bazarloader | 3db2c1f543f255d87c37c3faa0dc3c4e20e0e939a20c58db4efad1bab9b55e9a

Sharing

Copy URL Twitter E-mail

General

Target
zen.win-specific.zip
Size 94.7MB
Sample240923-xp2dms1fjf
SHA256 3db2c1f543f255d87c37c3faa0dc3c4e20e0e939a20c58db4efad1bab9b55e9a
MD5 a9afb97d7b2380c20ed78b126a63688a
SHA1 528383dd994d2c8f32f0718c054a85394c5ff687
SHA512 f9fbcab4df9d9254f59ef8fc148369e4a66242f92acd4941ab7aab5db5183b4dc213fce05dab4f736c9e149232c0fb1dec56dd264b1f1739e1934af3c3f1ff00
SSDEEP 1572864:mWtIJ7vnXtdMGUpsGRNGQN1x0ZzJaJdPB661R+7cqP/Z+yi9+/k3OIkZ:mWu1XtGGUpLNN1IlqE6T6nZLiY/k3qZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  zen.win-specific\zen\AccessibleMarshal.dll
- Size 29KB
- SHA256 f9b13f6e00fb3ee6acb4915b75867400f49d0367b2d3e330f878eb4ae583d9ae
- MD5 73fd7f799de7bf6b397c7a115aaee881
- SHA1 e98120f3175957f46d5409635771b784bfc6f0ba
- SHA512 809bc8773fbac84442e120a437a431ed710d7fe96c11e4df92eda82b362845d137eb641ccf635e3fb9931887810793eb081b9a387d2373586f3524ed4541f03c
- SSDEEP 384:PmMUbpeTLB5+Vra/vfjMdfj9ycDieIL0Ieu4ExGGmLu5w5k2mNDsSofouswa8:PmMupezvfAhjfD5I2GLyGheSoQud
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1
- Target
  zen.win-specific\zen\browser\features\[email protected]
- Size 229KB
- SHA256 c984f1d2c00a9e1fb7bed10fd262c2eb87fbcdc70ce59d56b9814baf83b1421f
- MD5 cd651c709fe1b26b68a7b2433b480acc
- SHA1 5c2f057d1150f93503d7fbe142e5684cf721f20b
- SHA512 fd6598fef93991cb6dd7c7504b0bfed3603ce40971efc164301f6ab6794ea60e1158d7e9a3bcb11472b4e3126364309acbe77117cfa60f03fd8a83d96e3d9896
- SSDEEP 6144:somJ9DWxL1HMJ+NfHzVMM6+2wmKKqi2XaGR:BmJ9D4JHMJ+NfHzVMM6+2wmKKqi2XaGR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral2 behavioral3
- Target
  zen.win-specific\zen\browser\features\[email protected]
- Size 433KB
- SHA256 bbddd9a035ae1a420dfe95a83fa8ed4c1f3e9e4a31511c05d38ef1aefc6b5f66
- MD5 3b9c829c1b7a3f55be6e8881a5140565
- SHA1 78243c04002305d4749b0b789acf0dc0be7686c7
- SHA512 66d934de2b381f9bc884803c1dff8678b903d19e1f2a7aa06d243acaa050ad25dd67761bb7587d71e9a940b2ae4908b53f001daed7094b74f2829cd0efe2e1be
- SSDEEP 3072:qV/ihq+Cl0VLi8UHKHgWmj1dNtgInmj2XoJ+Z1Epa1c:nC0LhUHKgnj1dNtgkqDHpaa
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral4 behavioral5
- Target
  zen.win-specific\zen\defaults\pref\channel-prefs.js
- Size 427B
- SHA256 2f068ae56a6150bab6fc576c501ee7a9836475a93ae7b3f4296e9885b743d9ff
- MD5 e44234f7fafcd73a246967ed7f4739d1
- SHA1 dbac01b22dde7ccbe766be65aaaba5da2f355a59
- SHA512 83540974dba305fba9a75373b028d9aacf953c6de73bc103d87e9550add8b6eb8d49920d37ba236d8c5a8c92f0b3fc4a8de3af5e98023204570fae23f661bebe
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral6 behavioral7
- Target
