start	end	text
18630	26950	Presenting the Detecting the Not PowerShell Gang with Tez. And with that, I will let Tez take it away.
28130	35310	All right, thank you so much. Hello, everyone. Welcome to this talk titled Detecting the Not
35310	42570	PowerShell Gang. It's by me, Tez. You can find me on Twitter, anywhere else, TezManager.
42970	47610	All right, let's get to know me for a little bit. I'm a Threat Hunter working for
47850	56510	a major Canadian communication company. We also do MSP, MSSP, ISP, whatever you can think of.
56510	61950	So my main tasks in this company is to do threat hunting, a lot of involvement with
61950	68630	threat intelligence also, and a lot of automation, which is programming, coding, etc. I have some
68630	74410	previous experience in application security, and also some security auditing slash legal.
74410	81070	I graduated from Sheridan College, so I am based in Toronto, Canada. So if you're around,
81070	85510	you know, like if you're a company around Canada and you're looking for good talents,
85510	91570	you can definitely look into that school. So yeah, so that's pretty much me with my
92430	98630	medium, small security budget, fighting the bad people one lock at a time.
99430	105170	All right, so if you ask, like, you just do work? No, I do play a lot. I like to do fun security
105170	111630	stuff, CTF. I like presenting, attending conferences. I also love to do photography,
111630	117710	specifically astrophotography, some landscape photography. Also, I do have a drone and just
117710	123770	taking pictures and videos. I play guitar at times, and I love to go to festivals and concerts.
123770	129370	And of course, like everyone else, gaming, it's something that it's always fun to do.
129770	137710	Just some pictures of me doing stuff, taking picture of stuff, just to show that I'm not
137710	142610	working all the time. All right, first of all, let's start with disclaimer. All the opinions
142610	153130	are my own, and this doesn't reflect any views of my employer. So with that in mind, let's move
153130	158690	forward. So also note, this presentation, it's actually a compressed version of similar
158690	164010	presentation that I did in HackFest last year. So if you would like to see more about the tools,
164010	169350	demonstration, et cetera, you can go watch it on HackFest YouTube channel. The link is there.
169650	172830	The slides, also the extended version, are available on my GitHub.
173910	181330	Okay, so let's talk about the content. We just, you know, talking about me. So we got
181330	188270	three major parts. We'll have some introduction about the gang itself. How do we detect each
188270	193770	member of the gangs? There's some bonus detection. There's some bonus members of the gang. And we
193770	200930	close everything with some outro and a Q&A at the end. Yeah, so in this section, we'll get the basic
200930	209190	understanding of what is exactly not PowerShell gang, not PowerShell tools. So I did this research
209970	217750	roughly like one to two years ago. And I see a bunch of, we actually see a bunch of tools that
217750	224610	acting the same way, that act to try to avoid PowerShell security logging and mechanism,
224610	231150	but they achieve it with different ways. So this is really interesting to me. So I just pretty much
231150	236370	bundled them together and then, yeah, build detection for all of them and then see the
236370	243430	unique way each one of the tools doing. So one question you're going to ask, like, why these
243430	248770	tools even exist? Why don't they just use PowerShell? Well, because the PowerShell love
248770	253910	Blue Team. This is a blog post that they posted back in 2015 when they released version 5 of
253910	260870	PowerShell. They released a lot of security feature and it is actually really bad for Red Team. So
261630	266950	pretty much friendship ended with the Red Team. Now Blue Team is Microsoft's best friend.
267650	277370	So is it that bad? Actually, it is. You get protected logging. So whenever you type anything,
277370	281930	PowerShell will be locked. Whenever you enter a script and you enter commands, it will be locked.
281930	286870	If the Blue Team have centralized theme, that's it. That's the end for the defender.
286870	292090	Sorry, for the attacker, right? Also, I'm saying integration, which is anti-malware
292830	297690	mechanism. So there's a lot of bypass being released, but this is pretty much a never-ending
297690	303790	race between Microsoft and then the Red Team slash offensive tool makers. So they bypass the patch.
303790	309070	They bypass the patch. It's just never-ending. And lastly, we got the Constraint Language Mode,
309070	316490	CLM, that able to limit the capability in the sensitive environment, for example,
316490	319810	in your PCI DSS server, in your production server. You can limit
319810	324110	things to do with PowerShell. So that's not really good, actually.
