vestin It's a package as any other And right Except it has some specifics So it's it's rpm. It's basically it's actually set of rpms But the specifics are that the source repository for the Colonel the the The repository where the work is done is not the repository from which the rpm is built This is different to most packages in in Cento Vestin So it has separate Repository more than that later second difference is that the work on the Linux or the Cento Vestin colonel is Parallel so imagine like bunch of well number of surgeons Work in operating on the same body at the same time One of them is like maybe updating the circular system replacing arteries with something better While another one is replacing a leg At the same time. So there are some challenges. Yeah, especially when the arteries go to the leg They have to coordinate somehow So yeah, just to just to give you an idea how massive it is I checked yesterday So currently we have 149 Merch requests opened for Cento Vestin Colonel 9 Yeah Some of those have several hundreds of commits in in them Of course to have all of this to be manageable The the Colonel teams have to establish some some processes around that because yeah, it wouldn't work otherwise So there are custom rules Custom processes that needs to be adhered to if you want to contribute on the other hand the the benefit of all of this is that We basically need a dedicated person to maintain all of that to merge the stuff to take care of the pack of building the packages pushing that to the to the district to the to the repository from which the Packages are built. So we have a dedicated person or maybe even persons for that And they deal with the Cento Stream Processes themselves. Yeah, so the distribution have some processes But the contributors to the Colonel don't have to deal with those So we basically exchange one set of processes once of complex processes for another set of complex processes Yeah So this is the introduction in order to understand what What the work entails what are We basically constrained by let's first talk about the expectations So let's take a user user of Cento Stream user of rail. Yeah, what they expect from the Colonel Of course stability. What does that mean? That means no regressions Stop that work before should work after a colonel update, right? Well, it's more it's performance No performance regressions The user probably wants After update for this for his regular for their workloads to work as fast as they did before Yeah, so performance regressions. No, no No API changes, of course if you have a program if and then update the colonel You still expect your application or program to work. Yeah, and basically every application interacts with the colonel So the API is that the colonel provides the application should not change at all. Yeah, right? This is what you expect Well, then we have kernel modules You may be using third-party kernel modules and we the driver for example for your graphic card or whatever And you want those drivers to work after the update, right? So to the kernel update So the problem is that those modules those kernel modules the current drivers they are using the internal API of the kernel So you want this? Application binary interface between the modules and the current to not change at all, right? Well, it turns out that some people Want more not just the binary interface. They want the also the internal API Which means I take the driver source code From the old version update the colonel and compile it against the new canal and it should still compile Sounds seems sounds like the same, but it's like it's actually very different thing No behavior changes, of course. I want the stuff to run exactly as it was running before the update So yeah in shirt do not touch the stuff. I'm using Yeah, redhead, please keep your hands off the stuff my stuff and also Please bring me new features Yeah, we want the newest Chinese. Yeah, so please like yeah, give us what we need There's that new hardware we bought we want it to work in your next release So please update the drivers for us. Oh And we also heard about this cool new feature that upstream kernel has so please bring it to yeah Update the core update like yeah, dude, please update it. Please update everything you can Except for the stuff I'm using Don't touch that stuff Yeah, now do you see the problem that my stuff is different thing for different users So everyone wants to update everything except for this stuff. So this is the situation we're in We need a compromise. Of course, we cannot deliver all of that at once So the compromise that we arrived to It's a compromise. Nobody is happy about it But apparently people are still buying rail and using CentOS stream. So it's not that bad So the compromise is no functional regressions if something worked before it should work after the update Performance yeah, it's now we should not regress performance But imagine cases when you do something and you improve performance for 90% of users by a lot Didn't touch performance for 9% of user and for 1% of users you slightly slowed down There there were clothes. Is that okay? Is it not who knows? Yeah, so there's some kind of balance So yeah, but Probably slowing down networking for 90% of people or slowing down this story treats. That's probably not acceptable Then yeah, of course so the the user space API that the kernel provides to application that should not Not change, but it should not break Yeah, so we can change it if we maintain backwards compatibility probably or if nobody notices. That's okay as well, right? the Colonel modules Yeah, they should probably work but Here is a problem the the the kernel level of land upstream and the the community kernel it doesn't Doesn't care about internal API stability. It changes all the time the interfaces inside kernel and to the drivers They are constantly changing so if we are to Bring in some new features. We cannot keep this interface completely stable We can try to maintain some backwards compatibility, but it's like a lot of work and nobody's enjoying that work Cost a lot. So yeah, so we have to limit somewhere again. It's it's about finding a balance We also Are updating drivers Not all drivers obviously we don't have infinite people working on on the kernel But we are updating drivers, but again Sometimes updating a driver means bringing in a new kernel core feature that the driver is using So there are dependencies And it's not always easy because sometimes bringing in some new feature from a steam. It's it's it's risky Yeah, we risk stability. We risk introducing regressions. So again, it's kind of balancing act So we might update drivers, but maybe not Enable all the features that the hardware support supports and of course we updating the the kernel core features again Balancing that with stability not everything is possible without compromising the other stuff So yeah, as I said nobody is happy, but hopefully it's good enough for everyone How Does this work in practice? When we started and now I've been talking mostly about or basically only about so CentOS stream 9 But it applies to also the other other streams So for CentOS stream 9 we we had when when the development started there was a kernel was 5.14 and The CentOS stream 9 is still on this kernel Yeah, even those years later. So we have kernel 5.14 But we're back porting stuff for upstream. We are taking comets from upstream and applying them to the to to the kernel And that ranges from single bug fixes for like simple stuff single features to like a large basis of whole all drivers and whole subsystems So for example for you to know what I'm talking about the XFS file system is up to the upstream kernel 6.0 the USB subsystem all drivers the core like everything is Up is on par with upstream 6.2. You know the latest kernel in the upstream is 6.3 So this is pretty new BPF subsystem. Yeah, this is pretty core stuff That's like connected to really memory management and all of that It's 6.2 in the kernel in the current CentOS stream 9 wireless including all drivers 6.3 multi-party CP 6.4 that kernel is not even yet released upstream Yeah, so you see all the different stuff is Kind of suits into the kernel. You have replaced different version and yeah So maybe you get the Frankel kernel Temminology now or technical term now. This is what we have It works it works but oh One thing one thing I forgot and I will stress its multiple times We are taking stuff for upstream. That means everything almost everything We strive for everything that we have in CentOS stream to be upstream. You're taking stuff from upstream Everything is to be upstream first so as I said all of this can Stick together and work reasonably only thanks to Thanks to Several things first is the processes we have around that I will talk about in a minute and the second and very important thing is testing So this is the testing that happens Whenever a single change Be it a single bug fix or that large rebase whenever it is applied to CentOS stream kernel first testing Happens when a developer does the work. So when we back port stop from upstream Yeah, or when we develop stop upstream and then back for it. So this is where the first testing happens Yeah, obviously nobody wants to just push over the fence untested stuff Then Automatic testing kicks in. Yeah, we have CKI There were talks about CKI in previous devcoms. If you are interested you can find the recordings online. So this is Continuous kernel integration testing large test with a lot of infrastructure around that. So this is this is run We have an a Steve Linux network stack testing Which is specifically for testing networking perform both functional performance and We're adding more over time So this is run automatically then there's pre verification which means before the change can be merged to the kernel a human and Hopefully or maybe automation if it's there if there is automation for the particle feature or particle bug But someone someone else then the original outer and it's this is important Tests this and if it passes only then This is merged to the CentOS stream kernel Then there's integration testing because it's nice that you tested one feature or one backfist in isolation But it can interact with those other 150 Parallel changes to the kernel in weird ways. So once this is merged We need to test again to see whether it did not conflict or did not like good influence by other stuff in negative way and last thing is proper QA testing done by QE engineering. That's like really comprehensive testing of the whole kernel and all the features and I think so that's a lot of testing Okay, so bit that good. Let's Let's Look how it looks from the point of view of the contributor to CentOS stream kernel The centerpiece is the merge request We're using githlap for CentOS stream not just CentOS stream kernel, but the whole CentOS stream development So this is the URL of the CentOS stream 9 kernel source repository. So this is where the development happens It's completely public you can go there You can watch what we are working on and of course