  zen.win-specific\zen\freebl3.dll
- Size 841KB
- SHA256 d363840d084d788dfea1ed4f0101d1f32402e154244e0a11af41a4d1b8558c56
- MD5 5369e148bec20b9eb2e4eadce2853062
- SHA1 580e11f553a4b7d1302a69603694284e8b3e08e3
- SHA512 e5fb9e108174059423214554b96b32720271aef16f1f654be6ec23c788b1c271df135dc2997fd937137863041be2b54aed1dd6195017cc93bde6035f2c919ae9
- SSDEEP 12288:JqB8qCJQuUQLrxBZl6azydExeODsmmz0ioK8Sxd7qnh5eVj:JqBUmZQLpl6oFDsmmz+ZSH+h5Kj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  zen.win-specific\zen\gkcodecs.dll
- Size 8.6MB
- SHA256 8f3f906324ed14e2654da2039ad92e7323e10a25bc170e83fe30ea1c6120d2ed
- MD5 717e663059459dc4551933eeb18516c8
- SHA1 1e18d0f994bb65c9b82090e25e73a12b361cd403
- SHA512 166ff29615fdc9959eee427acc2ad1f15efecc03dd40477d72d7cae9d358fd091422d459d0e7f4e19eceb6bf435abaa2e2df00a9fe109d98be84aa541ced997f
- SSDEEP 98304:DaxCNVVQqDOPqLhzYGYJTyyVE2H+e7qqqddiW0Z4352Oya4muc1qWzCRtQAbLAqP:WxCNVVQqDkyIna5wCQhOcqG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  zen.win-specific\zen\gmp-clearkey\0.1\clearkey.dll
- Size 102KB
- SHA256 767e097193f3ba40660096d62c59f91a127e1f48aff01d967a1d04976c1e6dea
- MD5 a255bd9ed55f23a2d4755ef4745d373f
- SHA1 0f9c6e555572ffc11dde2a835490629c534ad005
- SHA512 e9bca10cbe83cb7492f4e32499d29ce6093e78d3ad5e10c6bf2760d3221a8d3c7d99be4bc74ff2165db59048f4e6c2a9ff0c13d370d68cbf5f6c7a10d49bd088
- SSDEEP 1536:71X27LOgxhABbmtChuq0cLJ15MrsozWv4bjh5rZZinsuR2GLTkL74V:g7+RhOc/5MrsEWv4bjDrZmsuRvTkfW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  zen.win-specific\zen\ipcclientcerts.dll
- Size 203KB
- SHA256 4f05fc56efde8ecdb06c0afb82b466f0d217d6a08a3cbba4fa39f14352b1a79b
- MD5 c8e1b003b65a08f7c98abd3f6be627b7
- SHA1 3237ed0dba830cb2af2669f3ad1b112d83c283e6
- SHA512 400995c49ab1fb48bc1964160717ee5a66f208bf8cdbcfb54bf704746cf7d1507c3548635d586126358e8a0ec02ee3aaba5c85c41474f68d22b68a7c29884531
- SSDEEP 3072:RaZpHLZBK/o6OiztxCxAGn1VARTpzilxK24E2SyFKyptjB7vMDJOzvTkfq:RO5ZBK/o6P1GkTpmbFV2LUWtNrMDJxC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  zen.win-specific\zen\lgpllibs.dll
- Size 146KB
- SHA256 b61299f2489d9bd192875908e06eb8e059b2c53a01ecca24a2ce8052ad9233db
- MD5 7d1819fca1ad6bfcc1c161fb546514a2
- SHA1 14d8c0925113aa796e714c113270a832bd63598f
- SHA512 80827869e4770c01d2d74af1c419e85d1f605d7f40145bca298efb3585fab984e9abf6106d84ffc45c450bafd47b7779d6197e1f64d02a0e9d9c52f6c50cb28f
- SSDEEP 3072:xXMVYtCqSULM8VNZxqv78Bi4/QtEgJz+4gXTjQ6zWgkXSnTxWAcbGavTkf0:BQcsiB3bjaDJz8TjQ6zWgkXSn4AV8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  zen.win-specific\zen\libEGL.dll
- Size 46KB
- SHA256 772db273cae0cf68f378e3caad91efef5cc12d23a155d5730d933b8beffaf217
- MD5 46ba6379352a02e91260529e1698434f