325870	333050	Five years later, so there was this EMA, Ask Me Anything, event going on in one of the
333550	339990	Slack channel of one of the big security company in the US. So I just jump in and ask the question,
339990	344630	from your recent engagement, do you still use PowerShell at all? And then most of the answer
344630	351970	is like, not really. We just drop it. We don't really use it. So that's the idea how bad it is.
351970	358010	Even five years later, people just start forgetting PowerShell at all. And that's
358010	365710	why we have the whole game. So now we understand what's not PowerShell. And then let's move forward
365710	373250	and just get some understanding about the detection. Make sure that you have these
373250	377390	requirements ready if you're trying to deploy this detection, because this is
377390	384850	the environment that I have, that we have, when we tested it. And then, yeah, pretty much
384850	391110	the whole goal of this presentation is to utilize your locks. So you can use whatever
391110	398230	same solution you want, Splunk, Elk, ArcSight. I can keep going on and on, but you get the idea.
398230	404990	So, yeah. So there's two types of detection that I will be sharing. The first one will be
404990	410110	the low-hanging fruits, the easy detection that's easy to create and easy to bypass. The next one
410110	416660	is a more complicated detection, the advanced detection based on TTP or behavior of the tools.
417770	426430	It's really kind of hard to make, but also kind of hard to bypass by the attacker. So we'll see.
426430	430330	So the first tool, we call it InFishyShell, not we call it,
430330	435210	the maker call it InFishyShell. The tagline is like, sure, we can hook it, because
436470	441950	the people from Javelin Networks, when they make this, all they do in the tools is just hooking,
441950	447630	hooking, hooking. They hook the SystemManagementAutomation.dll, the library of PowerShell.
447630	452890	They hook the SystemCorner.dll to bypass the logging mechanism, and then they hook the
452890	459370	anti-malware mechanism. They just hook everything. But it works perfectly fine,
459370	464550	because when they hook it, and then they override the input length for those attributes, the three
465290	471390	attribute buff, into zero length. So it's pretty much non-existent, which equals to
472200	475990	not functioning PowerShell detection, which is great for them.
477390	482590	So we have five detection here. We got the first one is low-hanging fruits.
482590	490130	So as you can see there, there is a dll called InFishyShellProfiler.dll, and then there's a
490130	495630	bat file that run with pat as admin. So this file are pre-compiled already, so it's available on
495630	501210	the GitHub. So when people run it as is, you can detect it. That's the goal of low-hanging fruits.
501210	507290	You detect it by using sysmoniv-97 and sysmoniv-91, and you deploy the role in your scene.
508030	513930	When you run the tools the first time, you will see this unique trace on sysmoniv-91.
514050	519090	You will see a PowerShell in the command line section, in the command line field,
519090	525770	just PowerShell, no exe, no parameters, etc. And then the parent command line will uniquely be
526550	533950	exe that is calling a bat file. You get the idea. So there's exe and a bat file in the same
533950	539430	parent command line. So we can combine these two information and then make a detection out of it,
539430	545310	which is what we do, what I do. And then the next one, this tool is actually able to do some
545310	552370	privilege escalation by adding some entries in the registry key. So we need to watch when they
552370	559390	do this using rec.exe, for example. And then there's a certain value, specifically inproc
559390	566530	surfer32, and those flags that you can see. The parent command line will be the same
568330	573390	parent command line as the previous one. So you will have the .exe and then the .bat.
573990	579250	Again, if you combine that and then you combine additionally the rec.exe tools,
580110	586270	you pretty much have pretty strong detection there. The next one, it's the inproc surfer32
586270	594630	registry key changes, or additional, to say. So if you see here, you can see the target object
594630	601430	is the inproc surfer32. But they're trying to load the malicious... not malicious, like the...
601430	608970	not PowerShell DLLs that they are using, which is the InfoShellProfiler.dll. So you can watch
608970	615410	for anything that is not system32 being loaded to this particular target object,
615410	620110	because that's kind of fishy. And again, you will be using Sysmon,
620110	624890	specifically event ID 13 of the registry value set.
626890	633210	The last detection for this tool, it's actually watching the DLL being loaded
633210	640290	to the legitimate PowerShell, because again, it will hook the PowerShell library. So there will
640290	647470	be... you need to load the module from the DLL to the exe. But the thing is, usually PowerShell
647470	652870	will load stuff from Microsoft, because it's a Microsoft tools. And then you can also see
652870	658290	the signature status, it's false and also unavailable. So that's kind of questionable.
658290	665810	We can combine this... what do you call it... interesting thing, combine it together,
665810	669130	and you can make a row out of it and start building detection on it.
669870	676090	And the next tool is PowerShell DLL. So it's not PowerShell, it's PowerShell DLL.
676450	681730	And the tagline for this, yeah, we got DLL for that, because it's on the name already.
681730	688970	So Penta pretty much created... this is also one of the tools that is having a lot of stars in
688970	695870	GitHub. So this tool actually has two modes. You can use the DLL mode and then the exe mode.
695870	703470	For the DLL mode, you need to use the DLL loader. So this is a low bus component that will be used.
703730	711010	And you'll load the particular DLL that you feed. Or you can use a pre-compiled exe. So you just
711010	717510	run the double-click exe and it will just do the job. So you'll use... there's options of five
717510	725770	different DLL loader thing or proxy execution exe that you can use. So this binary is signed
725770	734430	by Microsoft. So sometimes it's not... it's normal when people whitelisted it. So make sure you pay
734430	741910	attention in this particular area. And then moving forward for the exe mode, it will load
742430	750170	the exe itself. It loads 57 PowerShell automation DLLs and other supporting DLLs for the operation.
750170	756750	So all the lists... all the 57 DLLs are listed on the appendix at the end of the presentation.
757930	763150	For the detection, we get four things here. We get the low-hanging fruits, which is
764630	771010	simple thing like description field, product field, even the image, so the file name itself.
771370	775650	So you can definitely use that. Again, this is a low-hanging fruit detection.
776310	781590	Just a tip, if you want to change it, you can just go to the code before you compile it. And then
781590	787710	those are the information by default, the PowerShell DLL, copyright 2016. You can easily
787710	793050	change it to anything. But again, low-hanging fruits detection is supposed to be easy detection.
793590	801170	The next one, PowerShell DLL loading DLLs. To be precise, PowerShell DLL loading the PowerShell
801170	807590	DLLs, so the real PowerShell DLLs. So this is applicable for the DLL mode. For example,
807590	814790	you're running it using the runDll32.exe. And then runDll32.exe is loading a bunch of
814790	822210	PowerShell-related DLLs. It's like they're trying to do something related to PowerShell, right?
822230	827630	So yeah, that's what they're trying to do. So we can watch them, again, with the system 1.97.
828690	833630	And then more general to that, we can actually watching what the loaders do. So whenever they
833630	840270	are loading unsigned DLLs or the DLLs that doesn't have any signature, we can create an
840270	846130	alert on that. But the problem with this, it's actually quite noisy. There's some application,
846130	852770	third-party application that do this. On the top of my head, I can say notepad++ do that.
852770	857930	So that's the first thing that triggers the role when we deploy it in the production. I'm like,
857930	866450	okay. But yeah, you can whitelist it for sure. The next one is when the exe mode loading 57
866450	872330	different DLLs. So this will happen in a millisecond, just like that. Just instantly
872330	881130	load 57 DLLs. And you can see all of this from system 1.97, but make sure you add those DLLs
881130	887110	into the system 1.config. Just make sure you modify the config to watch for those specific DLLs.
887930	892630	For this, to make it easier or to make it detection better, you can use correlation
892630	901450	or cardinality. So whenever one DLL is being loaded, the rule itself will look for the other
901450	908110	56 DLLs if it's being loaded around maybe like in the last one minute or like in the last 50 seconds,
908110	914770	et cetera. So you can just see if at the end, like as a bigger picture, if all of them being
914770	919990	loaded at the same time. So some examples of correlation on the same that you can do is elastic
919990	926030	search. I think they have cardinality rules. ArcSight correlation engine for sure. And then
926030	932430	Splunk, you can combine multiple indicators. So you will have 57 indicators. And then when
932430	938290	everything trigger at the same time, you create a rule out of it. And then you can also use elastic
938290	945070	Kibana heat map if you want your analysts to do that just to look into stuff. And you can do it
945070	952510	over Python for sure because, yeah, what Python cannot do, right? Powerless shell, the next tools,
952510	959230	the tagline is don't worry, we got Lullabas here because Mr. Unicoder, I think he's in Montreal,
959230	967670	local Canada also. So yeah, so what in his mind when making this tool is just to use a lot of
967670	975450	Lullabas. There's two Lullabas specifically being used here, the msbuild.exe that will be used to
975450	980870	compile a payload that you send from the outside from attacker machine to the target machine.
981090	987870	So it relies on the msbuild.exe for execution. So it will provide a script, either PowerShell
987870	993770	or whatever, and then it will compile it for you. But the unique thing is they are not using the
993770	1000130	one that is already in the machine. So they bring the whole exe from the outside and then rename it
1000130	1005030	to something else. It can be something random, it can be to a known process name, for example,
1005030	1013490	cog.exe or cnd.exe. And then from there, it will get the instruction from the script file,
1013490	1018390	from the PowerShell script or whatever script you provided. It will encode the command using
1018390	1023410	certutil, another Lullabas, and then they'll perform some kind of obfuscation, make it
1023410	1028330	confusing for the analyst, for the blue team. So you can see here the function and variable names
1028330	1033930	is just like mumbo-jumbo. You don't understand what it is. The last component, not the last
1033930	1038250	component, it's the component that is sitting on the upside on the attacker machine to generate
1038250	1044970	all of those stuff are a PowerShell.py, which is like a Python code that pretty much the engine
1044970	1051630	of the tool will create everything. And then you can ship those three files to the victim machine.
1053410	1063050	For the detection for the low-hanging fruits, we will have a creation of the... remember that
1063050	1069570	they will rename the msbuild.exe. So you can check on the .NET Framework folder if there's
1069570	1076630	any new exe file being created. For example, if you see cnd.exe created in the .NET Framework
1076630	1085650	folder, that will be so suspicious. You'll be using SysModify11 for that. PowerShell logging,
1086110	1091590	well, it's because this tool is not really evading the PowerShell detection.
1091590	1100210	It is still recording the output of the PowerShell script being deobfuscated. So after
1100210	1106530	all the encoding, you can still see the final content of the code. You can detect more PowerShell
1106530	1115970	payload, etc. using the Event ID 4104 from the Microsoft App, if I'm not mistaken.
1116730	1125610	Moving on, detecting the low-bass. The first component 3A is CircUtil. So because they
1125610	1130470	encode the thing, the payload, they need to decode it in the victim machines.
1130470	1135990	So they use CircUtil to decode the hex. So you can watch for any CircUtil doing
1136530	1141690	decode hex function, because it's actually really rare in the production. You can use
1141690	1148030	SysModify11 for that. And then the next part of it, the second half, it's msbuild.exe,
1148030	1153930	the renamed one. So not really msbuild as the name, but it is from the description field,
1153930	1158590	you know it's msbuild, because the only way you can change the description field is to
1158590	1163470	reverse engineer the whole application and then change the value, which is like too much work for
1163470	1173590	just evading this stuff, right? So the msbuild.exe will be combined with the random 5 to 25 upper
1173590	1181330	and lower characters. So you can watch on that combination, SysModify11 again.
1181430	1186530	Process masquerading, this pretty much can cover not only these tools, but pretty much any
1186530	1193910	masquerading, which is always suspicious. So the file msbuild.exe being renamed to smss.exe,
1193910	1201070	or on the right side, you can see it's a random name, can't even pronounce it.
1201250	1208570	Again, SysModify11 for both. And then we have number five, the .NET DLL loading. So you see
1208570	1219070	here in the image, it's smss.exe. We already know it's not sms, but we can see why does sms.exe is
1219070	1227350	loading Microsoft build or msbuild.tas.dll. So that's definitely suspicious, so you can build
1227350	1235410	detection on this. SysModify11 again. And lastly, PowerShell DLL loading,
1235410	1247410	that is always visible via process access. So again, our .exe, smss.exe, can be seen
1248210	1256870	making some access trying to touch poking systemmanagementautomation.dll, which is again,
1256870	1263970	it's a PowerShell engine. Why would smss.exe doing that? Are they trying to get some functionality
1263970	1269730	out of it? Probably is. So you can use SysModify11 to build that. You can combine all this information
1269730	1277110	together. Tools number four, no PowerShell. The tagline is, can you C-sharp? Because
1277730	1285970	bits.admin create this tool implemented in C-sharp. And this is really popular these days.
1285970	1293130	If you look for offensive researcher, they start using more C-sharp, C-sharp, C-sharp.
1294210	1300450	Because it's hard to detect C-sharp operation because it's not using PowerShell. It's not
1300450	1307470	using PowerShell DLLs. It's just go straight to the native.net library. And this tool,
1307470	1313310	it's actually trying to mimic PowerShell. So you get the same cmdlets. For example,
1313310	1321810	you have things like get process, get user, et cetera. There's two modes. You can run it by using
1323250	1329430	rundll32, again, similar to PowerShell DLL. Or you can run it using CobaltStrike.
1330130	1335890	There's two components. For CobaltStrike, you get the exe file, and then you get the cmi,
1335890	1341830	the CobaltStrike file. For the DLL, there's two options that you can do, depending on your target
1341830	1349190	machine. You can use the 32-bit DLL or the 64-bit DLL. And then you will need to load it using
1349190	1357250	rundll32. But I suspect you can use the other DLL loader. And it's exactly acting like
1357830	1364530	PowerShell DLL mode. We get forward detection for this. Low hanging fruits,
1364530	1371430	again, because it's written in C Sharp, based on .NET. Just look for a description product,
1371430	1378850	just in case the user forget to change it. Because it is always true, true positive
1378850	1386730	when this value showing up in your logs. This is not false negative. This is true positive always.
1387870	1393650	So for the CobaltStrike mode detection, well, unfortunately, our team doesn't have access to
1393650	1399310	CobaltStrike yet. If we can find some CobaltStrike people after this talk, maybe we can build
1399310	1408550	detection on it. Yeah, but thanks to Olaf Hartog, we get detection. He created detection
1409310	1418850	on this particular mode by using Event ID 8 from Sysmon. So you will see there the event
1418850	1424130	description of create remote thread. The process name will contain PowerShell.exe.
1424130	1429110	But the unique thing here, you will see that target process address will always end
1430770	1439310	with 0B80, which is really unique. But there's more story if you read in the blog. There's some
1439310	1444870	interaction between him and also the creator of the tools, and they made some changes, and then
1444870	1449150	it's no longer the case. But still, if someone used the older version of the tools, they can
1449150	1455810	still detect this. DLL modes, again, similar to PowerShell DLL, you need to watch the loaders.
1455810	1464890	Whenever run DLL 32 is loading unsigned or not available signature DLLs, you create alert on that.
1467460	1473260	And then the next one is .NET version downgrading. So this is actually happened by mistake. So I
1473260	1480880	forget that this tool require a lower version of .NET. So I run it in the version 4 or 4.5,
1480880	1486540	if I recall. And then it's just like, oh, I don't like this version. Can you bring it down?
1486540	1494580	And it actually can. So it tries to call the Fondue.exe, which is, I think, an upgrade downgrade
1495480	1502500	exe on the Windows server, and then ask them to enable feature the .NET FX3, which is the
1502500	1509320	version for the 2.3.5. So you can watch that on SystemManager 91. But the thing is,
1509320	1514780	legitimate application might do this, because, hey, who doesn't love doing backtrack using old
1514780	1522240	application, right? So, yeah. Other than that, we got some bonus here.
1522740	1529180	We got two tools that is pretty similar to PowerShell, or no PowerShell for the
1529180	1535040	SharpQuick. So the first one will be PowerLine. It use MSBuild, really remind you to PowerShell,
1535180	1542260	a lot of compilation stuff. And SharpQuick will be, this is actually a tool they use to demonstrate
1542960	1548300	or test the blocking of PowerShell, and just to bypass AppLocker, because I don't think
1548300	1555540	Red Teamers like AppLocker at all. Bonus detection IDS, Sysmon Event ID 10,
1556100	1562300	process access. So any application that accessing PowerShell VLL, but not PowerShell, because you
1562300	1569560	are not supposed to do that. Windows PowerShell Event ID 4103. So this is locked from PowerShell.
1569560	1575780	But when the context application is not PowerShell, isn't it questionable? So yeah,
1575780	1583340	I think we should be watching for that also. And lastly, you can use ETW for .NET library tools.