contribute. So merge request Against this is repository. That's that's basically the the the the centerpiece Which around which everything is built however before You can Open a merge request you need to do one important thing and that is to file a bug or issue Every change we do needs to be tracked So you go to bugzilla or jr. Doesn't really matter File a bug or open an issue there Be sure to select the proper product component subcomponent Product Red Hat Enterprise Linux 9 Component obviously kernel subcomponent in bugzilla. Whatever you think is the best fit The reason for that is you want your change your merge request to reach the the proper team and In the bug or in the issue explain Why you are doing that explain the benefits of it Why it's important If you if you come as a contributor to CentOS stream kernel, it's not The the amount of work That is connected to the computer contribution. It doesn't end with Submitting patches submitting commits There's more just testing I talked about someone has to do it and there's maintenance Someone needs to maintain that stuff for the all the whole period where Well, that's my edit edit Enterprise Linux is maintained. Which is many years Yeah, so Submissions don't come for free for red hat So explain benefits explain why the change is good and Also, because it means work for other people Try to make it easier for them provide detailed testing steps Yeah, so the so the QQ QQ quality engineering Is okay with the change because they know okay. This won't be that much work for us Don't forget to to note that you will be submitting the Mange request So you are not asking the developer to do the work Yeah, make it easier for them and Be mentally prepared for the option that it might be rejected So we have a bug or issue Then now let's do the work We clone the repository as usual from good lab Starting create our own branch based on the main branch This is where the like the main branches where the where the development happens Apply our patches Now let's stop at that The and now this is the first the first thing about the processes the The commits the commit messages They have some mandatory format. I will explain it in next on the slide So it's not like freeform commit message So that's first thing second thing apply upstream commits one to one So one upstream commit is one CentOS stream commit do not squash commit together and of course It's a Frankenkernel, you know, so it's unlikely that commit from upstream will apply as is to send to a stream kernel Most likely or some commits do if you're lucky, but most likely you will have to do some changes Adjust to the old APIs that are there or something Those changes need to be explained. Yeah, there should be like reasons why Your why the the the backport differs from the upstream Let's look at the example. This is a real commit from CentOS stream 9 and Let's see It's first the mandatory fields mandatory format. There must be a bugzilla or Jira link in Every commit every single commit must have this line and In this format. Yeah, it's it's parsed by machines. So even like training white space is a problem. Yeah You will be taught so it's not like It's not entirely black box more on that later. So this is the first thing second thing every as I said The the police there is upstream first policy So everything that we bring to a CentOS stream kernel must be upstream this line actually says This is the hash of the upstream commit. This one is backport in Yeah, so and again exactly this format. It is parsed by machines Third thing that's mandatory is the signed-off byline which has some legal implication If you're not familiar with the certificate of certificate of origin see the documentation must be there and Here I will point out this section. This is not passed by machine. This is for human consumption for reviewers Yeah, so this is free form except the conflicts line that like must be in this form Explains what was changed compared to upstream? Yeah, so this is this is an example how it looks like So you apply patches and then you can finally submit submit Merch request. Yeah, the usual GitLab workflow nothing you Are not familiar with so basically you fork So at remote push to your remote open match request using web UI or API and you're done almost In the match request description, you have to repeat two things the bugzilla or gilaring and your sign-off byline when you do it then the automation Kicks in on GitLab A Colonel is built and it's tested if you are an external contributor Then then only a limited limited tests are run It's not not full test. It's for security reasons Once your submission receive reviewed by someone from Red Hat They will start the the complete pipeline We don't want the the code compromised by a External contributions obviously Then also some some automation is is run which Will do checks on the submission. It will check better the fields I describe like all that bugzilla entry and so on but it's present. If not, it will it will tell you in a comment in the Merch request It will check whether the bugzilla or JIRA issue filed whether it's in proper state There's something you cannot influence someone that has to put that in the in the correct state the bug or issue Another check is for missing fixes So if you backported something from upstream and there was a follow-up upstream that fix that you will get and it's not there It's not in your submission. You will get notified It will also check for conflicts between submitted much requests It is quite important given the amount of magic quest we have then There will be some labels at it Actually quite a lot of labels. So this is an example of one magic quest There are Subsystem labels here basically those indicate which Subsystem were touched or very modified by your submission. This is a large magic quest. Yeah It has I don't know like Three or four hundred commits. Yeah, so it touches a lot of subsystems There are labels with the current state like exnet needs review or CKI and so on It will also add approvals to to to git lab to the magic quest meaning The list people who should review the magic quest and it will notify them Then a review then review happens. This is important part But there's nothing surprising so someone from redhead or from community Will review the commits you submit it Will make comments Now it's important to to respond to the command if someone has objections or ask for ask for explanation Provide that the discussion happens in the in the magic quest. Yeah in the in the comments there and When finally when it's reviewed and I think I was ready The merge request is ready for QE testing. That means you get all of these labels in the okay or warning state Adversed so your commit description is okay. No merge conflicts. This the CI testing succeeded and The somebody or like all the approvals were given the all the needed reviews were done Then and bugzilla and JIRA is like in Prepared for testing state you get ready for QA Then the testing happens The pre-verification again done by someone else than you You will probably agree in the bugzilla or JIRA who will do the testing whether will be redhead or whether Someone from your company or your friend provides or your friends provides the testing whatever Then if that then is done, then you get bugzilla or JIRA. Okay ready for merge and boom It's merged or the main tender will match it One short notice Sometimes if the for example if there is a driver update it might depend on other changes in the kernel yeah, so if you for example update the Networking driver your favorite networking driver to the newest version It might need some changes in networking core to support new protocol perhaps or something So that's a different merge request. Of course. It's not the same stuff so different merge request needs to be filed for that and To save us time you can actually submit those merge request in parallel You can depend on other merge request, which is not yet merged by pulling the code Applying your purchase on top and Submitting that the only thing you have to do is put this line to the to the merge request Description that you are depending on this particle and other merge request and then The the automation we have will be able to figure it out Find out that like what is the first commit that is really part of your merge request So that's like top of the dependencies will put this label there and then you're good The only problem is good lap is not aware of that. Yeah, this is a feature that is missing in the lab So we out we implemented it ourselves and as a consequence. It's really hard to impossible to to use the web UI I Will yeah, okay 15 seconds We have tools that will help you with that lab is a CLI tool that helps with submitting merge requests And we have review metric, which is a custom tool that helps with reviews that understands the workflow we have So that's it Here's a link for full documentation process if you're interested in details and now questions Yeah, so the question was that by doing the backports We are repeating the work that upstream does with the with the LTS kernels And better it would not be easier to use them Yeah the problem is that the That the the quality of the upstream stable kernels is not satisfactory or a distance we found There are things like machine learning involved which selects which commits are back ported and also basically whatever someone thinks is Decisible for those table kernels strewn over the wall and applied and It does not mean this does not meet the stability and no regression warranty guarantees we need So we really want all the stuff that's going into that to get reviewed by us Yeah, and to be tracked to to have someone who's responsible that's like we can go back to say okay Yeah, look you broke it. You fix it. Yeah So all of it together You found out it's like for stability. It's it's yeah, it is basically no go Yeah, there's question Yeah, so the question was what? What is what the integration testing consists of what what what it is? Basically right now, it's it's sick. It's done it by CKI again, but it's like a larger battery of tests There's a lot of different tests with that I don't remember of the top of my head, but they are there's a TP and like many more The question was there whether they are open source. I believe so I'm not 100% sure of everything, but I think so And Please don't like yeah, I'm not sure I'm not sure. Thank you


Hello and welcome to the session. My name is Mansi and I'm going to help you with the following question. The question says write 7 consecutive composite numbers less than 100 so that there is no prime number between them. In this question we have to find 7 consecutive composite numbers less than 100 so that there is no prime number between them. Now let us start with the solution to this question. We see that 7 consecutive composite numbers less than 100 so that there is no prime number between them are 90, 91, 92, 93, 94, 95, 95 and 96. So this is our solution to this question. I hope you understood the question and enjoyed the session. Have a good day.


Have you ever wondered what people think of you? Why do people treat you in a specific way? Could it be because they find you attractive? Let's put your mind to ease and take a look at signs you are secretly attractive. 1. Others go out of their way to help you. Do your coworkers often offer to help you with your tasks? Do people jump at any opportunity to help you with the problem you're having? People are more likely to come to your aid when they are attracted to you. They naturally help you as they are curious about you and would like to get a chance to get to know you. In essence, the people attempting to assist you are trying to make themselves look good in front of you to earn your good opinion as you have earned theirs. 2. People are shocked that you have insecurities. It's natural to have insecurities, yet one must make sure that they don't take over.  People think you've managed to sidestep all the common insecurities just by looking at you. Since you appear self-assured and capable to them, they're quick to assume that everything is perfect on your end. This is why most people are astonished when you say you're insecure or desire to change some features of yourself. But the truth is that everyone suffers from low self-esteem at some point in their lives. If you often shock people when you speak about your insecurities, it may be a sign that they find you extremely attractive. 3. You're good at expressing yourself. Are you adept at expressing your opinions? Do you always manage to say what you think? The more at ease you are with yourself, the more you're not concerned about impressing others. The culture powered by social media may make it seem imperative to gain the approval of others above all else. So it takes a lot of maturity to realize that this urge to impress others isn't important at all, and that being helpful is more essential than going viral or being praised. When you stick to what's right, rather than caring about what others will say, your confidence makes you very attractive to others. You have wholesome conversations with people. Let's not forget that attractiveness isn't solely determined by your physical appearance. Sure, it's a fantastic place to start, but being attractive is about so much more than how you look. You're not just appealing, but you're also a terrific company if you find yourself having incredible discussions and amazing banter. If you have a way with words, then there is a good chance people are attracted to what you have to say. Number five, you don't want attention. Have you ever observed that you get a lot of attention? When you wish to spend some alone time, for example, friends call to arrange a meeting or your family might invite you over. What does it mean when it happens frequently to you? Well, it simply indicates that people regard you as dependable and stable. They know they'll get something valuable if they ask for it, so they take as much as they can. They stay around you for the genuineness and positive vibes you bring along. Number six, you often catch people staring at you. Meeting another person's gaze, especially if it's sustained, can be a sign of attraction. In casual conversations, if others lock their eyes with yours for a very long time, it might be because they find you interesting and don't want to miss anything you do or say. People may also make eye contact with you without realizing it since they're staring at you. When you grab their attention, they may swiftly avert their sight and appear uneasy or nervous. Number seven, people open up to you easily. Are you a personal favorite secret keeper for them? People tend to divulge more personal and sensitive information with those they find attractive, whether it's to develop a connection or simply because you appear trustworthy to them.  The signs mentioned are just a tip of the iceberg. Human nature is complex and therein lies its beauty. Beauty is far more than skin deep. It's what's on the inside that matters most. You're more than just your appearance. It's important to look beyond the surface and cherish what makes you who you are. Do you know any other traits that others may find attractive? Feel free to leave a comment with your experiences, feedback, or suggestions. If you find this video helpful, be sure to hit the like button and share it with others too. Don't forget to subscribe to Psych2Go and hit the notification bell for more new videos. Thanks so much for watching.


