and without further Ado we're ready now
for the first double Act of the day
um let me introduce you to Mr Kurt
Baumgartner and Georgie coutoon
all right thank you guys
uh first off thanks for attending our
talk and uh thank you to activity for
having us my name is Kurt Baumgartner
I'm a principal security researcher with
kaspersky's Global Research analysis
team I've been a part of the team since
2010 working and living out of Boulder
Colorado and this is my friend and
colleague Georgie kochiran
yeah I'm also part of the Global
Research and Analysis team but I joined
not so long ago about two years ago when
I became 18 and uh and great I'm working
at analyzing complex stress I've done
research on the solarwinds attack on the
Phil Fisher a commercial spyware and I
do a lot of reverse engineering of
Target stress and uh I like my malware
analysis a lot
all right yeah thanks kurgi all right so
uh today we're here to talk about uh
particularly interesting threat group
that we've called diceyf
um the story here really has to do with
the targeting of online casino
development Studios and operations
Studios which makes this a really a
pretty interesting subject
so uh first off the The Who what is the
who the who and what so who maintains
continuous acts unauthorized access to
online casinos uh development
environments and operations
um it's a group that's that's known
actually for quite some time they've
been operational uh some vendors claim
that they've been operational for almost
a decade
um but uh while we were performing this
particular incident uh research Trend
Micro came forward with uh a talk at bot
conf and they called this particular
group Earth berberoca or gambling puppet
as they're also known and there's a
previous operation from this group
called operation drb control
other vendors call them unknown they
they don't have a name for this cluster
because it's changing and it's such an
unusual cluster of activity and
resources but we're going to stick with
the name diceyf
um for reasons that we'll get to in a
second
uh so when you're talking about casinos
and and targeting casinos it I have
these Grand visions of Ocean's 11 style
attacks and all this and uh really is
that what we have do we have Clooney pit
uh Duos going after casinos and the
answer is no
it's still really interesting stuff so
the trend guys at bot conf they also
said that there's no evidence of a
financial motivation even though these
guys have been doing this for years now
um they've been supporting their own
custom back doors malware families
they've been going after casinos for
quite some time in the incidents that
Trend looked into they found that there
was exfiltration they did observe some
but it was source code and customer
databases which might tell you about an
interest in money moving customers in
particular the incident we're looking at
has to do with
organizations in Hong Kong and Southeast
Asia very similar to what trend saw
so first off what sparked our interest
in these guys it was an unusual delivery
of plug X of all things
um but it was signed with a what looked
like a stolen certificate and the stolen
certificate had to do with a secure
messaging client a pretty obscure one
mango
and this is interesting because past
operations gambling puppet according to
trend has been using
other clients to deliver plugx and orat
to Mac OS
and the other interesting thing is that
this plugx delivery was through a
there was an employee monitoring system
and then there was also a security
Center distribution so the installer
itself was signed with this stolen
certificate and then it was sent out
within an organization from a security
Center uh distribution service so they
had access to everything
and then finally there's a.net file that
maybe a week after we initially saw
plugx
at the within this environment that had
a bizarre pdb and
uh it was signed with the same
potentially stolen digital certificate
and you'll see down here their pdbs are
pretty explanatory as far as development
goes and the functionality and sort of
style of of these Developers
so that certainly sparked our interest
another thing that sparked our interest
is that uh this game player framework
downloader was calling back to the same
command and control server as the signed
plug X
payload that was delivered to this
customer maybe a week prior they were
using mango.exe this secure messaging
client file name they were using the
digital certificate and they were using
the file name so they were really trying
to spoof this secure messaging Client
app
um and then finally it's interesting
that there are all these puppet loader
strings within the pdb pdb files
themselves
um so with that uh those dot net objects
that we're talking about the game player
framework itself will dig into uh or
geergy will dig into technical details
of that framework
okay thank you good so uh uh one could
discover those gameplay of framework
samples he gave them to me to reverse
engineer and so I had to
dive into this malware framework and
analyze it and while doing it I found
many interesting things that I want to
show you right now
so first of all when you have this a
large collection of files a large
collection of malware samples that
belong to the framework the first thing
that you do is called basic static
analysis
you just look at the files in general to
find some uh interesting artifacts and
in our case such an artifact as good has
already mentioned it was a pdb pass
pgb paths they are important for malware
analysis because this paths contain a
pass to the folder where the source code
of the malware is located
and we can use those pdb paths for
malware attribution
for example so in our case the pdb pass
