Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent e0d777ad61246564
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\PHelperService] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\PHelperService] 'ImagePath' = '%ALLUSERSPROFILE%\PHelperService\PHelperService.exe'
Creates the following services
- 'PHelperService' %ALLUSERSPROFILE%\PHelperService\PHelperService.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\uieseve
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vu5ku.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-30rkr.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-1labm.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-49vm3.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-ej611.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-870vs.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uc3gs.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-baikl.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-drmau.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rhafb.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-0ve6v.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4636b.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f1ua9.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-hn2sh.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-tju67.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-u68jj.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-jnpjd.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-d267u.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8t1gj.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f02u0.tmp
- %TEMP%\a976.exe
- %TEMP%\a215.exe
- %ALLUSERSPROFILE%\phelperservice\phelperservice.exe
- %TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe
- %TEMP%\is-t1uf5.tmp\saxsupport\install\unins000.dat
- %TEMP%\is-t1uf5.tmp\saxsupport\is-l496p.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-0tjvh.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lessmsi\is-ck391.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8o634.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-e2hat.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-j1iqh.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-ejvah.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5hab5.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vmf6u.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-048n5.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlskr.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2p03n.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-o60ar.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5d7hu.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2c9ij.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-lsqsh.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-2o3pt.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\install\is-78ah8.tmp
- %TEMP%\is-t1uf5.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-t1uf5.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-t1uf5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-gbv9e.tmp
- %TEMP%\is-t1uf5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-algad.tmp\259d.tmp
- %TEMP%\259d.exe
- %TEMP%\e4b6.exe
- %TEMP%\dda3.exe
- %TEMP%\d3e2.dll
- %TEMP%\c4f3.exe
- %APPDATA%\vauhhhr
- %TEMP%\is-t1uf5.tmp\_isetup\_regdll.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cectt.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-a0htq.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fbf7f.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uk9ov.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-mqgf8.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-c8sl3.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-bvpkj.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cgokh.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fb9up.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-nuo99.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-srb2q.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4ndrv.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-9pnfi.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-3sp7j.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cfkns.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-pavr6.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-7307m.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlvk8.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-otm30.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-a5j8d.tmp
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rbbpb.tmp
- %TEMP%\c0a0.tmp-shm
- %TEMP%\cd90.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\uieseve
- %APPDATA%\vauhhhr
Deletes the following files
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\date.txt
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\tagsreplace.txt
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\tak_deco_lib.dll
- %TEMP%\c0a0.tmp-shm
- %TEMP%\cd90.tmp-shm
Moves the following files
- from %TEMP%\is-t1uf5.tmp\saxsupport\install\is-78ah8.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\install\unins000.exe
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-hn2sh.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\rg_ebur128.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f1ua9.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\wavpackdll.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4636b.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libsoxr.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-0ve6v.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libsox-3.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rhafb.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\uchardet.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-jnpjd.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\utils.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-drmau.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libdtsdec.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uc3gs.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\dsd2.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-870vs.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libvorbis.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-ej611.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\sqlite3.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-49vm3.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lame_enc.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-1labm.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\da.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-30rkr.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\daiso.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vu5ku.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\dstt.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8t1gj.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\dsd2pcmt.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8o634.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\pcm2dsd.exe
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lessmsi\is-ck391.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lessmsi\lessmsi-v1.6.91.zip
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlskr.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\d_writer.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-048n5.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libwebp.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vmf6u.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libwinpthread-1.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5hab5.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\sd.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-ejvah.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\peak_scanner_plugin_c.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-j1iqh.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\raw_decode_plugin_c.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-e2hat.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\copying
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f02u0.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\7z.exe
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-tju67.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\mp3gain.exe
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2p03n.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\takdec.exe
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-u68jj.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\optimfrog.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-baikl.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\opusenc.exe
- from %TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-2o3pt.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\stuff\date.txt
- from %TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-lsqsh.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\stuff\tagsreplace.txt
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cectt.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\tak_deco_lib.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fbf7f.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\avutil-58.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-3sp7j.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\avfilter-9.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rbbpb.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\swresample-4.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-a5j8d.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-otm30.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_aac.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlvk8.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassalac.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-7307m.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassape.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-pavr6.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassdsd.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cfkns.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\basscd.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-9pnfi.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassflac.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-mqgf8.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassmix.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4ndrv.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassopus.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-srb2q.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\basswma.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-nuo99.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\basswv.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fb9up.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_fx.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cgokh.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassmidi.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-bvpkj.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_tta.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-c8sl3.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\copying.lgplv2.1
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uk9ov.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\ff_helper.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2c9ij.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\gain_analysis.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5d7hu.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libflac_dynamic.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-o60ar.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libmp4v2.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-d267u.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_ofr.dll
- from %TEMP%\is-t1uf5.tmp\saxsupport\is-l496p.tmp to %TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe
Substitutes the following files
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\date.txt
- %TEMP%\is-t1uf5.tmp\saxsupport\stuff\tagsreplace.txt
- %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\tak_deco_lib.dll
Deletes itself.