- SHA1 628c1f68672b5616c71f0ecee63a6fde79633355
- SHA512 87b25d9705dc4b8f2d1781e9e03d312453d4832d3d11f72974f31353592588f4e2248bd4c87341e5e2cc2de973799e7fe3342cfef324a8f21a41c456a35418ed
- SSDEEP 768:WHNZBXqURG3/HoQrdxVGfGxMJ2GLyGheSoQu0uVo:KZXqUR2wQrdx0uxMJ2GLTkL7ne
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  zen.win-specific\zen\libGLESv2.dll
- Size 4.3MB
- SHA256 3fb278e30ff170b581c311cef2cf19e36552de6168d43c4399d158752727d645
- MD5 e6a5fbb300ad6ecf3d97b5cae3bce6fc
- SHA1 8c5656c1518c0edf29367fcdddc4bd990000662f
- SHA512 aa8265d49114e6d3ada4c3f8cc1aaf7f117486dc0abde01372345b12b7444eff6f3295e16f62e5fc867981aff124336cd2b67d9f7b5de3dc052e775e5f70fbd6
- SSDEEP 49152:5ba5+oNQyI35G9FSz35Pi/zlmxBi6BOMNoalvmF5sv1XqokEf0EOPmAU6UAhnZK9:lEv/4Bi6oIvnv1XXAUhTx
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  zen.win-specific\zen\mozavcodec.dll
- Size 3.1MB
- SHA256 7ba1822ca57db17ad1b2502398dca01beca09b388151dcad230c418065f38022
- MD5 e1f80b13a98d0bc8492f11bc96a82be3
- SHA1 5c49eb31e2c14c0d9ac94d5ba34bbd7d1bbb0a26
- SHA512 a314406d1ddef1ba6a97a6f2d52f49ca8ddf6c1a52fe40dd735d8a3e76e1de9209e14b853bd366ee08ad6503a5006c2895b23835df062488007a6d1c913663df
- SSDEEP 49152:D6ggKSyWW4nsv1LNkcbD+p+WY/RSEDB88MEU4YF03M9rdx8NWn:AHns0cbD+p+WISEDBfRuxmY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  zen.win-specific\zen\mozavutil.dll
- Size 564KB
- SHA256 abaa28fb6e167b53446e0970d0c99d74c7cd078ffe7a28b9b0cf250b7ae7425d
- MD5 ac637a2c3a2499bacc5c9c289423b2e6
- SHA1 55f431b7e34a0ae72238571d5a92f6bf06cebe22
- SHA512 3e93e664738b73979291cbe00c36d0413ef399cb70d40108176466d7565dc92a57e9cb5e921cfa607deddf4e98a994721699bce1ea02739cde8b8eb51070797b
- SSDEEP 6144:Plvn2U3lepvipmB4f1Fl8CPes4RCTYf1aS32fyVCPIJLmGr:Plf2U3l3m+9D8CPRcf2IJKe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  zen.win-specific\zen\mozglue.dll
- Size 744KB
- SHA256 d0efcf7ebf812d128bd81ee2e1e6b5d4931c1d67f4c28de38afdacd830a337e5
- MD5 611a5d5f2fb5d0437b7bdd531393ac33
- SHA1 dbdd6e58354cf1cabc384d21bad2f1b927eec428
- SHA512 8703976c638ff9cc90b77a3bc57af16a5f4400d9d61ca9d5b03fa096156ded3998bb8cb37e5174a4195252914bee31288e9f15bf5eaf1b198d59ae6bdaf0d125
- SSDEEP 12288:WEID+kBN7TXMS/bRgxoC9n5A/e322YzrCwBqwulDgnlZTA4ngJk1R50YtlH48j:DIDRNFWxDnD22YSwBqTlDQTLgJk1R5z1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  zen.win-specific\zen\msvcp140.dll
- Size 549KB
- SHA256 aa72ab084da6f07411546c5073bd89f5a463cd18daca910b8c6f16f18976f747
- MD5 03aaa9d4284dac195f66435836f42b99
- SHA1 8d91b4863f4382783825d7e282a466675565a0d6
- SHA512 43b39a5fec54312f0f2c2897b1aebb3a7e55b3172709da04dc25565e115ab0af3501f016e70b021e1f550c60349b4e8b18fe9e4fd87a0535428de7da6001202c