contained a string called gameplay
framework and they were also in this
gameplay play a framework folders there
were two subfolders they're called Tifa
and Yuna and uh we believe that FIFA and
Yuna are kind of a branches so there is
a gameplay framework and there are two
branches out of it the thief one and the
unit one
and when I saw the speed we pass I
immediately wanted to know what Tifa and
hula is as I have already said PDP pass
can be helpful in the attribution like
for example you can find uh the name and
the last name of the malware developer
if you're lucky enough so I needed to
find what Tifa and Yoona was
so I first suppose that it was a
different Universe some words in the
Marvel developers mother tongue but when
I looked at uh something that it could
connect different humor together I found
the game final fantasy and Tifa and Yuna
are female characters from this game so
this means the presence of these folders
could mean that
uh the malware developer is a fan of
Final Fantasy and he may have left those
folders as an Easter egg for us malware
analysts
and as for the branches themselves the
Tifa Branch we spotted it first in
November 2021. but then in 2022 the euro
is a default Branch completely
disappeared and was replaced with the
unit Branch so we may suppose that the
zipper branch is just an older version
of a gameplay framework and Euler branch
is a new version of the framework
so then I had to find the uh among these
uh many files of the framework I had to
find how the infection started I looked
for the files I looked through our
antivirus Telemetry and I found out
something that looked like an installer
of the framework
and while browsing through Telemetry I
found out that uh this is installer was
distributed through the victim
organization Network so what happened is
that the attackers they compromise the
victim Network and after doing that they
started deploying the framework over the
machine so this framework is used as a
post exploitation framework
and what was interesting about the
installer is that they didn't look like
a common targeted malware installer
usually if you are a sophisticated
straight actor and you want to deploy
malware to victim machines you try to do
it as silently as invisibly as subtly as
possible so that no one notices anything
but in our case everything was vice
versa
and uh when I open the installer in the
decompiler I noticed that it has a
graphical interface which is very
uncommon so they display to the user a
fake window and
while that is playing it they are
installing malware
and if you are doing graphical uh uh
installer malware graphical interface
model installers there is a problem you
need to convince the user that your
window is legitimate so that the user
doesn't suspect everything and go to the
I it department and cry oh I mean
with malware
in order to do that in order to do in
order to prevent that the attackers used
social engineering let's look at the
window that they display in it there are
some interesting strings let's look at
here mango account data synchronizer
devoted to the victim organization name
so what they did is that they uh they
know what victims they are compromising
they included the victim organization
name in this in in the strings in the
window
and another thing they did let's look at
the other string employee accounts need
to be bound with IP addresses please go
to the 10th floor to find the IT
department to build so they did not only
discover the victim organization name
they also conducted research conducted
reconnaissance on the victim's office
and they found out the floor where the
ID department is located
and when a usual user like a person who
is not very familiar with cyber security
when an ordinary uses sees this window
they may simply think that uh
oh it's something from the it
departments they say where uh the IIT
Department Floyd they have my
organization name so yes that's truly
legitimate that's not malware that's
what an ordinary user could think
but in my opinion such uh reconnaissance
they research the victim organization
floor plans they found out where the IT
department is
such reconnaissance is not common for
Target malware and I think it's uh
really amazing
so what this installer does is that it
writes the framework files to the
system32 folder this is the first thing
it does and then it for some reason
creates copies of system dlls inside
system inside system2 folder and after
doing that it establishes persistence
now writing files and establishing
persistence are really common thing for
malware installers but what about
creating copies of system dlls why would
you need to duplicate dlls
let's look at the step in more detail
like in system32 folder we have the
system dlls like kernel Studio dll
ADV API subject to dll and uses it to
the dll
what the malware does is it copies these
dlls and other dlls to the same folder
but it adds an ads to the name like
kernel 32 dll becomes kernel Associated
to s.dll and user32.dr becomes
user32s.dll
but why would you need to do that it
turns out that the framework components
it reference it doesn't reference the
original dlls it references copies of
the dlls like it Imports function from
the S functions
there may be two possible explanations
about of about why they do that
the first thing that they wanted to
prevent is to prevent analyzing the
malware in a sandbox let's suppose that
you are a security operations center
analyst and you have some suspicious
activity going on
you notice the uh the the files that
belong to the malware framework but at
this point of time you don't know
whether they are malicious or not in
order to find that out you want to take
those files and plug them into the
sandbox and see what the sandbox thinks
and when you do that the sandbox will
refuse to load the files because the
sandbox if you don't have the installer
if you have only the framework files uh
the sandbox is going to contain only
original dlls it won't contain sdlls and
that is why execution on a Sandbox would
fail and there would be
no information about the samples
and another thing that uh is possible is
that they wanted to evade extended
detection and response Solutions or
other Security Solutions
Security Solutions like to set hooks on
dlls they need that in order to uh
intercept cost of functions and to track
which function is called and then
correlates uh called functions with some
rules in order to detect malicious
activity
but EDR solutions they may not set hooks
on the copies they may only send hooks
on the original functions and thus when
the malware will call a function from
the copy it will not get logged in the
EDR and the malware will be able to
perform the activity in a silent way
so that's it for the copying and now
it's all persistence techniques they
always change them probably in order to
make it harder to detect the samples
in the very beginning 2021 we saw some
distributes using the services they
created the service and they configured
it to load on Startup the service names
were called certificate manager and
update
then they switch to schedule tasks that
had the same names certificate manager
and update
and after that they switch to another
trick which involved a
copying a dll called uh rest custom as
the dll and then putting the passwords
dll in a key belonging to the harassment
service harassment service is a standard
service that comes with Windows
and if you specify the password custom
as those dll the erasmine servers will
loaded on Startup
why so why is this strict with erasmal
service and the same dll rest custom as
it has been previously used by the
manuscript Strat actor which is a Korean
speaking threat actor but uh
for now we think that they simply the
dicef they simply borrow this trick from
a manuscript and uh that is why we
cannot perform attribution based on this
trick but still the number of decision
techniques is very vast they always
change it in order to avoid being
detected
so when you establish persistence every
time when the victim machine starts up
the framework will be launched
and earlier we saw an anti-sandbox trick
that involved copying uh dlls but on
Startup there are actually more such
tricks performed
like uh take this trick for example it's
kind of uncommon trick
what the malware does is that it
allocates 10 chunks of memory and each
of these chunks is 50 megabytes in large
so in total the malware allocates 500
megabytes
and then it starts filling each of these
chunks with data
and after writing the data the malware
reads it back from memory and checks
that the data is in place now the trick
here is the sandboxes and emulators they
may not handle large amounts of memory
correctly like 500 megabytes for uh for
example a Sandbox or an emulator that
has one gigabyte of memory is kind of
large
and that is why uh as a Sandbox or an
emulator May incorrectly handle writing
stuff to large amounts of memory and
maybe the writing will fail or maybe
something else will happen the malware
tries to detect uh such exceptions and
if it detects such an anomaly then it
stops executing
and another trick is it involves setting
an error value on Windows through the
setlist error function and then it
retrieves it back using the get last
error function and then it checks that
the two values the set one and the one
that has been retrieved from get less
error it checks that the values are
equal and if they are not the malware
stops running
so uh these are quite in my opinion uh
cool position tricks uh cool
anti-sandbox tricks that are not seen in
common malware especially the one with
the 50 megabytes maybe they wanted to
bypass some kind of uh EDR sandbox that
is not handling large amounts of memory
correctly so the presence of these
tricks it basically proves that malware
developers are able to adapt to Security
Solutions installed the victim machines
and as they are able to create some
things that would help bypass them
so if all these anti-sandbox checks are
complete uh the framework loads its main
module and the main module is a.net file
and on Startup it loads its
configuration from a folder in C program
data which is called Nvidia and the file
with the config is called the config
and once it does that it connects to the
C to server command control server that
is specified in the configuration
and what's special about this C2 servers
is that they contain the word mango in
them as we will see later like a mango
update something like this so uh they
also try to masquerade uh uh the uh
activity of uh uh as a framework as the
activity of the secure mango messenger
that could told you about before
and once it does that it starts sending
heartbeat packet packets and it receives
commands from the command and control
server now the packets they all sent
through a TCP socket and it has its own
kind of structure for uh
for these commands and forces messages
like it contains stuff like checksums
and so on but what's important about
commands is that the commands of the
main module they can for example collect
a lot of system information like uh uh
the computer name the anti-virus
installed amount of memory the processor
this thing may be required for initial
recorder sounds
now it also allows to execute shell
commands like maybe to perform some
execution maybe to also perform some
fingerprinting of the victim machine it
can also be useful
then it can be used to download and
upload files maybe just to run some
tools penetration testing tools on the
victim machine
and what's important uh here is that it
also allows to manage plugins the C2
server May request a framework to
download to download the plugin and to
install this plugin
and let's look into the plugins in
Greater detail
so plugins they as you saw the main
module it doesn't have many features
just like basic stuff command shell file
uploading just very basic stuff
there's a all the activities of the
framework are concentrated in plugins
plugins are normal exe files that are
downloaded from the command and control
server
but what's important about plugins is
that the malware doesn't drop them on
disk they are all kept firelessly only
in memory and this complicates the
overall process of retrieving plugins
from the victim machines
so uh uh since uh their Wireless uh
let's look at how the main module loads
the uh plugins
uh so every plugin is run into a
separate process
please look at the screen I'll show you
a demo about of how the gameplay
framework loads the plugins so first of
all right here we have our main module
process and as I have already mentioned
the the every plugin runs in a separate
process and so what the main module does
is that it creates an spouse.exe process
and it creates it in suspended mode
then it injects a plugin downloader
through dll injection just like it's
very standard dll injection message just
virtual analog Android process memory
and after it does that uh it so the main
module opens a TCP port and it starts
listening for connections on this fault
and what's the plugin downloader does is
that it connects to the main module
through that Port via a socket
and then the main module it dispatches
the plugin body to the plugin downloader
and once the plugin download uh loads uh
it once it receives the plugin it starts
launching it and as a result we have an
SVC host process with a plugin in it and
then a plugin into thus some stuff like
it on its own connects to the C2 server
requests its own commands from it and
executes them
now when we looked into the plugin
launching process let's look at the
plugins themselves
the main module it contains a.net
dictionary with plugin names and if you
look attentively
at the screen we notice that plugins
have Chinese names and this is a very
good clue for attribution
by looking at that we can suggest with
at least medium or maybe even high
confidence even high because we noticed
that the malware is distributed through
plug x with which has Chinese Origins
we can
use that
malware has Chinese Origins based on the
Chinese strings that we have here
and look let's look at the Arsenal of
bloggers that we have here what we have
here we have something called
acquisition system that's what Google
translate gave for this uh Chinese
string
maybe it used to collect some data from
the victim machine
now I have something called hidden
process it can hide processes hide most
processes from the uh from the user
then it has a plugin called general
purpose
it can also perform port forwarding both
following day becomes useful whenever
you want to access an internal resource
on the victim machine and if you if you
want to do it from the attacker machine
you can perform port forwarding and by
doing that you can conveniently access
some maybe infrared some internal
internal websites on the organizational
Network you can do it through the uh
through your own computer if you are an
attacker
now what we have here is screen transfer
it is able to
send the screenshots take screenshots at
uh periodically and then send them to
command control server
another thing we have is virtual desktop
just maybe once the user is away that
that will be able to control the mouse
pointer and the keyboard and do whatever
they want and then clipboard to capture
the clipboard
and there are also plugins that have
English names SSH just
a secure shell for also for execution
commands session CMD may be also for
executing CMD commands and then two
plugins for stealing cookies from chrome
and Firefox
out of these three plugins we observed
out of these plugins we observed three
of them in the wild which are general
purpose virtual desktop and clipboard
the other plugins we haven't observed
them in the wild but we keep looking for
them
as for the general purpose plugin it's
as we as the name suggests it provides
some miscellaneous commands to the
attacker like create processes browse
and modify registry create stop and
start Services you can also turn the
machine into a proxy server again it may
be useful when the attacker wants to
easily access some resources on the
local network of the organization
and it also contains some commands that
allow it can be useful for performing
lateral Movement Like listing at Active
network connections and recent RDP
connections by looking at these
connections the attack may decide which
computers to attack next
now as for the clipboard recorder plugin
uh its name is kind of confusing because
clipboard recording is not only
functionality it's also able to lock key
stocks the method used to lock key stock
is kinda straightforward and known for a
long time is by using the getasync key
State function
and as for clipboard it locks it using
the.net clipboard class
and then it encrypts the data with a
simple Excel Cipher it's very common for
malware and then rise it to disk and it
tries the clipboard files and the
keyword files to separate files it
splits them
now as for the virtual desktop plugin
unfortunately we have not uncovered yet
it's dotnet binary but we have uncovered
each configuration its configuration it
contains two things a remote address
which is an IP address and a port
we can suppose that during uh uh during
its work this plugin connects to this uh
server and uh just maybe uh it
implements somehow an RDP communication
using the server
and what's uh important about this IP
address is that let's look at the Domain
what named which it resolves it's called
update to dot imango lm.com so here
LML here is probably just they replaced
an i i mango IM instant messenger
they'll try to replace it as an L in
order to masquerade the URL and as you
can see again they try to masquerade all
the activity as legitimate as belonging
to this mango messenger this is probably
installed at the victim machines
foreign
so what can you say about this framework
in general first of all the
reconnaissance part is just amazing how
they looked for the floor plans how they
discovered that the IT department is on
the 10th floor and how they tailored the
files to the victim organization
and the fact that they used uh as a
stolen certificate for the mango
messenger it is probably used at the
victim organizations that is in my
opinion very amazing example of
reconnaissance
and it also contains quite rarely
encountered anti-antivirus techniques
like the technique with dll copying it's
not commonly imagine targeted malware
and then some also sandbox checks that
are rarely used
so in terms of uh reconnaissance and in
terms of anti-antivirus detection this
malware performs quite well I would say
and it also has a vast number of
functionalities like we saw before a lot
of plugins with a lot of functions that
allow the malware developers and the
attackers to perform whatever they want
to do
however some things in the smell where I
live much to be desired
for some reason they made some operation
security mistakes like the pdb pass
in Target of malware you have to remove
those PDP pass if you forget to strip
them then it's a mistake and it allows
as I have already said reverse Engineers
to find something about about you and
about your identity in some cases
and another mistake that we saw is the
Chinese plugin names
in my opinions I should have removed
that because
it provides a hint that the malware has
Chinese Origins maybe they didn't remove
it because they weren't really concerned
with uh attribution being performed
and another thing is that there is no
obfuscation.net binaries all the cloud
claims like Yuna and Tifa all the method
names are there they are not replaced
with some some random jungle it's all
there and uh since they forgot to add
obfuscation this allows to easily detect
this malware through for example Yara
rules but the most difficult case for
victim organizations is to find out they
are infected and uh them once you find
the detection is easy
and uh overall uh the malware it's it's
a complex complex framework it performs
quite well it has a lot of
functionalities and uh it's dot net uh
it's a new rewrite of the C plus plus
malware uh I guess uh that uh uh it's uh
quite sophisticated and uh it's quite
for the attackers it's quite useful
and now uh code
please uh oh
all right thank you Georgie uh excellent
analysis
um a few other remarks or notes about
the framework uh that we found during
throughout this incident
um it's interesting that these guys
continue to develop this framework
throughout this months-long incident so
at the very beginning of the Tifa
downloader deployment in those malware
modules the custom they hand wrote Json
uh data Json formatted data within
um within their executables so when they
were sending up data to command and
control servers they were doing this all
by hand months later in 2022 they
started adding newtonsoft Library they
started adding more professional support
to their.net modules which is kind of
interesting they made a few they added a
few bugs actually at the beginning of of
the development cycle so that was
interesting they added log talking as
time went on so I think they found more
mistakes in their code than they
expected they eventually added
encryption functionality to cover up
what it was they were stealing from
machines and then finally throughout the
campaign they added these incremental
changes and they actually maintain
date-based versioning timestamps in all
of their modules and there were lots of
them so they they're doing a pretty
interesting semi-professional job of
maintaining their code and delivering
new new code as time goes on
um other Oddities about uh the group is
in in their activity is that they Mash
all this stuff together so yeah they
want to be stealthy and they deliver
things and they cloak like what Georgie
was talking about um their
infrastructure in names that spoof mango
uh mango.com so imangolm.com
um but they do this with all they throw
all this stuff together so they'll
they'll deliver a mango executable
that's using Nvidia strings which is
unusual and then they throw in Final
Fantasy strings into that and then on
top of that they're replacing Microsoft
VPN dlls which doesn't match any of this
uh like that it just doesn't fit so um a
lot of what they're doing when they
combine it together just makes a bit of
a mess and makes them pretty pretty
discoverable
um other uh artifact Oddities have to do
with uh previous secure messaging client
that they used they trojanized an
installer for Mimi chat and here's a
statement from the Trend Micro guys we
couldn't find any public source for it
which brings into question whether or
not it was developed by the adversary
themselves but we we don't have an
answer to that that's pure speculation
but they were delivering plug X so with
this trojanized Mimi chat installer and
then they were also delivering orat on
Mac OS so they were supporting multiple
platforms even I think we saw this stuff
in 2018.
in 2019.
um I mentioned the and and Georgie
mentioned the Nvidia Oddities uh these
good file names are where they store the
clipboard and the stolen keystrokes and
then the heartbeat data is maintained in
the stat loc file again it's unusual for
a mango for a secure IM client to store
stuff in these paths so it kind of kind
of it's an odd choice
um Georgie went over the Final Fantasy
characters the Tifa download downloader
was yeah fairly primitive compared to
the Yuna code
and and then finally the Microsoft VPN
support and the other dlls that they
replace in system 32 is just another odd
choice for for a messaging client
um and then finally uh one other fairly
sloppy thing is that within these pdb
strings and the other the rest of the
code when you look back at this 2020
Flash installer that they used as a part
of Earth barbaroca or operation gambling
puppet they use the string puppet loader
puppet core release and uh sure enough
two years later with some of their later
Unicode they were calling it Yuna puppet
loader guard and so they they're still
using they're still incorporating
strings and and names in their code base
uh they're borrowing from older code and
just and just rebuilding and
reconstructing in.net which again kind
of gives things away so uh that's
another odd
um odd development choice
all right and with that um I'd just like
to say we have more details in our
private report
um and we always have trial subscribers
and that sort of thing so we have a
two-part report about these guys in
their activity in this particular
incident so if you're looking for more
details we can always get you more
details including iocs and everything
else with that thank you for your time
and I think we have time for Q a
thank you
any questions yeah
thanks for that very interesting
um could you go back to the GUI
installer please
there was a a question and observation
so that the question would be
the reference to the 10th floor it
department since the threat actor
already had access to the environment
it's likely they probably saw that in
some sort of AED
uh you know user profile right or they
just looked on LinkedIn so they probably
weren't looking at floor plans uh to get
that so I would probably just be less
impressed but it's still good right in
terms of execution
um and what's interesting about that
that statement that employee accounts
need to be bound with IP address is that
they're not just saying
uh you know I don't know something that
you would receive as an employee read
the statement and say oh okay this is
linked to the IT department on the 10th
floor which is the strong the strong
part of this right but they're actually
directing employees to go to the 10th
floor
so that's really curious to me because
it's too strong yeah so they get the
upside with the 10th floor mention but
then they actually direct employees
there
yeah so it seems strange to me that they
they do that and then the observation
would just be
uh from a language point of view that
last line
we've got you know Anglo spelling of
synchronizer uh the others are you know
us style so it suggests whoever added
that last line was at least educated in
English you know through a commonwealth
type country
um was was there any thoughts on that
um are you referring to the English
language being used or that no
you know Chinese it's the old s and z
s z z
yeah so uh what you see here in English
text uh I added this to uh the
screenshot to Translate from Chinese
what I think about the fact that they uh
is a tennis ball yes it's some kind of
gray area because uh people may go to
the tennis floor and check what the hell
is this uh but this thing it runs only
for a short time so uh it's uh maybe it
will just open they will really they
will close it and they forget about it
uh maybe uh that's how you do it and as
for the mango account data synchronizer
they probably found out that the
organization uses mango then they use a
certificate and then we plan this
information so they may be just once
they got into those organizations they
may have searched for the electrical it
still takes time to look at the files
that you have for example on remote
drives to find the floor plans some
instructions that's what they did
so anything else
yeah is this working
actually we're out of time I don't want
to ruin everyone's uh coffee break yeah
but um you'll have the chance to speak
with them uh for the rest of the day
um thank you very much uh Georgie and uh
Kurt for a dynamic uh presentation full
of information and can see a dedication
to the topic so thanks very much for
that a round of applause yeah
if you guys have questions we can meet
sometime during the conference
please ask some to ask please ask us
questions uh don't be shy
thank you very much