Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    15-03-2022 14:05

General

  • Target

    520636dbbdc33d8dbdf1b14f043b46f8.exe

  • Size

    252KB

  • MD5

    520636dbbdc33d8dbdf1b14f043b46f8

  • SHA1

    20eec5615c4ecca3603f889bccf975c855fa7a07

  • SHA256

    bd8aa280646a2b601ccbd5cec125d51646624d34005eb7db56da6b70fda821cb

  • SHA512

    fc3869cf9a917b21e16f2f7150dbf78227c4e52a4f73a3b572555f38b2ae51358f32d0af7e08dc944529a1ed931f4cd09c694a92ad6b5680de58c4a2149077b6

Score
10/10

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300994

rsa_pubkey.plain

Signatures

  • Gozi RM3

    A heavily modified version of Gozi using RM3 loader.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2996
      • C:\Users\Admin\AppData\Local\Temp\520636dbbdc33d8dbdf1b14f043b46f8.exe
        "C:\Users\Admin\AppData\Local\Temp\520636dbbdc33d8dbdf1b14f043b46f8.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 624
          3⤵
          • Program crash
          PID:2608
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit" /p C:\Windows\system32 /s /m po*l.e*e
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\system32\forfiles.exe
          forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit" /p C:\Windows\system32 /s /m po*l.e*e
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1596
          • C:\Windows\system32\cmd.exe
            /k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA= & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3624
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBhAGMAYwBvAG4AJwApAC4ATQA=
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1276
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4644
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2752
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yduppq40\yduppq40.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4192
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4FC.tmp" "c:\Users\Admin\AppData\Local\Temp\yduppq40\CSC1C2BCD08D0674F4EBB14B4F82C2728A0.TMP"
                  7⤵
                    PID:4280
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gkonnpn0\gkonnpn0.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3124
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD692.tmp" "c:\Users\Admin\AppData\Local\Temp\gkonnpn0\CSCFBE45FDC2F347C08385E222A1869041.TMP"
                    7⤵
                      PID:3800
        • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
          "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
          1⤵
            PID:4436
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4440
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17410 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3632
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82950 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2752
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82954 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4492
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82958 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4992
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82962 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1928
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17412 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2092
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82968 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2580
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82972 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2720
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82976 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4816
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82980 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4300
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:82984 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:5008
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 444 -ip 444
            1⤵
              PID:1512

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

              MD5

              54e9306f95f32e50ccd58af19753d929

              SHA1

              eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

              SHA256

              45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

              SHA512

              8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

              MD5

              6bc51132df2990f83cad1b18f7095383

              SHA1

              2b684fadcf445317566482e19b2ce050be5d1a45

              SHA256

              d77fc617d7f398c54bd8d11afaeb07315ce12db06bc9ed5a7195fbb6d4c19c39

              SHA512

              d81f094ef9b22925679779af522015684c0953fb433ce6f77202760da22870aa163c33e7274e3284685b2f030de381e80197a9bf697cf966608d701dbe728431

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2psodd8\imagestore.dat

              MD5

              b07c239f418299f3b983557b171e5523

              SHA1

              f13960edf84337c30db5ed9b48a0aaea2ffe1805

              SHA256

              bc0ac00d36dedbf66b153395c9f6830e9a558c5112d2c286119a507323ed7709

              SHA512

              a37aa264a0bbea2a76c7b255baf335451d7188cb4d4a0d45c1cb725ca19cb6dd49cce18cf654eb55b3e32e79d1b0db7ea75636640dddf93ceb522975c02af6e6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\558DW1ID\favicon[1].ico

              MD5

              a976d227e5d1dcf62f5f7e623211dd1b

              SHA1

              a2a9dc1abdd3d888484678663928cb024c359ee6

              SHA256

              66332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271

              SHA512

              6754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              MD5

              feadc4e1a70c13480ef147aca0c47bc0

              SHA1

              d7a5084c93842a290b24dacec0cd3904c2266819

              SHA256

              5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac

              SHA512

              c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              MD5

              9856eec246073417aba7c4e517d16d0b

              SHA1

              ce495a8b86044e11eaf50cc89a92116cc9b13724

              SHA256

              0ed72f3f9a4847fc67fe0d6dc44d1773b8a652aaaf84352440b44da59a66d7f8

              SHA512

              8227671cae6eb7e5d2f77e82656c9099efb0e59b9478a7884216e83bc2be8c11ae2cbdea1c9137da263825c3a8357321fc5c931841020596cdd82ca42489f16e

