dc21d272f9c15d8fefa8d57e639b046c92ddb967e7b54ff2f559ebec6de1e92e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79e9dd35aef6558461c4b93cd0c55b76_Purchase Order.jar
Size

123KB
MD5

79e9dd35aef6558461c4b93cd0c55b76
SHA1

09c6b30b7ff918d54ee6db72bf1bc41b5d6f1ca1
SHA256

53ab4883cc1e84f1f1732bb2fdb97358490b9134156eedc516d6dde6b97018ba
SHA512

61b4121768900bd8a6a5c056f02b7d0f34d6fd2124742f80b9b80e028dbd679d961cf24a1d36c460d69b90034a107fee89fb8cf30b280265c96bd4bf38e838c0
SSDEEP

1536:XDBcxrH8YRt1mYuFGTU1Mep4fKz6stVwG/JLWOOpXILt4vhwJ+/aW6Ef2u3jx0OF:zCRjKFGTMpOKzJtVRRLWO/4OW1XdJPB

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe\debugger = "svchost.exe"	regedit.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3984	attrib.exe
4064	attrib.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2936	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yBoBG0m3Gt = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\jcwDpUEpCh\\LcuSMagrlF.txt\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yBoBG0m3Gt = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\jcwDpUEpCh\\LcuSMagrlF.txt\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\Desktop.ini	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\Desktop.ini	java.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\tem.txt	java.exe
File opened for modification	C:\Windows\tem.txt	java.exe
File created	C:\Windows\tem.txt	javaw.exe
File opened for modification	C:\Windows\tem.txt	javaw.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1644	reg.exe
2432	reg.exe
832	reg.exe
636	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1376	regedit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4404	java.exe
2488	javaw.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2936	4404	java.exe	84
PID 4404 wrote to memory of 2936	4404	java.exe	84
PID 4404 wrote to memory of 1644	4404	java.exe	92
PID 4404 wrote to memory of 1644	4404	java.exe	92
PID 4404 wrote to memory of 2432	4404	java.exe	93
PID 4404 wrote to memory of 2432	4404	java.exe	93
PID 4404 wrote to memory of 3984	4404	java.exe	94
PID 4404 wrote to memory of 3984	4404	java.exe	94
PID 4404 wrote to memory of 4064	4404	java.exe	97
PID 4404 wrote to memory of 4064	4404	java.exe	97
PID 4404 wrote to memory of 2488	4404	java.exe	100
PID 4404 wrote to memory of 2488	4404	java.exe	100
PID 2488 wrote to memory of 832	2488	javaw.exe	102
PID 2488 wrote to memory of 832	2488	javaw.exe	102
PID 2488 wrote to memory of 636	2488	javaw.exe	103
PID 2488 wrote to memory of 636	2488	javaw.exe	103
PID 2488 wrote to memory of 2324	2488	javaw.exe	108
PID 2488 wrote to memory of 2324	2488	javaw.exe	108
PID 2324 wrote to memory of 1376	2324	cmd.exe	110
PID 2324 wrote to memory of 1376	2324	cmd.exe	110

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3984	attrib.exe
4064	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\79e9dd35aef6558461c4b93cd0c55b76_Purchase Order.jar"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2936
- C:\Windows\SYSTEM32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /t REG_SZ /d "\"C:\Program Files\Java\jre-1.8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1644
- C:\Windows\SYSTEM32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /f
  2⤵
  - Modifies registry key
  PID:2432
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:3984
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\jcwDpUEpCh"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4064
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SYSTEM32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /t REG_SZ /d "\"C:\Program Files\Java\jre-1.8\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:832
- - C:\Windows\SYSTEM32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /f
    3⤵
    - Modifies registry key
    PID:636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c regedit /s C:\Users\Admin\AppData\Local\Temp\TaskNetworkGathor8123578931222131026.reg
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\TaskNetworkGathor8123578931222131026.reg
      4⤵
      UAC bypass
      Sets file execution options in registry
      Runs .reg file with regedit
      PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
2987498c8b278665cf86f31dc4134bb0

SHA1
5c148b80d0574ed61b27b850f28de2905bde0d60

SHA256
5e694a1b27c2586776234b1cd9cd9bb595373ab94cc26a9e78d9b2e14d6cb3b1

SHA512
6c0670795dc646ab51c87425b673488370cee7760525b00dc016b51749803a8745e4df35fa81c56297ea564cc9c07c2259ce2181ee7115103e8809d7fb015845

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskNetworkGathor8123578931222131026.reg

Filesize
2KB

MD5
6486acf0ca96ecdc981398855255b699

SHA1
66ec7eb84247848d0d80beec8790cd6788704cd3

SHA256
f96b76b3db9739c7d7e0fcac48c19191895abb5b5d18eca35cfbb9c695fbfcfc

SHA512
6677dff216eab25383539040b5d48e9fd9c6025e6276b973bd462349451616ad6bc59d07e7c760f40c326446cd5eb19417c14cb0e35f169cd702d2be1202c8fd

Download Submit
C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\Desktop.ini