- SSDEEP 12288:EPeu+VwM4PRpJOc8hdGE0bphVSvefIJQEKZm+jWodEEVwDae:OqwpzSFJQEKZm+jWodEEqT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19
- Target
  zen.win-specific\zen\nmhproxy.exe
- Size 566KB
- SHA256 d44988538dc9024dd18ed84d3c499410571905096fea79fc7063367ff26b7c77
- MD5 9a59b537ae4389729b531ac94d7d7bbb
- SHA1 b6c03565a707ea820dd058e72c7c0525e3bb4226
- SHA512 c05c1a9b91c79dd3eb4e8787717cbb724f84f13fd8a991e900906227dc40c144e9300b8d23102df1db9146150d23f795526e3041f8c446982afd34d915b3bf05
- SSDEEP 12288:YYZBkprWXGDdYe7YnUnxlltafRiCKp/nqpxx:YikpWXWdc8Wx
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  zen.win-specific\zen\notificationserver.dll
- Size 58KB
- SHA256 2a2cf24828e5a525444cf3087e8260e036eb5d5be7d9084de846a7bef8b15f22
- MD5 16e523411bf21cc2a8ac43ffe5bad48c
- SHA1 ae274e155dc4f38d88ea6c051b66007effdde8e8
- SHA512 60d40b5b9111820c56b0e637c3eac360c33506cb0ec8ada345a09945898a14ca16b2bed4cc2496e3f48cf19930903ce45ece93fe6a0f02cb3524f50a844e5c15
- SSDEEP 1536:zMIm34N3nBj+lOZ7StT2IEK/Pq8lfWr2GLTkL7w:z+34N3n9Z702IEKPFWrvTkfw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  zen.win-specific\zen\nss3.dll
- Size 2.3MB
- SHA256 c12e2f2c69061c33af9efd22549ec795ee7c0cf1a375a0de858689462f99991d
- MD5 d7257fdb7da586528d3fc9596726d65a
- SHA1 4a81f942ad3b4924f95578ea01b0edcc9f729141
- SHA512 1dbb996155c6be4e2e4cf86522fdc0617af453594dea3927bd0affe5954bd8da1077b7248f85404c737498654006be5f7981fd346d6e4f748af3991dc5fc324d
- SSDEEP 49152:dSIc6o6dieaX/E33ESm0kMhw47IycLPbGnYc6bq5oh3EmTgU0h3LqaSfPrL732T0:dn/oJV9Iw4lcLPq6mOT0QaSfDL7380
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  zen.win-specific\zen\nssckbi.dll
- Size 369KB
- SHA256 777f938ccaed791194981fee81b0a127f6c4ba9d53dd2d635168baec115b7b1d
- MD5 a355af2d00fb4a30f8bdf8380ccf9f66
- SHA1 27a5b7526334a5037d8951e505c3862bd835865b
- SHA512 b01072a6a68798419830b06dec01fb1d4e0fa07d8b098419eb61b40dcaafcb7b8053c16a7b758623a737b67c10325aab3dc3e81f0c09f63fea715007f8d88f20
- SSDEEP 6144:4jOju3K/6Yd5GtvZqBuYPdSqnAViGJ243x208cGLbTmNxpcmoK6MQ297alTqMLvS:4jr3Kt9BuYY24h2DvL+xp6EQ21aTqya
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  zen.win-specific\zen\osclientcerts.dll
- Size 344KB
- SHA256 648a0868c0463a4cb1e9ee3080f33904f7da5fe49b6c68f09c62ede9b33e7031
- MD5 a67910d55a37997b1222910188262968
- SHA1 bb442270cd6499bab32855b8d955cf581ad83c0c
- SHA512 11903752adbf4e95bf76f3c090694844039c70a160c8febd6903185ce7a6dd67f67bf3adc6c14fb85faca2d31ea167413aaabc742422b2f775e7b554a862c51b
- SSDEEP 6144:tBQ6G0l/SfQ/F6j0x6Iut+NU/kO6cfp/u1mDkcK2xRrR+:tmV0VV+YY+WBAe0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25
- Target
  zen.win-specific\zen\pingsender.exe
- Size 78KB
- SHA256 0b2e76efec708d9f915eaa595a4c8851e5d0ffb12531a817a8d91a79019efe10