            • C:\Users\Admin\AppData\Local\Temp\RESD4FC.tmp

              MD5

              18d385382c9cef05ab2fb59ef2179f38

              SHA1

              34a8a72dac898afcccec131c6485c0b664a65bf9

              SHA256

              552e55b48034a4d0372ab19987b01324fe8de4abc48df19f28189912dbb78b1e

              SHA512

              af68a99b9f31c3339c53a03288c3501ab4f540673572e3fd62ba4f0023fc9c1d8b0c7272acd3c2ec17368cf7748f2aef95203f93f4cefa04c1e4153f6ab917b7

            • C:\Users\Admin\AppData\Local\Temp\RESD692.tmp

              MD5

              98090b034d332c533789e4435166c7d3

              SHA1

              19af81eccc15398b6f3825763d8c38b27a76ff31

              SHA256

              d4f30f15368d279f471981b8c03ba05d185a4414241b22e9496e86360a56fde4

              SHA512

              b8d7d8456530b94f9aa4d48fd582755afd2e24be7156d4a8a318ade843d9f5cc82dada745c3ccf97cf444f1cb78b0c4a4f06109c1bc719fd3e293ef25cf9a644

            • C:\Users\Admin\AppData\Local\Temp\gkonnpn0\gkonnpn0.dll

              MD5

              08639db717fd568cbbf83b8951853e0a

              SHA1

              759dfe3cbefcec767c301fa33af3fd1b3c1ba5d4

              SHA256

              5ae518ed2a7f968060731bc62e8893ba69756dfc9f489f99485e6b08e3e29f23

              SHA512

              741724a30ba70ad65eeed822a4d40d634b33e15072a2ce6ab8dbcac2863b310f231a1f5bb817af83c10b6442790cecba13c760098792e4c1a2fb8091026eba60

            • C:\Users\Admin\AppData\Local\Temp\yduppq40\yduppq40.dll

              MD5

              c7e0ce7c250bc52d8ed97a410cfa8ab4

              SHA1

              1282eba2b5e561dc1b26ba24fa7ce8b744edfea9

              SHA256

              339b677126b8d37d50f246811595f9915f1f6588618f4cba03265eeb245b4834

              SHA512

              c18e1536068463ce6ce8edc5804f1b653f9adfb3b8e7382fa86814891abb09c84eb7051d4c13c4b06a1623747cbdf3aa3ecb284eecc199d38c173bb82390467d

            • \??\c:\Users\Admin\AppData\Local\Temp\gkonnpn0\CSCFBE45FDC2F347C08385E222A1869041.TMP

              MD5

              0829765fc0fea14feccd7f9aee983897

              SHA1

              5a35f111e627591248ce26d1e15ecacf57465f1b

              SHA256

              5136e1c6b8a9c1e866fc944d35db273608866cb042179087b92779c0498b0bfd

              SHA512

              d7e9633e68ac5d16ac2b666f360ae6be5ace4f6a1bb7d67a6668ef113342cc2acb8aab3ce910b6e798e0a2a72828ba783a675b1597217b1125b631549b1099e9

            • \??\c:\Users\Admin\AppData\Local\Temp\gkonnpn0\gkonnpn0.0.cs

              MD5

              697f16b8c6892082559d8a17db343865

              SHA1

              246d6ba1419478be7915e78b61525da894321fb9

              SHA256

              518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f

              SHA512

              801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6

            • \??\c:\Users\Admin\AppData\Local\Temp\gkonnpn0\gkonnpn0.cmdline

              MD5

              108e007a6ad4048d2b446eff65bd71e8

              SHA1

              ecc2f4d2491aae9d083b9e69bc77fbed5249c007

              SHA256

              adeaf88bb60f5dc7d3a24e0a78b2f7398e5c2e7834a7c1e476add0fc12bdbba8

              SHA512

              49671fbc673d147f0c76cca350207db8b0bf0a0d8ba2fa966a8c9614d808417db298df163ce6bc51d03d1c94d4b95c7a0e30a8f91c23bccf5a3e41c5ae9899e1

            • \??\c:\Users\Admin\AppData\Local\Temp\yduppq40\CSC1C2BCD08D0674F4EBB14B4F82C2728A0.TMP

              MD5

              a71a02ee123c1527fbf22cf4d5f4bbcd

              SHA1

              d06066ba2b5b2e4fab8b2525256101107bbea75d

              SHA256

              da37e4a2f0448cc7b1d5838c84de8d9d8c97ce30ae78a8563b3cbb512d40a4e2

              SHA512

              0316e4f51b4b2fb663a6457f0fc5510401738a3a82588f732cb41bff497371b82200d9a3a6ced1b3fce1976b09a5ffe51e2ccd792a6f04df4f284d6d3a936ab1

            • \??\c:\Users\Admin\AppData\Local\Temp\yduppq40\yduppq40.0.cs

              MD5

              7fceb996f934e8bda687cdd2bd46a9a7

              SHA1

              81e1edbcca6438daaccc3845fa0e3b1a6cff17a6

              SHA256

              fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e

              SHA512

              6aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205

            • \??\c:\Users\Admin\AppData\Local\Temp\yduppq40\yduppq40.cmdline

              MD5

              d9b84d1bedd2ddccb9eff29469b5ca23

              SHA1

              4a008025e90fdb0b71a4bfdb2244f78521f9616f

              SHA256

              ca5719fd89f44f57a5d84fcb69c6187f8246826dafe9b424bfa668616df04d68

              SHA512

              a85673dc719f1a40a682bf20bbc28d897fba1789e6a7c9442cd67c2389285ae000b4e9d435cc8a8483fe4e3185b366c97e4d45f384a3bdd2868ab328c02a6c04

            • memory/444-136-0x0000000000590000-0x000000000059C000-memory.dmp

              Filesize

              48KB

            • memory/444-138-0x00000000005A0000-0x00000000005B0000-memory.dmp

              Filesize

              64KB

            • memory/444-135-0x00000000005CE000-0x00000000005DA000-memory.dmp

              Filesize

              48KB

            • memory/444-170-0x00000000001C0000-0x00000000001CE000-memory.dmp

              Filesize

              56KB

            • memory/444-137-0x0000000001000000-0x000000000106F000-memory.dmp

              Filesize

              444KB

            • memory/444-134-0x00000000005CE000-0x00000000005DA000-memory.dmp

              Filesize

              48KB

            • memory/1276-169-0x00000244F8EB0000-0x00000244F8EC3000-memory.dmp

              Filesize

              76KB

            • memory/1276-153-0x00000244F8F26000-0x00000244F8F28000-memory.dmp

              Filesize

              8KB

            • memory/1276-152-0x00000244F8F23000-0x00000244F8F25000-memory.dmp

              Filesize

              8KB

            • memory/1276-149-0x00007FFDF9760000-0x00007FFDFA221000-memory.dmp

              Filesize

              10.8MB

            • memory/1276-151-0x00000244F8F20000-0x00000244F8F22000-memory.dmp

              Filesize

              8KB

            • memory/1276-148-0x00000244DF5E0000-0x00000244DF602000-memory.dmp

              Filesize

              136KB

            • memory/2752-155-0x00007FFDF9760000-0x00007FFDFA221000-memory.dmp

              Filesize

              10.8MB

            • memory/2752-157-0x00000239B67B3000-0x00000239B67B5000-memory.dmp

              Filesize

              8KB

            • memory/2752-156-0x00000239B67B0000-0x00000239B67B2000-memory.dmp

              Filesize

              8KB

            • memory/2996-172-0x0000000000B00000-0x0000000000B15000-memory.dmp

              Filesize

              84KB

            • memory/2996-173-0x0000000007F50000-0x0000000007F65000-memory.dmp

              Filesize

              84KB

            • memory/4644-150-0x00007FFDF9760000-0x00007FFDFA221000-memory.dmp

              Filesize

              10.8MB