to our committee in the last year and particularly Aalish Kennedy and Fiona Malley and they've really they're brilliant they've just come in and they get it and they're really interested in this and Aalish came and said look why don't we make a you know why don't we and really what maybe I should start at the start is to say we'll call it the power of one what can you do and it's it's a big making small changes that everybody can look at what you can do and it's maybe one small thing it can be turned down your thermostat it can be picking up a bit of litter on your way home it can be anything small it could be donating a bag of clothes to a charity shop it can be repurposing and upcycling clothes using a water bottle a reusable water bottle it can be what you're going to see we're all going to see come into the country now is a lot more reusable coffee cups because you're going to pay for the for the coffee coffee cups just things like that these are all simple things that we can all do we just but I suppose we have to make a conscientious decision to to do them you say listen well that's easy don't I can do that and I can do that every day or every week we're just asking people to think about it and what small difference can they make in their day and as part of this campaign just to maybe explain it a wee bit is that we commissioned a professionally made video which shows how you can do things and the power and it's a little story attached to it so that's what we're launching it's very simple video but it's powerful because when you think about the message behind it you go oh yeah yeah that works it's simple it's simple and then we will take it then and we will promote on social media over the over the next few months little ideas encourage the you know the local community to share their comments and to share their photos around the hashtag hashtag power of one LK and and just you know that we can get people engaged and we can show them little examples and just get the conversation going and in a in a simple local way so this is each out of there about about the environment and about sustainability and about climate change and these are these are global issues but this is dealing with it at a local level and in this case it's letter Kenny and trying to pull people together and and and going right down to each individual yeah in the area thinking is there something small I could do yeah or getting the message to those people saying please just think about something that maybe you could do yeah when English came with this idea when the more she explained it to me I thought this is exactly what tidy towns is about this is what we do we go and we look at something and we try and improve the area in small little ways and you add everything up and it becomes something you know and that is isn't that it yeah you add it up and I come something much bigger yes so that's the whole thinking behind it this isn't just a one-off campaign something that's going to last for a week or a month we see this last and right in we're ongoing we would like to we've created it in a way that we it's something that we can use on social media to create awareness and for look for a reaction for and just becomes part of our normal life so we see this as a slightly more long-term thing than something within a week or a month so the hashtag again is hashtag is power of one okay so if someone's doing a little something just recycling upcycling reuse no water bottle whatever it is and they want to you know take a photograph or a short video or whatever use the hashtag spread the word spread the word exactly okay if someone's listening in and think and they're around a lot of Kenny area or in the town and they'd like to get involved what they're thinking you know what if I go forward there I'm gonna be gathering rubbish until the cows come home and I just want to have time yeah it's not it's not like that you know if you have time go to a meeting if you have an hour and a Sunday morning go down to market square just any wee bit helps we have some of our most active people never attend a meeting because they don't want to attend a meeting they've no interest in it and I say that's fine you know there's there's people attend meetings is people that don't attend meetings I think about tidy towns is and it's a great organization it's the sort of thing you know even when people do join us we say to them look come in and join us and don't have to do anything just listen and sort of find what you're interested in and what you're interested in going you know go and interest go have a look at that I mean we've people in there in our committee who are interested in litter control we people are interested in gardening we people interested in biodiversity we people interested in sustainability and they can really pick what they want out of it and some people just say well I would like to give some of my time but I don't know when that will be some of them some people will come down to Neil the 1030 and Sunday some people will do it in their own time it could be a Tuesday morning and they'll send a text into Neil what they've done and they'll coordinate it so it's a very open sort of people do what they want to do because people are busy as well and we're very happy and we're very inclusive like that we're you know anybody wants to do something we just say thank you you know and that don't work around it and if anybody wants to just find out what's going on in the community and that's grand but generally speaking well someone goes to the bother and they do find out they want to get involved in some small way they do yeah yeah all right then and a presence on social media on on Facebook and there's the website as well at a tiny towns yeah yeah tinytowntown.com this this video to launch the initiative will be on Wednesday evening will be a good place to start if anybody wants to get involved 7 o'clock yeah it's a thing that we it's actually a bigger event it's a sustainability community sustainable community letter candy event so there'll be a talk about upcycling and how examples of how you can upcycle clothes and how to reuse and reuse and re-purposed your clothes and there'll be talk as well from climate action and change makers will be there as well doing a little bit of talk about the system that's within change makers and the pathway that we can has a town can improve versus the inability so it's just an event to start at 7 o'clock but it is a ticket event but it's a free event through Eventbrite so tickets are available register just you just register you know because we need to have we need to have to to close down the numbers possibly even by this evening because the hotel needs to know numbers and whatnot so that's really what we do and we've had a few of these events in different spheres you know we had one on biodiversity and this is our sustainability one under just nice events you know and we launched the video that night as well okay that's just coming Wednesday at 7 o'clock we'll do Eventbrite if you'd like to register to go along Jared thank you thank you John thank you for having me


Hello and welcome to this explainer video on how to get started with the STM32 Nucleo motion and environmental sensors expansion board using the ARM embed environment. We are going to explain how to get your application running in the ARM embed environment. The first half of the video will focus on the software setup and the second half will detail the hardware functionality available. Connect the STM32 Nucleo board to a PC using a mini USB cable. The board is automatically detected and seen as a disk drive. Now connect to the ARM developer dot embed dot org website and log in with your credentials. Click on hardware, then components and select environmental under the sensors category. Click on XNucleo IKS 01A2 motion MEMS and environmental and find the Hello World IKS 01A2 and then import it into the online compiler. Open the main program and choose the desired target platform. Add a new one if needed. At this point build the application and download it on the STM32 Nucleo board. Once downloaded the application will reset and start. You can also reset the board by pressing the black button as shown. This simple application shows how to get environmental data like humidity, temperature and pressure. It also displays the inertial data from the accelerometer, magnetometer and gyroscope. Information on how to obtain the board can be found on www.st.com.x-nucleo under the reference XNucleo IKS 01A2. This board includes a variety of MEMS based components. An inertial module composed of a 3D MEMS accelerator and a 3D MEMS gyroscope. A MEMS based combination 3D accelerometer and 3D magnetometer. And a MEMS pressure sensor and a relative humidity and temperature sensor. Thanks for watching this video. For more information on all of our expansion boards please visit www.st.com.x-nucleo.


Perfect kick. No way. I get a perfect accuracy on a perfect accuracy. So here we go boys last season Playoffs Minnesota Vikings on the road against Green Bay who we've played a lot who we had we were on a losing streak against Green Bay We popped the out of them over there in week. Whatever it was to get the playoff run going We're super hot now right now We're playing our best ball of the season with the Minnesota Vikings right now last playoff run Here we go boys. Remember in the YouTube video. Let me know if you guys want to see CFM in Madden 24. Is this something we do now? Also, I'll ask you guys this question as it has been a big topic in the CFM community Do you guys want a fantasy draft which I want a fantasy draft?  Some people like regular teams like I might get the Browns try to bring them back to you know Their legacy days or something like that, you know, so that's been the question I'm team fantasy draft some people like regs, but you know for me I like the draft honestly, but we'll see I believe the CFM will start a little bit after the first tournament I don't think it's gonna be a launch thing right away. I don't not doing too. I'm not doing too I think one thing I did wrong this year was getting into a bunch of CFMs Now honestly, I wanted to play them because they were the Eagles and I was like, you know I'm still a football fan, but I don't think I'm doing more than one CFM I think it's easier to follow one CFM all year. Honestly, we're you know, we're gonna mud it up But we are 100% so this is Mark Andrews. We gotta try to stop Patrick Mahomes You see it as 99 offense 99 defense. We feel good just over to Mark Andrews Patrick Mahomes We got Kyla Murray Patrick player move. I feel good on defense. I don't know if he changed anything I think I really set the meta here with the short knockouts in CFM, you know We weren't stopping anything in man coverage anyway deep down the field So like what's the point of deep knockout?  Come on. Thank you, man. Hold come on So boys, are we serious right there? Did we just get shredded that We did work a free 1-0 free 1-1. We literally did we went from from bunch. We audibleed We got a free 1-1. He just got not got a knockout. Was he lucky? Someone say yes Do I have secure protector?  I really I really knew on first down after running the ball I would be able to get no good pass coverage out there a one-on-one opportunity. I got it Oh I'm playing defense though. I really am dude. He's like max protecting. He's so like who slants in the streak like Why am I pass blocking right now? Give him p.i. He give him intentional grounding. He's 20 yards back in the pocket. Just chucking the ball up Once again max protect. Come on, man. I feel like you've got a kick, dude This is so tough to not to go for this short knockout. Let's go man I almost didn't call time out there too because I was kind of cool going to halftime three to three I'm playing really good defense, but like it's hard to stop these guys from scoring touchdowns Obviously he's got two drives and zero points. So I almost didn't call that time out with 26 seconds I'm glad I did but you know, I didn't expect he I mean he just runs spinner Like a moron when I only have two plays to get in full range. We're just in spinner That's a good catch by muth though.  You got to try it, you know Dude, that's literally why I motioned the extra person to block the slot corner there That's why threat detector is so OP. I didn't want to call that play until he read blitzed everybody Once he read blitzed, I knew there was nobody on the running back threat detector is absolutely terrible for madden It should not be in the game Look like this like dude, I don't know he like I swear to God his guys are on the Juice, bro.     Come on Nobody open dude and lose the game right here, dude Honestly, maybe you don't I mean dude his d-line is I I have no idea what happens Like I have no idea how his d-line is on this much of a juice, bro. Am I tripping? Yeah, but I've run the ball so much. He's past committing bro. I mean, we're just gonna run here He's gonna call time out I'll kick a field goal 12 to three He'll need it. He'll need an onside kick the one perfect kick No way I get a perfect accuracy on a perfect accuracy There's no way on perfect Accuracy you got to be joking man There's no way. I thought I thought we get pert dog. There's just no way man Absolutely nailed that bit and we get a we get that. That's what we get Absolute nails right there Absolute professional gaming Nails, dude for what boys for what that's just brutal the way to go. It's just beautiful. It's just brutal Absolutely perfectly kicked executed play right there.  He sucks About my game man 99 99 99 99 What a play What a play was that fire move that made that tackle y'all lying Was it move that made the tackle on the on the kickoff team move was on the kickoff team And made the tackle of the season That's football dude That is football boys gg though ggs. Let's see it. I gotta watch the highlight. We gotta watch the highlight now Dude, was it this was a bad game I can't believe now listen. I thought when you smoke a field when you absolutely nail a field goal like that They can't block it. Did you guys do you guys feel like that? I feel like that's been in the game for a couple years When you get the perfect kick, so I didn't even hold that's my fault I didn't even hold it but because I was a little bit nervous because honestly when you have a lot of people watching You're like damn if I miss this I don't really I don't think I've ever missed the field goal like a big field goal But like it's nervous and shit because it's like this game's over if I make the field goal I don't want to miss it right and I'm nervous a little bit So I was nervous about the field goal. So when I hit perfect, I'm like, I'm good I got a why would I kick full power on a little 30 yard field? You know what I'm saying like so I don't want to kick full power because then the speed is so much more So when you I'm out here, what's this a 47 yarder? My kicker's got like 97 kickers like mutt. So I did like 80 power and it was so perfect Then I felt so good about it because I was a little bit nervous.  Oh, he missed look at mooth misses the scoop and score Hawks him down from the depths We benched them a little bit this year.  It all comes back to the man that started the cfm legacy of the vikings