- MD5 3bbde6c0b71945411fc1f8aa2c014340
- SHA1 04801d522cdf457f0bb02f2d7ffa79b012f25fce
- SHA512 c6b90aadfbd4adb70e4a92d019aab7e2b6992ee6987abbe7bec33b020f795e6b69a0306ce12a2b45619a31817ee1dbfb15b53d7f842fe62f3f6ceddfe1799681
- SSDEEP 1536:UB8Cf/BvqXA4HXPPI3/cXDkhtFlO1dQuh89Rn6dhDbCpy32GLTkL7o:6pqQ4XyEXDQm1h6h2HYy3vTkfo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral26
- Target
  zen.win-specific\zen\plugin-container.exe
- Size 282KB
- SHA256 8f1f32a4a3b15f1fca8bde6b2d0484e6024dd3983ffbb9c1a4add6d1b36be41c
- MD5 bb82c94cca8dee9a8647ae50c7d56f81
- SHA1 5c4e576412a666bbd04a4d018a5f6e911e4d84d6
- SHA512 3f329a06f58944bff87915d2aa34041fedea034311b3295472337f0d23fba2ff11d02996f2134120c005f7aa33d84dd13b1581384f6679e7b7eea5474d1c6fe2
- SSDEEP 6144:rPU30dcwYjOaR3cKPF9dXYfTkvLPsyDQ+F77TE8Q:z45OB+YfIDBlEv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27
- Target
  zen.win-specific\zen\private_browsing.exe
- Size 130KB
- SHA256 dcd141979e1815996faf7fdcfc76e4b3ab821e8c7bdacfb4aaac7d5ae21c6284
- MD5 cd54ffb591d100f72f53a02e1b79530a
- SHA1 9cd1b2e34237d3ad8e1e46d5a5d7ff77fd82000a
- SHA512 f648c83c58f0d72969abcb205be12fb7797b6abe74944c457b2413477e8330153c04d7c0cb84c8bce53f00c3b009513f14b8be703b7bf95056a79578a748d4bd
- SSDEEP 768:FbVBx0z1hspNjEcdVVmPUQY+uXiXSdr2YoPSC3SVz2FygIXdb2GLyGheSoQuGQz:FXx05omEfm2ZnoaC3m+ub2GLTkL7Pz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28
- Target
  zen.win-specific\zen\softokn3.dll
- Size 283KB
- SHA256 b1ad3fdca1ed09d732fbb462d42e41e12fab35042c7f5ac2cde74103c7d6f9fa
- MD5 07420aa50886258502aa835fdc15ecd7
- SHA1 83053215ac70090e293984e9cef4fd87dee9270a
- SHA512 843e8ce4084a3246b21d199f2e57476a52e3e9c220c613c098055ec27e17d0a33738c8070e8314879bbaaf482856b0f709207014f5bb7a3529c035d4af343b17
- SSDEEP 6144:pGMGxUbC2ugmWIaZlcF4xLXSXTzmcACYz+xnfvaOAi:pGMFugmWIaJOzBYz+xnaO5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  zen.win-specific\zen\uninstall\helper.exe
- Size 1.1MB
- SHA256 4bd16c3aadf946dc43f604e2f68b25b85c097b31f49168d6b82b7cee9178fcab
- MD5 8f04caef6fe19520b1795523dbd79d13
- SHA1 67fec91779d4f2bf175066edd1d9d04842b7b9c2
- SHA512 22853d3f6dd0ff80606b443b6225a4af48cb98ff6aff507efd8f4ee459fd4fecb9891441dd940a9b1cc92b7321f6ef3a54ee132c4c8a6846ab975ee8456fa7ce
- SSDEEP 12288:UTSUjD5xMDk9euP+btSjDUJDJY95+B7a2So/FJW1sx:UTzMD8hmbtSjp0BW1ocsx
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/UAC.dll
- Size 28KB
- SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
- MD5 d23b256e9c12fe37d984bae5017c5f8c
- SHA1 fd698b58a563816b2260bbc50d7f864b33523121
- SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
- SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32