MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7a96c24aabf3e2426942dfc60d8f0ebc944da5bd5ad64e85245297345eedd630. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Emotet (aka Heodo)
Vendor detections: 8
| SHA256 hash: | 7a96c24aabf3e2426942dfc60d8f0ebc944da5bd5ad64e85245297345eedd630 |
|---|---|
| SHA3-384 hash: | c22555c9132107852579e955381eecf7598de5c24066a0e87c44393f7fd7899e43419e6efe935027474909f96af21d95 |
| SHA1 hash: | f73db7a02813d3e93c7a87fae18084079f86e201 |
| MD5 hash: | ae26b022515fde4823238e28a47c242f |
| humanhash: | nineteen-alanine-massachusetts-magnesium |
| File name: | emotet_exe_e2_7a96c24aabf3e2426942dfc60d8f0ebc944da5bd5ad64e85245297345eedd630_2020-12-30__183625.exe |
| Download: | download sample |
| Signature | Heodo |
| File size: | 210'432 bytes |
| First seen: | 2020-12-30 18:36:34 UTC |
| Last seen: | 2020-12-30 21:24:23 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | af8c46e2036b4cba8cb6c464a934bce4 (58 x Heodo) |
| ssdeep | 3072:Uww2ERHyxQGF+TeyVV2HPVxS6biE5JS1i9Zx4Tt4ZCkqRauqqt9+tMjWTzz:jw2ERHmZPVxfD5JSoE4/qRGoWMjWPz |
| Threatray | 1'074 similar samples on MalwareBazaar |
| TLSH | D624DF02B5D0E170E0FE067A48B9DE51077E7D62CFB099DB7BA4248E59702C05F3AB62 |
| Reporter |  Cryptolaemus1 |
| Tags: | Emotet epoch2 exe Heodo |
Intelligence
File Origin
# of uploads :
2
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Emotet
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
emotet
Threat name:
Win32.Trojan.Emotet
Status:
Malicious
First seen:
2020-12-30 18:37:36 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
5/5
Verdict:
suspicious
Similar samples:
+ 1'064 additional samples on MalwareBazaar
Result
Malware family:
emotet
Score:
10/10
Tags:
family:emotet botnet:epoch2 banker trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Emotet
Malware Config
C2 Extraction:
75.188.107.174:80
75.109.111.18:80
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
136.244.110.184:8080
84.232.252.202:443
138.68.87.218:443
172.125.40.123:80
109.74.5.95:8080
61.19.246.238:443
24.179.13.119:80
46.105.131.79:8080
185.201.9.197:8080
185.94.252.104:443
74.40.205.197:443
59.21.235.119:80
139.99.158.11:443
176.111.60.55:8080
66.57.108.14:443
37.187.72.193:8080
118.83.154.64:443
62.30.7.67:443
168.235.67.138:7080
187.161.206.24:80
173.70.61.180:80
97.120.3.198:80
167.114.153.111:8080
120.150.60.189:80
70.180.33.202:80
70.92.118.112:80
200.116.145.225:443
190.29.166.0:80
5.2.212.254:80
181.171.209.241:443
172.105.13.66:443
119.59.116.21:8080
109.116.245.80:80
87.106.139.101:8080
152.170.205.73:80
50.245.107.73:443
144.217.7.207:7080
51.89.36.180:443
104.131.11.150:443
85.105.111.166:80
203.153.216.189:7080
95.213.236.64:8080
190.240.194.77:443
123.176.25.234:80
139.59.60.244:8080
62.75.141.82:80
24.164.79.147:8080
194.190.67.75:80
220.245.198.194:80
98.109.133.80:80
72.186.136.247:443
201.241.127.190:80
41.185.28.84:8080
62.171.142.179:8080
120.150.218.241:443
5.39.91.110:7080
64.207.182.168:8080
121.124.124.40:7080
37.139.21.175:8080
172.104.97.173:8080
93.146.48.84:80
142.112.10.95:20
178.152.87.96:80
78.24.219.147:8080
100.37.240.62:80
197.211.245.21:80
181.165.68.127:80
174.118.202.24:443
110.145.11.73:80
24.231.88.85:80
202.134.4.211:8080
110.145.101.66:443
188.165.214.98:8080
89.216.122.92:80
74.58.215.226:80
157.245.99.39:8080
161.0.153.60:80
70.183.211.3:80
78.188.225.105:80
24.178.90.49:80
49.205.182.134:80
94.23.237.171:443
67.170.250.203:443
79.137.83.50:443
202.134.4.216:8080
194.4.58.192:7080
75.177.207.146:80
209.141.54.221:7080
188.219.31.12:80
95.9.5.93:80
74.208.45.104:8080
217.20.166.178:7080
2.58.16.89:8080
24.69.65.8:8080
47.144.21.37:80
50.91.114.38:80
134.209.144.106:443
202.141.243.254:443
74.128.121.17:80
78.189.148.42:80
115.94.207.99:443
110.145.77.103:80
172.86.188.251:8080
139.162.60.124:8080
190.162.215.233:80
75.109.111.18:80
157.245.123.197:8080
50.116.111.59:8080
173.249.20.233:443
136.244.110.184:8080
84.232.252.202:443
138.68.87.218:443
172.125.40.123:80
109.74.5.95:8080
61.19.246.238:443
24.179.13.119:80
46.105.131.79:8080
185.201.9.197:8080
185.94.252.104:443
74.40.205.197:443
59.21.235.119:80
139.99.158.11:443
176.111.60.55:8080
66.57.108.14:443
37.187.72.193:8080
118.83.154.64:443
62.30.7.67:443
168.235.67.138:7080
187.161.206.24:80
173.70.61.180:80
97.120.3.198:80
167.114.153.111:8080
120.150.60.189:80
70.180.33.202:80
70.92.118.112:80
200.116.145.225:443
190.29.166.0:80
5.2.212.254:80
181.171.209.241:443
172.105.13.66:443
119.59.116.21:8080
109.116.245.80:80
87.106.139.101:8080
152.170.205.73:80
50.245.107.73:443
144.217.7.207:7080
51.89.36.180:443
104.131.11.150:443
85.105.111.166:80
203.153.216.189:7080
95.213.236.64:8080
190.240.194.77:443
123.176.25.234:80
139.59.60.244:8080
62.75.141.82:80
24.164.79.147:8080
194.190.67.75:80
220.245.198.194:80
98.109.133.80:80
72.186.136.247:443
201.241.127.190:80
41.185.28.84:8080
62.171.142.179:8080
120.150.218.241:443
5.39.91.110:7080
64.207.182.168:8080
121.124.124.40:7080
37.139.21.175:8080
172.104.97.173:8080
93.146.48.84:80
142.112.10.95:20
178.152.87.96:80
78.24.219.147:8080
100.37.240.62:80
197.211.245.21:80
181.165.68.127:80
174.118.202.24:443
110.145.11.73:80
24.231.88.85:80
202.134.4.211:8080
110.145.101.66:443
188.165.214.98:8080
89.216.122.92:80
74.58.215.226:80
157.245.99.39:8080
161.0.153.60:80
70.183.211.3:80
78.188.225.105:80
24.178.90.49:80
49.205.182.134:80
94.23.237.171:443
67.170.250.203:443
79.137.83.50:443
202.134.4.216:8080
194.4.58.192:7080
75.177.207.146:80
209.141.54.221:7080
188.219.31.12:80
95.9.5.93:80
74.208.45.104:8080
217.20.166.178:7080
2.58.16.89:8080
24.69.65.8:8080
47.144.21.37:80
50.91.114.38:80
134.209.144.106:443
202.141.243.254:443
74.128.121.17:80
78.189.148.42:80
115.94.207.99:443
110.145.77.103:80
172.86.188.251:8080
139.162.60.124:8080
190.162.215.233:80
Unpacked files
SH256 hash:
16c745e0f13325f3f50a634c4fe09bb116db8db7cf3743a5bc188dbf7b83ebe3
MD5 hash:
6a57ba17874080e20baf2a85113abe8c
SHA1 hash:
c6da8073fd03d1ee425c7ac9d183d59c13ea1c53
Detections:
win_emotet_a2
Parent samples :
06c2d4058199bb267a6cb18a13681fe8012cda796b6c186768dbfbb90460dff0
94dce0d17d1d5e602db1026a9b6361e4273d2b0822373f5ab03093f2d2e15a6c
f80e2f33de463812a9650722e56c1a9bf2feb8b51fbb4f16e6e1bc28ed4fb0e5
439a8c98ec6a37763246ea1bbd05000fbc0a7cf6dcbdd47d99ddf9f1f41c8033
26ef59fa5b5ce80b5061d76a7daa2ad0248de0b616c79e67f74e2a3bf1b3b580
726f476dabeec41ce0f8ff673159dbfe2305acb1b1d6eec17eb5682f99477619
1c180a90b2c96fd3bf14f50eec02a3f944c2fdda41eecdc2ef58b943d358fb27
aa3f7bd93d496c890d87e4f96392c01369dbf70005acc4b34a97d51ad8caf390
3b603999fb54e4b0c85a54543668651953a19bdd598c5c1a3606e520e8e1f5e5
d11199f93ff6caf63f16767c91fedac1aa551620cf6ae6d2c2855c6db36a0699
e7084709e42e8bf7f4c8c21be2f95d012dcc58731a4a009f0cc9f0e46e7800f1
9eadcfb4403d5593865e2d86c472775ceb9ceeca27103fc049e39934903300da
0e6141177f9e856d239a5981a2c16b03d97f468f7c0d8a0ded019b41fbcb0e2c
7848182153398099f60aa09cafe43a09255c43118e8425eed40213bed1c63cab
cd0935a278605d0e3eb4232f80bfe1d33d96f6cb8c1f869a157a14794a72d8de
7f6c588abec8a9f10d6d6a8e6a9f7511aeee7685560bba8cd3962e2b6ac9a868
1ca7e09455ba02e0768483ce82b1372172139968fe47de419a1c02722578b9fd
f2e0c88b889e855da43bf872ace95cc18b17e6c938c1c0b4d972ea7783be4fce
9e68619bd36663a2bcd0f3a04e46721f0624db6cc900aac0fd29368562ed14d0
7e9551a80a62c6e7c579bc61d2fe5d95ca37e149a4dbd84b29bd23cff8865f58
e10fd14f6a31fc9babe775e9754ada80624bc681addba90bc746e8a9cb9f4c1d
a9e326776fc960e896a547e48b52eed0b1d671f608a4f6f8b5cb0b95642a27c4
835e59b885279c57f1547b5cd7c7bf8a3938952e907b290d6ee634b9336bc0e8
7a96c24aabf3e2426942dfc60d8f0ebc944da5bd5ad64e85245297345eedd630
148890d6d49306621c069382ff58606e2b747873ab9a2863305652bd31027121
00b0d164a921b8b6e6d3780dd315d35b5840eaf1ec25bbecdfbb220aab499aae
4dd73e36f9cc94d40a92893cb6aef4895242af98ef8283abb21354b2c4add341
770b6b14d631f153ec40553338f909919a8825f798d1f752b8cea9eddabb6a62
bbdf819150aa24638250d793e4b38c19dca3aeada1131d75c1edc85e90d43014
7c356cc6df3eb52f2c018d2db81b774fb9784604b4ea44edf65ce53d8ddb5936
37d92ad47c34ab7ce5eb44dfe07f487a0aa6fa7966d3a8442fe8a5dc375e7547
4627ff1c1e2adc4d7899a150d64826cc774171d154048306510784ff73a18dfe
894c5421ba1656c168373642249a75fb7a884c6b0a573d4dd3eea1dbefed42a3
93365859652ff735a27c00ca455985928f67b110bd9f0dd30e1a61c67339234b
c1727b1cb784736817e2956e1062253ac2edc1c18efc756729cb45be3e79f268
307628758d1f5a228c781e7f72306fa303d61793be18b74655822c394667cc06
d11f63eb8ecf6e5bcaee11a6aa2e994352564ec6688478854a5c0b4377323929
9822b86fd8435fbe11c899860cc411fa9aabc9841e4d24f4da66175146a66772
74ce1adbc14de4b7da2fe39ee0fc847c27ff03b7193376789547d635216eee90
95110e9d79d248ab1472abb6da12cf46b94fbbf8991bdb1ae4d080718bf1225f
5f0cd7dbe97e1238a94eea5a3c42935b522d25fb3f9d993eacfdb32060f769df
f0b937db7ff5ae75c5102fcacee22c616fff04455b2933d83c1172108ee39dbd
98656b84a18f6a1341c680c9317fe4f4be2830e263297b92320a0048494fbe54
9b7f7e1841ce75b2328480f986d177428afce4890fbef70decb0890a5f321511
0ad2ac8f68fa6334cdd49e90b58a1f94ced5397fd34eb64e31037747938f31f5
916c46cbccd5cac10369de3bb07413040981932714d2584ae7653d9e1fb63cf6
562db493a61cbcc1d1854c8946a3d2efc6095d8c2c93c683a0bcac5f63782052
197db9e65c9e6aec3d6190c6b87869a0fd169ac7c57cbea0db6767cd1e637d41
8203e50739851c519b1c0a632a19dc0d9b904b42d497c651ee666f88d17c6f86
4a112aa04b07078f4353c25037c975ea906d1fc70e30100c4b3eddcce31609ea
6a37fde77b6cc289b6f2315c9a3f38177a00bdb71cacb4ee30dd26a139f2c153
c451d8669242db07bca0b4341da03735e69e7819768e0d7d7bb706449489938c
3cb57714ee1586c161b9117d1821225818bf5d967aabfb24a00bcf294c0ca4d6
28918f781cc6edbb063cf01e75452fb5b8e9d379bd17c2c374d423debabaa15a
2612ec7cb9d29bacd427d25614492b756dab1507ba310c2323265e88ad1cf22e
4d3fa19f1e0a0e75119b6b63979e89cd244dae46ec1ac931cfce907b73991e7d
64ad611edf01fded7b92c03c6955a22b04b7256bb14b6ea35a27c4d575741340
8a290457ba9a4eb3c8192d598cd88eaae7e75090d3fcd0b15a1923a3dc055574
eaab2a1ead65090c7f0f9401d57730f47a5526324a4d8b19f926149d7f38ded4
f297cc1703f6688575d6a19701b4174304cf02b08d2bfc8d156d619c3c1b4b0c
f5d35f15a3c6e803d2095182de0bbc2a0f456fead5912bf597486bcf1cb225c8
caa9e9ecf4516f06b822588a7e70f6bc71e35208f210af25059a313c6ca6c71d
da161c005004669a070d2576bb58af390552091effac72a30637cd8b4708a851
163b35ee96495178b44032b0f6988b70b427fd5d8659f2c76f272f7c1cb4076e
916949a450f6f928f6ea5d5e64064a2f2a9af3840d6ce1cf68302fbbfc759ff1
32568da80e685a2356628b81d6f7e13e906ffb3a74d1106f0acb3e1a0ae4fcff
8dfb73f15eb8cbcb2cd69a7c8b71fa891084d29beec50a9cdeb811de33fee69e
17e7551f5115f2c859e9e0f00313e8f7214b6d84b8ee4ec66ee38747e7803904
c0a1d803530d1323ebe96446b1e38a84f40339b7fb42a526c18646ee758e93f1
b6535e7c75eb861687d1641c63420837919b2ab5321909e5f8a5d9acd978866a
5ff6371344cbb9cd9d336212e5f7e97677aaa728aec4cca28d41d2d4b21cce76
96588eabb507e6b8c41137c9c798dfa9421c062153a4cccfda70b993e4793de1
340e387bab434f0f34a58f57894ab92d87595af20dca012f36b84344ebe55def
e680feb6ae3a2925a9a04779e09966b1bfaa2d96533ec5863cf7fbf422fe48d6
d2f5f91c516b4bc9454e2e9e253ab08ac8a72840f6000633016d445a5ec4e99c
94dce0d17d1d5e602db1026a9b6361e4273d2b0822373f5ab03093f2d2e15a6c
f80e2f33de463812a9650722e56c1a9bf2feb8b51fbb4f16e6e1bc28ed4fb0e5
439a8c98ec6a37763246ea1bbd05000fbc0a7cf6dcbdd47d99ddf9f1f41c8033
26ef59fa5b5ce80b5061d76a7daa2ad0248de0b616c79e67f74e2a3bf1b3b580
726f476dabeec41ce0f8ff673159dbfe2305acb1b1d6eec17eb5682f99477619
1c180a90b2c96fd3bf14f50eec02a3f944c2fdda41eecdc2ef58b943d358fb27
aa3f7bd93d496c890d87e4f96392c01369dbf70005acc4b34a97d51ad8caf390
3b603999fb54e4b0c85a54543668651953a19bdd598c5c1a3606e520e8e1f5e5
d11199f93ff6caf63f16767c91fedac1aa551620cf6ae6d2c2855c6db36a0699
e7084709e42e8bf7f4c8c21be2f95d012dcc58731a4a009f0cc9f0e46e7800f1
9eadcfb4403d5593865e2d86c472775ceb9ceeca27103fc049e39934903300da
0e6141177f9e856d239a5981a2c16b03d97f468f7c0d8a0ded019b41fbcb0e2c
7848182153398099f60aa09cafe43a09255c43118e8425eed40213bed1c63cab
cd0935a278605d0e3eb4232f80bfe1d33d96f6cb8c1f869a157a14794a72d8de
7f6c588abec8a9f10d6d6a8e6a9f7511aeee7685560bba8cd3962e2b6ac9a868
1ca7e09455ba02e0768483ce82b1372172139968fe47de419a1c02722578b9fd
f2e0c88b889e855da43bf872ace95cc18b17e6c938c1c0b4d972ea7783be4fce
9e68619bd36663a2bcd0f3a04e46721f0624db6cc900aac0fd29368562ed14d0
7e9551a80a62c6e7c579bc61d2fe5d95ca37e149a4dbd84b29bd23cff8865f58
e10fd14f6a31fc9babe775e9754ada80624bc681addba90bc746e8a9cb9f4c1d
a9e326776fc960e896a547e48b52eed0b1d671f608a4f6f8b5cb0b95642a27c4
835e59b885279c57f1547b5cd7c7bf8a3938952e907b290d6ee634b9336bc0e8
7a96c24aabf3e2426942dfc60d8f0ebc944da5bd5ad64e85245297345eedd630
148890d6d49306621c069382ff58606e2b747873ab9a2863305652bd31027121
00b0d164a921b8b6e6d3780dd315d35b5840eaf1ec25bbecdfbb220aab499aae
4dd73e36f9cc94d40a92893cb6aef4895242af98ef8283abb21354b2c4add341
770b6b14d631f153ec40553338f909919a8825f798d1f752b8cea9eddabb6a62
bbdf819150aa24638250d793e4b38c19dca3aeada1131d75c1edc85e90d43014
7c356cc6df3eb52f2c018d2db81b774fb9784604b4ea44edf65ce53d8ddb5936
37d92ad47c34ab7ce5eb44dfe07f487a0aa6fa7966d3a8442fe8a5dc375e7547
4627ff1c1e2adc4d7899a150d64826cc774171d154048306510784ff73a18dfe
894c5421ba1656c168373642249a75fb7a884c6b0a573d4dd3eea1dbefed42a3
93365859652ff735a27c00ca455985928f67b110bd9f0dd30e1a61c67339234b
c1727b1cb784736817e2956e1062253ac2edc1c18efc756729cb45be3e79f268
307628758d1f5a228c781e7f72306fa303d61793be18b74655822c394667cc06
d11f63eb8ecf6e5bcaee11a6aa2e994352564ec6688478854a5c0b4377323929
9822b86fd8435fbe11c899860cc411fa9aabc9841e4d24f4da66175146a66772
74ce1adbc14de4b7da2fe39ee0fc847c27ff03b7193376789547d635216eee90
95110e9d79d248ab1472abb6da12cf46b94fbbf8991bdb1ae4d080718bf1225f
5f0cd7dbe97e1238a94eea5a3c42935b522d25fb3f9d993eacfdb32060f769df
f0b937db7ff5ae75c5102fcacee22c616fff04455b2933d83c1172108ee39dbd
98656b84a18f6a1341c680c9317fe4f4be2830e263297b92320a0048494fbe54
9b7f7e1841ce75b2328480f986d177428afce4890fbef70decb0890a5f321511
0ad2ac8f68fa6334cdd49e90b58a1f94ced5397fd34eb64e31037747938f31f5
916c46cbccd5cac10369de3bb07413040981932714d2584ae7653d9e1fb63cf6
562db493a61cbcc1d1854c8946a3d2efc6095d8c2c93c683a0bcac5f63782052
197db9e65c9e6aec3d6190c6b87869a0fd169ac7c57cbea0db6767cd1e637d41
8203e50739851c519b1c0a632a19dc0d9b904b42d497c651ee666f88d17c6f86
4a112aa04b07078f4353c25037c975ea906d1fc70e30100c4b3eddcce31609ea
6a37fde77b6cc289b6f2315c9a3f38177a00bdb71cacb4ee30dd26a139f2c153
c451d8669242db07bca0b4341da03735e69e7819768e0d7d7bb706449489938c
3cb57714ee1586c161b9117d1821225818bf5d967aabfb24a00bcf294c0ca4d6
28918f781cc6edbb063cf01e75452fb5b8e9d379bd17c2c374d423debabaa15a
2612ec7cb9d29bacd427d25614492b756dab1507ba310c2323265e88ad1cf22e
4d3fa19f1e0a0e75119b6b63979e89cd244dae46ec1ac931cfce907b73991e7d
64ad611edf01fded7b92c03c6955a22b04b7256bb14b6ea35a27c4d575741340
8a290457ba9a4eb3c8192d598cd88eaae7e75090d3fcd0b15a1923a3dc055574
eaab2a1ead65090c7f0f9401d57730f47a5526324a4d8b19f926149d7f38ded4
f297cc1703f6688575d6a19701b4174304cf02b08d2bfc8d156d619c3c1b4b0c
f5d35f15a3c6e803d2095182de0bbc2a0f456fead5912bf597486bcf1cb225c8
caa9e9ecf4516f06b822588a7e70f6bc71e35208f210af25059a313c6ca6c71d
da161c005004669a070d2576bb58af390552091effac72a30637cd8b4708a851
163b35ee96495178b44032b0f6988b70b427fd5d8659f2c76f272f7c1cb4076e
916949a450f6f928f6ea5d5e64064a2f2a9af3840d6ce1cf68302fbbfc759ff1
32568da80e685a2356628b81d6f7e13e906ffb3a74d1106f0acb3e1a0ae4fcff
8dfb73f15eb8cbcb2cd69a7c8b71fa891084d29beec50a9cdeb811de33fee69e
17e7551f5115f2c859e9e0f00313e8f7214b6d84b8ee4ec66ee38747e7803904
c0a1d803530d1323ebe96446b1e38a84f40339b7fb42a526c18646ee758e93f1
b6535e7c75eb861687d1641c63420837919b2ab5321909e5f8a5d9acd978866a
5ff6371344cbb9cd9d336212e5f7e97677aaa728aec4cca28d41d2d4b21cce76
96588eabb507e6b8c41137c9c798dfa9421c062153a4cccfda70b993e4793de1
340e387bab434f0f34a58f57894ab92d87595af20dca012f36b84344ebe55def
e680feb6ae3a2925a9a04779e09966b1bfaa2d96533ec5863cf7fbf422fe48d6
d2f5f91c516b4bc9454e2e9e253ab08ac8a72840f6000633016d445a5ec4e99c
SH256 hash:
7a96c24aabf3e2426942dfc60d8f0ebc944da5bd5ad64e85245297345eedd630
MD5 hash:
ae26b022515fde4823238e28a47c242f
SHA1 hash:
f73db7a02813d3e93c7a87fae18084079f86e201
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.