Network activity
Connects to
- 'su####lituyo.org':80
- 'sn####ukeutit.org':80
- 'li#####insteniki.org':80
- 'li####oumumy.org':80
- 'st#####luyastrelia.net':80
- 'ft###yager.cc':80
- 'sl.###anfast.com':80
- 'mo####eyclub.org':443
- '38.##.221.193':34368
- 'pk#.goog':80
- 'al###smail.com':80
TCP
HTTP GET requests
- http://ft###yager.cc/ftp/index.php
- http://sl.###anfast.com/order/tuc5.exe
- http://pk#.goog/gsr1/gsr1.crt
- http://al###smail.com/l1mb0/modules/legacy_l1.png
- http://al###smail.com/l1mb0/modules/cleanhelper.png
- http://al###smail.com/l1mb0/modules/runsysclean.png
HTTP POST requests
- http://su####lituyo.org/
- http://sn####ukeutit.org/
- http://li#####insteniki.org/
- http://li####oumumy.org/
- http://st#####luyastrelia.net/
Other
- 'mo####eyclub.org':443
- '38.##.221.193':34368
UDP
- DNS ASK on###ituyrs.org
- DNS ASK su####lituyo.org
- DNS ASK sn####ukeutit.org
- DNS ASK li#####insteniki.org
- DNS ASK li####oumumy.org
- DNS ASK st#####luyastrelia.net
- DNS ASK ft###yager.cc
- DNS ASK sl.###anfast.com
- DNS ASK mo####eyclub.org
- DNS ASK pk#.goog
- DNS ASK al###smail.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'X339f1_SAXS12062FlashFixClass_X339f1'
Creates and executes the following
- '%TEMP%\c4f3.exe'
- '%TEMP%\dda3.exe'
- '%TEMP%\e4b6.exe'
- '%TEMP%\259d.exe'
- '%TEMP%\is-algad.tmp\259d.tmp' /SL5="$10296,7675283,54272,%TEMP%\259D.exe"
- '%TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe' -i
- '%TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe' -s
- '%TEMP%\a215.exe'
- '%TEMP%\a976.exe'
- '%APPDATA%\uieseve'
- '<SYSTEM32>\cleanmgr.exe' ' (with hidden window)
- '<SYSTEM32>\rundll32.exe' %APPDATA%\..\Local\Microsoft\WindowsApps\runsysclean.dll,Main' (with hidden window)
- '%APPDATA%\uieseve' ' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\D3E2.dll
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\net.exe' helpmsg 6
- '%WINDIR%\syswow64\net1.exe' helpmsg 6
- '<SYSTEM32>\cleanmgr.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '<SYSTEM32>\rundll32.exe' %APPDATA%\..\Local\Microsoft\WindowsApps\runsysclean.dll,Main
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\taskeng.exe' {E5DFDBC4-ED2E-448F-9B0C-00E75193AA13} S-1-5-21-3150914307-1777937420-491476919-1000:xqkvmjyvesri\user:Interactive:[1]