1583340	1591480	So you can analyze this information using Message Analyzer and Lockman. But I think there's also
1591480	1598280	some tools out there. I think Splunk have like a converter for it. There is a sealed ETW,
1598280	1603740	Roberto Rodriguez play with it a bit. There's a series of blog talking about
1604700	1609200	analyzing more .NET blocks. So I think it will be interesting for you to try.
1610240	1617220	Well, that's pretty much the talk. It's pretty much, yeah, it's a compressed version,
1617220	1623600	as I mentioned. So if you'd like to know more, you can always go to my presentation previously
1623600	1630400	on Hackfest. Just some messages for red team, blue team. So just do all of this stuff. Use
1630400	1635680	PowerShell, update PowerShell over blue team, et cetera, et cetera. And lastly, of course,
1635680	1641020	be nice to each other. If you're a purple team, you can take both sides. Yeah, at the end of the
1641020	1647000	day, we need to be nice for each other because we are in the same boat. At the end of the day,
1647000	1653440	we just want to be Megazord and protect our security company, not security company,
1653440	1661000	our organization. We work together and then, yeah, we just upgrade our security posture.
1662080	1668020	And all right, that's pretty much it. Don't forget to grab some Sigma rules on your way up
1668020	1673260	because I made a lot of Sigma rules just for this presentation in the past week.
1673980	1681080	I actually never wrote Sigma rules before, but I definitely know what is Sigma rules now. So
1681980	1688880	make sure you grab that. You can convert the Sigma rules to any other same QRadar, Splunk,
1688880	1695920	Elastic, ArcSight, whatever you want. You can use either Encoder.io or Sigmac,
1695920	1702560	but I tested it on Encoder.io. So all the Sigma should be able to be converted to the other type.
1702560	1708580	If you use Encoder.io, but Sigmac, it's also an option if you like to do like CLI kind of thing.
1709980	1716140	So I'm so sorry that I didn't mention MatterAttack right from the start because I'm a threat hunter,
1716140	1723080	but yeah, I need to mention that. All the rules, all 20 rules that I've made for the four tools
1723080	1727740	are mapped to the closest attack TTPs. It is also using the newest version of the
1729380	1735060	TTPs. They're using sub techniques. So I try my best to map it. So if it's not, it's not perfect.
1735060	1740400	And if you want to change it for sure, you can do it. Yeah. So this is the slide that you want
1740400	1747320	to take a picture of, that you want to scan, that you want to send it to your, I don't know,
1747320	1756140	like subordinates. So yeah, make sure you grab it. It's going to take you through my GitHub. It's
1756140	1761360	special. Thanks to my employer, of course, for supporting me to do this understanding,
1761360	1768240	taking me, taking sometimes to do the research. ScoobyMTL, you should have attended his
1768940	1775480	workshop earlier today in the bootcamp village because it is great. And also my friend Avneet,
1775480	1782040	13Avneet for inspiration, guide, and feedback. My coworkers at work literally making me
1782040	1787780	understand PowerShell from zero to hero. And also .NET. I don't really like .NET.
1787780	1795100	Amazing not PowerShell tools creators, like making us the blue teamers need to spin our head around,
1795100	1800860	do a lot of research. And lastly, not lastly, in Fawcett community, Olaf Hartongs for the
1800860	1809080	detection, and he will be speaking later tonight. So make sure you check that. Sigma team,
1809080	1816800	because it's a really useful tool. And please, the last and not the least,
1816800	1823240	DEF CON, thank you so much for accepting my talks, for the volunteers, for your time,
1823240	1828340	and all the attendees for the talk right now. Thank you so much. If you'd like to connect with
1828340	1834300	me and my team, you can. You can find me on Twitter, on GitHub, on LinkedIn, if you'd like
1834300	1841060	to be more professional. Or you can check out a blog for my team, Threat Hunting Team on Medium,
1841060	1849920	and Hunting Threat on Twitter. We posted stuff sometimes. And yeah, if you scan this barcode,
1849920	1854260	it will take you to my GitHub page, pretty much where all my presentation is.
1854560	1857980	So yeah, that's pretty much my presentation. Thank you so much.
1859200	1866040	Thank you very much, Tez, for the wonderful presentation. As always, we encourage you guys
1866040	1874740	to join our Blue Team Village Discord server and ask questions in text talk track one.
1875220	1886240	And yeah, if there's no questions, which I do not see at the moment, I think we are set.
1886240	1891600	And the presenter will be around for a little bit to answer questions, otherwise.