Filesize
63B

MD5
e783bdd20a976eaeaae1ff4624487420

SHA1
c2a44fab9df00b3e11582546b16612333c2f9286

SHA256
2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

SHA512
8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

Download Submit
C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt

Filesize
123KB

MD5
79e9dd35aef6558461c4b93cd0c55b76

SHA1
09c6b30b7ff918d54ee6db72bf1bc41b5d6f1ca1

SHA256
53ab4883cc1e84f1f1732bb2fdb97358490b9134156eedc516d6dde6b97018ba

SHA512
61b4121768900bd8a6a5c056f02b7d0f34d6fd2124742f80b9b80e028dbd679d961cf24a1d36c460d69b90034a107fee89fb8cf30b280265c96bd4bf38e838c0

Download Submit
memory/2488-131-0x000001B252020000-0x000001B252030000-memory.dmp

Filesize
64KB

Download
memory/2488-87-0x000001B2504A0000-0x000001B2504A1000-memory.dmp

Filesize
4KB

Download
memory/2488-128-0x000001B252010000-0x000001B252020000-memory.dmp

Filesize
64KB

Download
memory/2488-125-0x000001B252000000-0x000001B252010000-memory.dmp

Filesize
64KB

Download
memory/2488-124-0x000001B251FF0000-0x000001B252000000-memory.dmp

Filesize
64KB

Download
memory/2488-120-0x000001B251D80000-0x000001B251FF0000-memory.dmp

Filesize
2.4MB

Download
memory/2488-135-0x000001B252030000-0x000001B252040000-memory.dmp

Filesize
64KB

Download
memory/2488-110-0x000001B2504A0000-0x000001B2504A1000-memory.dmp

Filesize
4KB

Download
memory/2488-97-0x000001B2504A0000-0x000001B2504A1000-memory.dmp

Filesize
4KB

Download
memory/2488-78-0x000001B252000000-0x000001B252010000-memory.dmp

Filesize
64KB

Download
memory/2488-146-0x000001B2504A0000-0x000001B2504A1000-memory.dmp

Filesize
4KB

Download
memory/2488-84-0x000001B252030000-0x000001B252040000-memory.dmp

Filesize
64KB

Download
memory/2488-299-0x000001B2504A0000-0x000001B2504A1000-memory.dmp

Filesize
4KB

Download
memory/2488-55-0x000001B251D80000-0x000001B251FF0000-memory.dmp

Filesize
2.4MB

Download
memory/2488-82-0x000001B252020000-0x000001B252030000-memory.dmp

Filesize
64KB

Download
memory/2488-80-0x000001B252010000-0x000001B252020000-memory.dmp

Filesize
64KB

Download
memory/2488-77-0x000001B251FF0000-0x000001B252000000-memory.dmp

Filesize
64KB

Download
memory/4404-37-0x000002346AA90000-0x000002346AAA0000-memory.dmp

Filesize
64KB

Download
memory/4404-41-0x0000023468EA0000-0x0000023468EA1000-memory.dmp

Filesize
4KB

Download
memory/4404-64-0x000002346AA50000-0x000002346AA60000-memory.dmp

Filesize
64KB

Download
memory/4404-63-0x000002346AA40000-0x000002346AA50000-memory.dmp

Filesize
64KB

Download
memory/4404-62-0x000002346AA30000-0x000002346AA40000-memory.dmp

Filesize
64KB

Download
memory/4404-61-0x000002346AA20000-0x000002346AA30000-memory.dmp

Filesize
64KB

Download
memory/4404-60-0x000002346AA10000-0x000002346AA20000-memory.dmp

Filesize
64KB

Download
memory/4404-59-0x000002346A7A0000-0x000002346AA10000-memory.dmp

Filesize
2.4MB

Download
memory/4404-66-0x000002346AA70000-0x000002346AA80000-memory.dmp

Filesize
64KB

Download
memory/4404-67-0x000002346AA80000-0x000002346AA90000-memory.dmp

Filesize
64KB

Download
memory/4404-68-0x000002346AA90000-0x000002346AAA0000-memory.dmp

Filesize
64KB

Download
memory/4404-57-0x0000023468EA0000-0x0000023468EA1000-memory.dmp

Filesize
4KB

Download
memory/4404-54-0x000002346A7A0000-0x000002346AA10000-memory.dmp

Filesize
2.4MB

Download
memory/4404-65-0x000002346AA60000-0x000002346AA70000-memory.dmp

Filesize
64KB

Download
memory/4404-38-0x0000023468EA0000-0x0000023468EA1000-memory.dmp

Filesize
4KB

Download
memory/4404-2-0x000002346A7A0000-0x000002346AA10000-memory.dmp

Filesize
2.4MB

Download
memory/4404-33-0x000002346AA80000-0x000002346AA90000-memory.dmp

Filesize
64KB

Download
memory/4404-31-0x000002346AA70000-0x000002346AA80000-memory.dmp

Filesize
64KB

Download
memory/4404-25-0x000002346AA60000-0x000002346AA70000-memory.dmp

Filesize
64KB

Download
memory/4404-21-0x000002346AA40000-0x000002346AA50000-memory.dmp

Filesize
64KB

Download
memory/4404-22-0x000002346AA50000-0x000002346AA60000-memory.dmp

Filesize
64KB

Download
memory/4404-18-0x000002346AA30000-0x000002346AA40000-memory.dmp

Filesize
64KB

Download
memory/4404-16-0x000002346AA20000-0x000002346AA30000-memory.dmp

Filesize
64KB

Download
memory/4404-15-0x000002346AA10000-0x000002346AA20000-memory.dmp

Filesize
64KB

Download
memory/4404-12-0x0000023468EA0000-0x0000023468EA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads