IOC Report
rDoc5633276235623657_xls.exe

loading gif

Files

File Path
Type
Category
Malicious
rDoc5633276235623657_xls.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rDoc5633276235623657_xls.exe.log
CSV text
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_d844b8734f1fb45ad8a822ff442cea23ced3141_3486005a_52676790-a461-4f19-a7ba-cc778124643c\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A2C.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Sep 26 11:27:35 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C31.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C61.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\places.raw
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp1CCF.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp1CD0.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\tmp1CF0.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\tmp1D00.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmp733.tmp.dat
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmp743.tmp.dat
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp7C93.tmp.dat
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp7CA4.tmp.dat
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp7CB5.tmp.dat
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp7CC5.tmp.dat
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
modified
C:\Users\user\AppData\Local\Temp\tmpA7EC.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 26 10:26:13 2024, mtime=Thu Sep 26 10:26:13 2024, atime=Thu Sep 26 10:26:13 2024, length=65440, window=hide
dropped
C:\Users\user\AppData\Roaming\XClient.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 11 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rDoc5633276235623657_xls.exe
"C:\Users\user\Desktop\rDoc5633276235623657_xls.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 2044

URLs

Name
IP
Malicious
178.215.236.218
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://cdn.discordapp.com/attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66f6783b&is=66f526bb&hm=22a3bafe0f63ec86e36ba63ace27289331a1b6e8c8a217e16ac633d8848215f6&
162.159.135.233
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://cdn.discordapp.com/attachments/1288648799220400244/1288791621017669705/xxxxxxxxxxx.txt?ex=66
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://cdn.discordapp.com
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://urn.to/r/sds_seeaCould
unknown
http://james.newtonking.com/projects/json
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://github.com/LimerBoy/StormKitty
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://cdn.discordapp.com
unknown
https://www.newtonsoft.com/jsonschema
unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson
unknown
https://support.mozilla.org
unknown
https://urn.to/r/sds_see
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://cdn.discordapp.comd
unknown
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
cdn.discordapp.com
162.159.135.233

IPs

IP
Domain
Country
Malicious
178.215.236.218
unknown
Germany
malicious
162.159.135.233
cdn.discordapp.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rDoc5633276235623657_xls_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\858CCD728664FC98EE47
66DBE3B90371FE58CAA957E83C1C1F0ACCE941A36CF140A0F07E64403DD13303
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProgramId
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
FileId
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LowerCaseLongPath
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LongPathHash
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Name
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
OriginalFileName
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Publisher
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Version
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinFileVersion
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinaryType
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductName
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductVersion
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LinkDate
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinProductVersion
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageFullName
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageRelativeId
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Size
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Language
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
IsOsComponent
\REGISTRY\A\{99c28d77-1ca8-de76-bd00-f0947f5ca259}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Usn
There are 26 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
6AD0000
trusted library section
page read and write
 malicious
2DB4000
trusted library allocation
page read and write
 malicious
2DD1000
trusted library allocation
page read and write
 malicious
2CDE000
stack
page read and write
2DC0000
heap
page execute and read and write
2B20000
heap
page execute and read and write
5BFC000
stack
page read and write
67E0000
trusted library allocation
page read and write
119B000
heap
page read and write
6670000
trusted library allocation
page read and write
60DE000
stack
page read and write
D80000
heap
page read and write
582E000
stack
page read and write
982000
unkown
page readonly
63FE000
stack
page read and write
5CBE000
stack
page read and write
592F000
stack
page read and write
12FA000
trusted library allocation
page execute and read and write
419C000
trusted library allocation
page read and write
1025000
heap
page read and write
3E11000
trusted library allocation
page read and write
3E41000
trusted library allocation
page read and write
1020000
heap
page read and write
6ACF000
stack
page read and write
6640000
trusted library allocation
page read and write
1400000
heap
page read and write
54AE000
stack
page read and write
BBB000
stack
page read and write
F2E000
stack
page read and write
5BD6000
heap
page read and write
12E3000
trusted library allocation
page read and write
12DD000
trusted library allocation
page execute and read and write
62FE000
stack
page read and write
1290000
heap
page read and write
143B000
trusted library allocation
page execute and read and write
74F0000
heap
page read and write
5C3B000
heap
page read and write
5BB0000
heap
page read and write
5C89000
heap
page read and write
6410000
heap
page read and write
109A000
trusted library allocation
page execute and read and write
5F3C000
stack
page read and write
2D88000
trusted library allocation
page read and write
6650000
trusted library allocation
page read and write
2D74000
trusted library allocation
page read and write
1437000
trusted library allocation
page execute and read and write
3E0F000
trusted library allocation
page read and write
53BD000
stack
page read and write
674C000
stack
page read and write
1305000
trusted library allocation
page execute and read and write
3DFB000
trusted library allocation
page read and write
1070000
trusted library allocation
page read and write
129F000
stack
page read and write
67A0000
trusted library allocation
page read and write
5C3E000
stack
page read and write
6754000
trusted library allocation
page read and write
67EE000
trusted library allocation
page read and write
3E02000
trusted library allocation
page read and write
6E0E000
stack
page read and write
10A8000
heap
page read and write
580E000
stack
page read and write
67C0000
trusted library allocation
page read and write
11CD000
heap
page read and write
1406000
heap
page read and write
2CD8000
trusted library allocation
page read and write
55BF000
stack
page read and write
972000
unkown
page readonly
2B10000
trusted library allocation
page read and write
1148000
heap
page read and write
3DF3000
trusted library allocation
page read and write
55C0000
heap
page execute and read and write
12C0000
trusted library allocation
page read and write
EC0000
heap
page read and write
1080000
trusted library allocation
page read and write
5DC0000
heap
page read and write
1320000
trusted library allocation
page read and write
74EE000
stack
page read and write
12D3000
trusted library allocation
page execute and read and write
1090000
trusted library allocation
page read and write
596E000
stack
page read and write
5DFE000
stack
page read and write
1330000
trusted library allocation
page execute and read and write
7528000
heap
page read and write
61BE000
stack
page read and write
2ABE000
stack
page read and write
5E00000
trusted library allocation
page read and write
2B00000
trusted library allocation
page execute and read and write
6510000
heap
page read and write
F20000
heap
page read and write
12F2000
trusted library allocation
page read and write
68D0000
trusted library allocation
page execute and read and write
3E53000
trusted library allocation
page read and write
1432000
trusted library allocation
page read and write
3E4E000
trusted library allocation
page read and write
12F0000
trusted library allocation
page read and write
609E000
stack
page read and write
65E0000
heap
page read and write
103F000
stack
page read and write
1215000
heap
page read and write
3E16000
trusted library allocation
page read and write
10E6000
heap
page read and write
5A6E000
stack
page read and write
11CF000
heap
page read and write
127C000
heap
page read and write
2D56000
trusted library allocation
page read and write
32E9000
trusted library allocation
page read and write
6600000
trusted library allocation
page execute and read and write
6680000
trusted library allocation
page execute and read and write
625C000
stack
page read and write
56AE000
stack
page read and write
5210000
trusted library allocation
page read and write
56EE000
stack
page read and write
5273000
heap
page read and write
57EE000
stack
page read and write
53FE000
stack
page read and write
4074000
trusted library allocation
page read and write
10AE000
heap
page read and write
3E1C000
trusted library allocation
page read and write
51BE000
stack
page read and write
649D000
stack
page read and write
1302000
trusted library allocation
page read and write
5BC0000
heap
page read and write
3DD1000
trusted library allocation
page read and write
970000
unkown
page readonly
5C8E000
heap
page read and write
117D000
stack
page read and write
605F000
stack
page read and write
3E47000
trusted library allocation
page read and write
7545000
heap
page read and write
1190000
heap
page read and write
6785000
trusted library allocation
page read and write
405E000
trusted library allocation
page read and write
107D000
trusted library allocation
page execute and read and write
2CCF000
stack
page read and write
5EFE000
stack
page read and write
1060000
trusted library allocation
page read and write
11C3000
heap
page read and write
65F0000
trusted library allocation
page read and write
2A70000
trusted library allocation
page read and write
3E2C000
trusted library allocation
page read and write
5250000
heap
page read and write
12F6000
trusted library allocation
page execute and read and write
1000000
heap
page read and write
2D7A000
trusted library allocation
page read and write
1300000
trusted library allocation
page read and write
2D6A000
trusted library allocation
page read and write
EE0000
heap
page read and write
5270000
heap
page read and write
5A5A000
stack
page read and write
3DDB000
trusted library allocation
page read and write
D39000
stack
page read and write
E60000
heap
page read and write
639C000
stack
page read and write
3E33000
trusted library allocation
page read and write
4ECD000
stack
page read and write
2CE1000
trusted library allocation
page read and write
62BD000
stack
page read and write
6BF0000
trusted library allocation
page read and write
1073000
trusted library allocation
page execute and read and write
1092000
trusted library allocation
page read and write
13EC000
stack
page read and write
51FD000
stack
page read and write
1420000
heap
page read and write
5BA0000
heap
page read and write
1440000
heap
page read and write
6660000
trusted library allocation
page execute and read and write
590E000
stack
page read and write
115F000
heap
page read and write
621D000
stack
page read and write
595D000
stack
page read and write
4DDE000
stack
page read and write
69CE000
stack
page read and write
5E0B000
trusted library allocation
page read and write
41B5000
trusted library allocation
page read and write
5260000
heap
page execute and read and write
2D5A000
trusted library allocation
page read and write
6610000
trusted library allocation
page read and write
F30000
heap
page read and write
525E000
stack
page read and write
5B99000
stack
page read and write
5BB5000
heap
page read and write
1427000
heap
page read and write
41AE000
trusted library allocation
page read and write
5DBE000
stack
page read and write
2D90000
trusted library allocation
page read and write
55AF000
stack
page read and write
10A0000
heap
page read and write
2BD0000
heap
page read and write
13AE000
stack
page read and write
1097000
trusted library allocation
page execute and read and write
5E10000
heap
page read and write
12E0000
trusted library allocation
page read and write
980000
unkown
page readonly
3E1A000
trusted library allocation
page read and write
1265000
heap
page read and write
114B000
heap
page read and write
3E3B000
trusted library allocation
page read and write
3E08000
trusted library allocation
page read and write
C3C000
stack
page read and write
5130000
trusted library allocation
page read and write
10D7000
heap
page read and write
1307000
trusted library allocation
page execute and read and write
12D4000
trusted library allocation
page read and write
1074000
trusted library allocation
page read and write
5C9B000
heap
page read and write
F35000
heap
page read and write
603C000
stack
page read and write
4196000
trusted library allocation
page read and write
107E000
stack
page read and write
635D000
stack
page read and write
1340000
trusted library allocation
page read and write
1145000
heap
page read and write
400000
remote allocation
page execute and read and write
5AFD000
stack
page read and write
2D60000
trusted library allocation
page read and write
1261000
heap
page read and write
2D63000
trusted library allocation
page read and write
12ED000
trusted library allocation
page execute and read and write
115D000
heap
page read and write
6690000
trusted library allocation
page execute and read and write
691E000
stack
page read and write
EAE000
stack
page read and write
2EEA000
trusted library allocation
page read and write
41A6000
trusted library allocation
page read and write
2D8C000
trusted library allocation
page read and write
1350000
trusted library allocation
page read and write
3CE1000
trusted library allocation
page read and write
517D000
stack
page read and write
5A9C000
stack
page read and write
130B000
trusted library allocation
page execute and read and write
5210000
trusted library allocation
page read and write
617D000
stack
page read and write
12D0000
trusted library allocation
page read and write
4088000
trusted library allocation
page read and write
611E000
stack
page read and write
EF7000
stack
page read and write
1360000
heap
page read and write
3DD7000
trusted library allocation
page read and write
601D000
stack
page read and write
67D0000
trusted library allocation
page read and write
6C00000
trusted library allocation
page read and write
6791000
trusted library allocation
page read and write
2AFC000
stack
page read and write
607E000
stack
page read and write
1430000
trusted library allocation
page read and write
3CE9000
trusted library allocation
page read and write
5C7E000
stack
page read and write
There are 238 hidden memdumps, click here to show them.