Overview

overview

10

Static

static

10

0ce8e2125c...fa.exe

windows7-x64

10

0ce8e2125c...fa.exe

windows10-2004-x64

10

0d08fd5994...a1.exe

windows7-x64

10

0d08fd5994...a1.exe

windows10-2004-x64

10

0d39a7ade0...a9.exe

windows7-x64

10

0d39a7ade0...a9.exe

windows10-2004-x64

10

0d7cbc8822...d3.exe

windows7-x64

10

0d7cbc8822...d3.exe

windows10-2004-x64

10

0da351d641...30.exe

windows7-x64

10

0da351d641...30.exe

windows10-2004-x64

10

0dcb9d68dd...81.exe

windows7-x64

10

0dcb9d68dd...81.exe

windows10-2004-x64

10

0de35a9720...08.exe

windows7-x64

3

0de35a9720...08.exe

windows10-2004-x64

3

0df2367bf9...81.exe

windows7-x64

10

0df2367bf9...81.exe

windows10-2004-x64

7

0df7144ed5...52.exe

windows7-x64

10

0df7144ed5...52.exe

windows10-2004-x64

10

0df97b99ca...e3.exe

windows7-x64

1

0df97b99ca...e3.exe

windows10-2004-x64

4

0e48a47f40...30.exe

windows7-x64

10

0e48a47f40...30.exe

windows10-2004-x64

10

0e820aad5e...54.exe

windows7-x64

10

0e820aad5e...54.exe

windows10-2004-x64

10

0ea0e36c70...d3.exe

windows7-x64

10

0ea0e36c70...d3.exe

windows10-2004-x64

10

0eb27c6385...3a.exe

windows7-x64

10

0eb27c6385...3a.exe

windows10-2004-x64

10

0ee8580c3e...ef.exe

windows7-x64

10

0ee8580c3e...ef.exe

windows10-2004-x64

10

0eed307263...f5.exe

windows7-x64

10

0eed307263...f5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    archive_4.zip
  • Size 47.5MB
  • Sample250322-ha9ddatlt5
  • SHA256 000996e02592d6f5216a77464baff2591739b5cb35a8ad930a5424c9099c7e11
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratnanocorenjratredlinevulturixwormhackedhttps://uloz.to/limereallogcollectioncredential_accessdefense_evasiondiscoveryexecutioninfostealerkeyloggerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

  • xworm

C2

  • 127.0.0.1:2408

  • front-recommend.gl.at.ply.gg:2408

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

Extracted

Family

  • vulturi

C2

  • http://78.70.235.238:5050:5050/gate

Attributes
  • c2_encryption_key

    RW0cRe5Zs02XCURF84ns2Q

  • c2_user

    root

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • https://uloz.to/

C2

  • kamel-hacker.no-ip.biz:1188

Mutex

  • 07f06f409b0231ba4f84af2f218145fb

Attributes
  • reg_key

    07f06f409b0231ba4f84af2f218145fb

  • splitter

    |'|'|

Extracted

Family

  • njrat

Version

  • 0.7.3

Botnet

  • Lime

C2

  • 167.71.56.116:22364

Mutex

  • Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    1234

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • blog-inter.gl.at.ply.gg:35572

Mutex

  • e5Fz01U2wnLTm6Jz

Attributes
  • Install_directory

    %AppData%

  • install_file

    Microsoft.exe

  • telegram

    https://api.telegram.org/bot7818532225:AAE5zgOMxoOeN0vIwutFPXEo3TEyYEyqB5k/sendMessage?chat_id=5147096551

aes.plain

Extracted

Family

  • xworm

Version

  • 3.0

C2

  • rndik-156-193-90-159.a.free.pinggy.link:36647

Mutex

  • XjOZyJuVeu5SB3cb

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

  • njrat

Version

  • im523

Botnet

  • HacKed

C2

  • match-monte.gl.at.ply.gg:5816

Mutex

  • 09b7fb4586b6a7f342b9f8da2c44b4b6

Attributes
  • reg_key

    09b7fb4586b6a7f342b9f8da2c44b4b6

  • splitter

    |'|'|

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2
Mutex

  • 4af74541-e3f1-469c-8af7-efe4071b81cf

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    178.32.224.116

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2018-07-28T12:59:38.488799236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    46218

  • default_group

    tourex

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4af74541-e3f1-469c-8af7-efe4071b81cf

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    [email protected]

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • redline

Botnet

  • REALLOG

C2

  • 196.251.92.11:1912

Extracted

Credentials
  • Protocol

    smtp
  • Host

    smtp.yandex.com
  • Port

    587
  • Username

    [email protected]
  • Password

    Boy12345#

Targets

    • Target
      0ce8e2125cf9b2549eeb18b14754aa2158878fc9eabcde0f54d75556492048fa.exe
    • Size 17.6MB
    • SHA256 0ce8e2125cf9b2549eeb18b14754aa2158878fc9eabcde0f54d75556492048fa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistenceprivilege_escalationspywarestealercredential_access

    • Modifies WinLogon for persistence

      persistence

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2
    • Target
      0d08fd5994f0570ef78ba20f575849b2e9c9eb01aeb29c0cd7b5c534552870a1.exe
    • Size 1.6MB
    • SHA256 0d08fd5994f0570ef78ba20f575849b2e9c9eb01aeb29c0cd7b5c534552870a1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dcratexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral3behavioral4
    • Target
      0d39a7ade0eaa19a185fc11508caeba9.exe
    • Size 920KB
    • SHA256 51c94ec08bddcec2e7992bb2c758e8518850b373e649ac57c9c26067715bd2ea
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dcratinfostealerpersistencerat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral5behavioral6
    • Target
      0d7cbc882298f639d31191a03ec81bd3.exe
    • Size 1.9MB
    • SHA256 56d64aaeab87dad048e08ea98237bcc727bbab88d97cc126e328ea1adf7fc913
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasionexecutiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      defense_evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops file in System32 directory

    behavioral7behavioral8
    • Target
      0da351d641066e6d8ebb95e8bcb6e030.exe
    • Size 418KB
    • SHA256 2b1b2abc07dc18921243eb6b26be170807db655803a4dfab4b4ec97d12e43d16
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Nanocore family

      nanocore

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral10behavioral9
    • Target
      0dcb9d68dd68eefabbec3c03cc3e8381.exe
    • Size 73KB
    • SHA256 537f638fa423a635cb9777e9a20b37c0757695a83c6307c1b482c0d8c932d9e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xwormexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral11behavioral12
    • Target
      0de35a97204bf9ccbe98450bbae38fe0e7c92d608328b2e600bf5484b0a3b908.exe
    • Size 3.1MB
    • SHA256 0de35a97204bf9ccbe98450bbae38fe0e7c92d608328b2e600bf5484b0a3b908
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      0df2367bf99523e1510e59310538d736cd3b125dcf0d76a09644fe7c65402f81.exe
    • Size 418KB
    • SHA256 0df2367bf99523e1510e59310538d736cd3b125dcf0d76a09644fe7c65402f81
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Nanocore family

      nanocore

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral15behavioral16
    • Target
      0df7144ed5104422c08fe0b6de1e2452.exe
    • Size 919KB
    • SHA256 cf2142b71c02cebf4aca8910971c84f52b7692fdc6c7bdccebf8c93f6c9aca1c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redlinereallogdiscoveryexecutioninfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral17behavioral18
    • Target
      0df97b99ca90dd92e313196ed212ed8bb7931ed5ff381a3dbce0e0479f820ae3.exe
    • Size 32KB
    • SHA256 0df97b99ca90dd92e313196ed212ed8bb7931ed5ff381a3dbce0e0479f820ae3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral19behavioral20
    • Target
      0e48a47f400685a0d5ded8ad220d8f30.exe
    • Size 5.9MB
    • SHA256 8ef226d36414c628f71bebb9a7724dbbe58ed58d280a35a32f4550593baf8c2a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dcratdefense_evasionexecutioninfostealerrattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      defense_evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral21behavioral22
    • Target
      0e820aad5e8af67e2f996c9261b1b8c500e26eab8fd99d9ec67dfecceb43aa54.exe
    • Size 291KB
    • SHA256 0e820aad5e8af67e2f996c9261b1b8c500e26eab8fd99d9ec67dfecceb43aa54
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    vulturistealer

    • Vulturi

      An info stealer written in C# and first seen in January 2021.

      stealervulturi

    • Vulturi family

      vulturi

    • Vulturi payload

    behavioral23behavioral24
    • Target
      0ea0e36c7047f7b2bf48101f2d9f62467b4bbf3749386f53ed607061ad0f0ed3.exe
    • Size 2.0MB
    • SHA256 0ea0e36c7047f7b2bf48101f2d9f62467b4bbf3749386f53ed607061ad0f0ed3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat
    behavioral25behavioral26
    • Target
      0eb27c638574f831cab876ce13b9043a.exe
    • Size 23KB
    • SHA256 209439e5a5d515be5ca3f5c578103301e52f08e7357fe0a882dbb725c75903b5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njrathttps://uloz.to/defense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral27behavioral28
    • Target
      0ee8580c3e8ccbefcf4d8b060189dd2dadfdb559b420c4a732270d7303fae6ef.exe
    • Size 1.6MB
    • SHA256 0ee8580c3e8ccbefcf4d8b060189dd2dadfdb559b420c4a732270d7303fae6ef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    dcratexecutioninfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral29behavioral30
    • Target
      0eed30726330520f68b4bec97e71989bc143e8755d0b918d2add30a15ce848f5.exe
    • Size 1019KB
    • SHA256 0eed30726330520f68b4bec97e71989bc143e8755d0b918d2add30a15ce848f5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    collectioncredential_accessdiscoverypersistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

AppInit DLLs

1
T1546.010

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

AppInit DLLs

1
T1546.010

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

6
T1552

Credentials In Files

5
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Browser Information Discovery

1
T1217

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

5
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks

static1

rathttps://uloz.to/limehackeddcratxwormvulturinjrat
Score
10/10

behavioral1

discoverypersistenceprivilege_escalationspywarestealer
Score
10/10

behavioral2

credential_accessdiscoverypersistenceprivilege_escalationspywarestealer
Score
10/10

behavioral3

dcratexecutioninfostealerrat
Score
10/10

behavioral4

dcratexecutioninfostealerrat
Score
10/10

behavioral5

dcratinfostealerpersistencerat
Score
10/10

behavioral6

dcratinfostealerpersistencerat
Score
10/10

behavioral7

defense_evasionexecutiontrojan
Score
10/10

behavioral8

defense_evasionexecutiontrojan
Score
10/10

behavioral9

nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral10

nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral11

xwormexecutionpersistencerattrojan
Score
10/10

behavioral12

xwormexecutionpersistencerattrojan
Score
10/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

nanocoredefense_evasiondiscoverykeyloggerpersistencespywarestealertrojan
Score
10/10

behavioral16

discoverypersistence
Score
7/10

behavioral17

redlinereallogdiscoveryexecutioninfostealerspywarestealer
Score
10/10

behavioral18

redlinereallogdiscoveryexecutioninfostealerspywarestealer
Score
10/10

behavioral19

Score
1/10

behavioral20

discovery
Score
4/10

behavioral21

dcratdefense_evasionexecutioninfostealerrattrojan
Score
10/10

behavioral22

dcratdefense_evasionexecutioninfostealerrattrojan
Score
10/10

behavioral23

vulturistealer
Score
10/10

behavioral24

vulturistealer
Score
10/10

behavioral25

dcratinfostealerrat
Score
10/10

behavioral26

dcratinfostealerrat
Score
10/10

behavioral27

njrathttps://uloz.to/defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
10/10

behavioral28

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
10/10

behavioral29

dcratexecutioninfostealerrat
Score
10/10

behavioral30

dcratexecutioninfostealerrat
Score
10/10

behavioral31

collectioncredential_accessdiscoverypersistencespywarestealer
Score
10/10

behavioral32

collectioncredential_accessdiscoverypersistencespywarestealer
Score
10/10