paladin316

Exes_cc49f7279b049c08b6d2aaf2939a1cc6_exe_2019-08-07_11_30.txt

Aug 7th, 2019
2,500
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 16.82 KB | None | 0 0
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_cc49f7279b049c08b6d2aaf2939a1cc6.exe"
  7. * File Size: 1241088
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "2f096033f86f1724b9eff06654a45bdf8eeb928d38fd83a591c53649878f0829"
  10. * MD5: "cc49f7279b049c08b6d2aaf2939a1cc6"
  11. * SHA1: "dfa5a0158b1dbb46c5b0259a98e6dfe9530da16e"
  12. * SHA512: "bc2ff81fcd575200f1611ec1087e628bef05433e76dbb5444e3389f8dcbaf0168c843f99f8abda4b38723312778ec0937ed7d72231268e28a78e0f2e9e90fa46"
  13. * CRC32: "60C4A69A"
  14. * SSDEEP: "24576:VAHnh+eWsN3skA4RV1Hom2KXMmHaBQaygWOD3x+MhJExFiO45:Eh+ZkldoPK8YaBQaygWO7x+cJ"
  15.  
  16. * Process Execution:
  17. "Exes_cc49f7279b049c08b6d2aaf2939a1cc6.exe",
  18. "RegAsm.exe",
  19. "schtasks.exe",
  20. "svchost.exe",
  21. "WMIADAP.exe",
  22. "svchost.exe",
  23. "WmiPrvSE.exe",
  24. "svchost.exe"
  25.  
  26.  
  27. * Executed Commands:
  28. "\"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7948.tmp\"",
  29. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  30. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
  31.  
  32.  
  33. * Signatures Detected:
  34.  
  35. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  36. "Details":
  37.  
  38. "IP": "79.134.225.117:2114"
  39.  
  40.  
  41.  
  42.  
  43. "Description": "Creates RWX memory",
  44. "Details":
  45.  
  46.  
  47. "Description": "A process attempted to delay the analysis task.",
  48. "Details":
  49.  
  50. "Process": "svchost.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  51.  
  52.  
  53. "Process": "RegAsm.exe tried to sleep 1123 seconds, actually delayed analysis time by 0 seconds"
  54.  
  55.  
  56.  
  57.  
  58. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  59. "Details":
  60.  
  61. "ioc": "v2.0.50727"
  62.  
  63.  
  64.  
  65.  
  66. "Description": "Expresses interest in specific running processes",
  67. "Details":
  68.  
  69. "process": "svchost.exe"
  70.  
  71.  
  72. "process": "RegAsm.exe"
  73.  
  74.  
  75.  
  76.  
  77. "Description": "Reads data out of its own binary image",
  78. "Details":
  79.  
  80. "self_read": "process: Exes_cc49f7279b049c08b6d2aaf2939a1cc6.exe, pid: 2792, offset: 0x00000000, length: 0x0012f000"
  81.  
  82.  
  83. "self_read": "process: RegAsm.exe, pid: 2468, offset: 0x00000000, length: 0x00001000"
  84.  
  85.  
  86. "self_read": "process: RegAsm.exe, pid: 2468, offset: 0x00000080, length: 0x00000200"
  87.  
  88.  
  89. "self_read": "process: RegAsm.exe, pid: 2468, offset: 0x00000178, length: 0x00000200"
  90.  
  91.  
  92. "self_read": "process: RegAsm.exe, pid: 2468, offset: 0x0000a720, length: 0x00000200"
  93.  
  94.  
  95. "self_read": "process: RegAsm.exe, pid: 2468, offset: 0x0000a73c, length: 0x00000200"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "A process created a hidden window",
  101. "Details":
  102.  
  103. "Process": "RegAsm.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp7948.tmp\""
  104.  
  105.  
  106. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  107.  
  108.  
  109.  
  110.  
  111. "Description": "The binary likely contains encrypted or compressed data.",
  112. "Details":
  113.  
  114. "section": "name: .rsrc, entropy: 7.91, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00064a00, virtual_size: 0x000648f8"
  115.  
  116.  
  117.  
  118.  
  119. "Description": "Executed a process and injected code into it, probably while unpacking",
  120. "Details":
  121.  
  122. "Injection": "Exes_cc49f7279b049c08b6d2aaf2939a1cc6.exe(2792) -> RegAsm.exe(2468)"
  123.  
  124.  
  125.  
  126.  
  127. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  128. "Details":
  129.  
  130. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe:Zone.Identifier"
  131.  
  132.  
  133.  
  134.  
  135. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  136. "Details":
  137.  
  138. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  139.  
  140.  
  141.  
  142.  
  143. "Description": "Installs itself for autorun at Windows startup",
  144. "Details":
  145.  
  146. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\udNFHVsAmQ"
  147.  
  148.  
  149. "data": "C:\\Users\\Public\\udNFHVsAmQ.vbs"
  150.  
  151.  
  152.  
  153.  
  154. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  155. "Details":
  156.  
  157.  
  158. "Description": "File has been identified by 45 Antiviruses on VirusTotal as malicious",
  159. "Details":
  160.  
  161. "MicroWorld-eScan": "AIT:Trojan.Agent.EBPO"
  162.  
  163.  
  164. "McAfee": "Artemis!CC49F7279B04"
  165.  
  166.  
  167. "Cylance": "Unsafe"
  168.  
  169.  
  170. "Alibaba": "Trojan:AutoIt/AgentTesla.784ebfbf"
  171.  
  172.  
  173. "K7GW": "Trojan ( 00554f8c1 )"
  174.  
  175.  
  176. "K7AntiVirus": "Trojan ( 00554f8c1 )"
  177.  
  178.  
  179. "Arcabit": "AIT:Trojan.Agent.EBPO"
  180.  
  181.  
  182. "Symantec": "Infostealer"
  183.  
  184.  
  185. "ESET-NOD32": "a variant of Win32/Injector.Autoit.EEN"
  186.  
  187.  
  188. "APEX": "Malicious"
  189.  
  190.  
  191. "Avast": "Win32:Malware-gen"
  192.  
  193.  
  194. "Kaspersky": "Trojan.Win32.NanoBot.njl"
  195.  
  196.  
  197. "BitDefender": "AIT:Trojan.Agent.EBPO"
  198.  
  199.  
  200. "Paloalto": "generic.ml"
  201.  
  202.  
  203. "AegisLab": "Trojan.Win32.Ebpo.4!c"
  204.  
  205.  
  206. "Tencent": "Win32.Trojan.Nanobot.Szlh"
  207.  
  208.  
  209. "Endgame": "malicious (high confidence)"
  210.  
  211.  
  212. "Emsisoft": "AIT:Trojan.Agent.EBPO (B)"
  213.  
  214.  
  215. "F-Secure": "Trojan.TR/Autoit.etlbx"
  216.  
  217.  
  218. "DrWeb": "Trojan.PWS.Stealer.23680"
  219.  
  220.  
  221. "Invincea": "heuristic"
  222.  
  223.  
  224. "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.tc"
  225.  
  226.  
  227. "Trapmine": "malicious.high.ml.score"
  228.  
  229.  
  230. "FireEye": "Generic.mg.cc49f7279b049c08"
  231.  
  232.  
  233. "SentinelOne": "DFI - Suspicious PE"
  234.  
  235.  
  236. "Avira": "TR/Autoit.etlbx"
  237.  
  238.  
  239. "MAX": "malware (ai score=85)"
  240.  
  241.  
  242. "Antiy-AVL": "GrayWare/Autoit.RunPE.a"
  243.  
  244.  
  245. "Microsoft": "Trojan:AutoIt/AgentTesla.SZ!MTB"
  246.  
  247.  
  248. "ViRobot": "Trojan.Win32.Z.Agent.1241088.HG"
  249.  
  250.  
  251. "ZoneAlarm": "Trojan.Win32.NanoBot.njl"
  252.  
  253.  
  254. "GData": "AIT:Trojan.Agent.EBPO (2x)"
  255.  
  256.  
  257. "AhnLab-V3": "Malware/Win32.RL_Generic.R284849"
  258.  
  259.  
  260. "Acronis": "suspicious"
  261.  
  262.  
  263. "ALYac": "AIT:Trojan.Agent.EBPO"
  264.  
  265.  
  266. "Ad-Aware": "AIT:Trojan.Agent.EBPO"
  267.  
  268.  
  269. "Malwarebytes": "Trojan.MalPack.AutoIt"
  270.  
  271.  
  272. "TrendMicro-HouseCall": "TROJ_GEN.R020H01H619"
  273.  
  274.  
  275. "Ikarus": "Trojan.Autoit"
  276.  
  277.  
  278. "Fortinet": "AutoIt/Packed.NH!tr"
  279.  
  280.  
  281. "MaxSecure": "Trojan.Malware.300983.susgen"
  282.  
  283.  
  284. "AVG": "Win32:Malware-gen"
  285.  
  286.  
  287. "Panda": "Trj/CI.A"
  288.  
  289.  
  290. "CrowdStrike": "win/malicious_confidence_100% (W)"
  291.  
  292.  
  293. "Qihoo-360": "HEUR/QVM10.2.0563.Malware.Gen"
  294.  
  295.  
  296.  
  297.  
  298. "Description": "Creates a slightly modified copy of itself",
  299. "Details":
  300.  
  301. "file": "C:\\Users\\user\\AppData\\Roaming\\netbtugc\\UserAccountControlSettings.bat"
  302.  
  303.  
  304. "percent_match": 100
  305.  
  306.  
  307.  
  308.  
  309. "Description": "Collects information to fingerprint the system",
  310. "Details":
  311.  
  312.  
  313. "Description": "Anomalous binary characteristics",
  314. "Details":
  315.  
  316. "anomaly": "Actual checksum does not match that reported in PE header"
  317.  
  318.  
  319.  
  320.  
  321.  
  322. * Started Service:
  323.  
  324. * Mutexes:
  325. "Global\\CLR_CASOFF_MUTEX",
  326. "Global\\1dfabe06-ff5a-438c-a5b6-f3af5c980db5",
  327. "Global\\.net clr networking",
  328. "Global\\ADAP_WMI_ENTRY",
  329. "Global\\RefreshRA_Mutex",
  330. "Global\\RefreshRA_Mutex_Lib",
  331. "Global\\RefreshRA_Mutex_Flag"
  332.  
  333.  
  334. * Modified Files:
  335. "C:\\Users\\user\\AppData\\Roaming\\netbtugc\\UserAccountControlSettings.bat",
  336. "C:\\Users\\Public\\udNFHVsAmQ.vbs",
  337. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat",
  338. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp7948.tmp",
  339. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\task.dat",
  340. "C:\\Windows\\sysnative\\Tasks\\DSL Subsystem",
  341. "\\Device\\LanmanDatagramReceiver",
  342. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  343. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  344. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  345. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  346. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  347. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  348. "\\??\\PIPE\\samr",
  349. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  350. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  351. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  352. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  353. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  354. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  355. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  356. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  357. "\\??\\WMIDataDevice"
  358.  
  359.  
  360. * Deleted Files:
  361. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp7948.tmp",
  362. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe:Zone.Identifier",
  363. "C:\\Windows\\Tasks\\DSL Subsystem.job",
  364. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  365. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  366. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  367. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  368. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  369.  
  370.  
  371. * Modified Registry Keys:
  372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\udNFHVsAmQ",
  373. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\Path",
  374. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\Hash",
  375. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Id",
  376. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Index",
  377. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\Triggers",
  378. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  379. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  380. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  381. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\15EE737C-85BC-411E-A386-081357FEA8AF\\Path",
  382. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\15EE737C-85BC-411E-A386-081357FEA8AF\\Hash",
  383. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  384. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  385. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\15EE737C-85BC-411E-A386-081357FEA8AF\\Triggers",
  386. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\15EE737C-85BC-411E-A386-081357FEA8AF\\DynamicInfo",
  387. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  388. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  389. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  390. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  391. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  392. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  393. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  394. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  395. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  396. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  397. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  398. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  399. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  400. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  401. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  402. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  403. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  404. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  405. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  406. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  407. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  408. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  409. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  410.  
  411.  
  412. * Deleted Registry Keys:
  413. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job",
  414. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job.fp",
  415. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  416. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  417.  
  418.  
  419. * DNS Communications:
  420.  
  421. "type": "A",
  422. "request": "donald081.duckdns.org",
  423. "answers":
  424.  
  425. "data": "79.134.225.117",
  426. "type": "A"
  427.  
  428.  
  429.  
  430.  
  431.  
  432. * Domains:
  433.  
  434. "ip": "79.134.225.117",
  435. "domain": "donald081.duckdns.org"
  436.  
  437.  
  438.  
  439. * Network Communication - ICMP:
  440.  
  441. * Network Communication - HTTP:
  442.  
  443. * Network Communication - SMTP:
  444.  
  445. * Network Communication - Hosts:
  446.  
  447. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment