Analysis

  • max time kernel
    13s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 19:05

General

  • Target

    d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e.exe

  • Size

    4.2MB

  • MD5

    1de3eaebddb8b0059fb279548dae5c5c

  • SHA1

    d87c6c276c28d515be6bea13f4b9afcb7421ff2e

  • SHA256

    d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e

  • SHA512

    19d9ee019cffa93ba2bc205bf3dabf0b1f7719ab533348e37927aee4db5fd951980eacd152c70171ec6fded885fdafb0cfc541473f667e25946c66a3fd593be2

  • SSDEEP

    98304:u+HT2dFOlkJa7jNZC2ePu9ILkthheCYlOaW:3zMKBrC2kuA8hntJ

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 17 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e.exe
    "C:\Users\Admin\AppData\Local\Temp\d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e.exe"
    1⤵
      PID:3040
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        2⤵
          PID:3504
        • C:\Users\Admin\AppData\Local\Temp\d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e.exe
          "C:\Users\Admin\AppData\Local\Temp\d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e.exe"
          2⤵
            PID:2964
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
                PID:3388
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                3⤵
                  PID:1900
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    PID:4388
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                    PID:2344
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    3⤵
                      PID:4960
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      3⤵
                        PID:4372
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                            PID:2484
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            4⤵
                            • Creates scheduled task(s)
                            PID:5940
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /delete /tn ScheduledUpdate /f
                            4⤵
                              PID:5880
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              4⤵
                                PID:5080
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                4⤵
                                  PID:4560
                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                  4⤵
                                    PID:4888
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                    4⤵
                                    • Creates scheduled task(s)
                                    PID:4248
                                  • C:\Windows\windefender.exe
                                    "C:\Windows\windefender.exe"
                                    4⤵
                                      PID:4296
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        5⤵
                                          PID:1480
                                          • C:\Windows\SysWOW64\sc.exe
                                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                            6⤵
                                            • Launches sc.exe
                                            PID:496
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
                                  1⤵
                                    PID:4612
                                  • C:\Windows\windefender.exe
                                    C:\Windows\windefender.exe
                                    1⤵
                                      PID:2308

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnlwdh3b.eev.ps1

                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                            Filesize

                                            281KB

                                            MD5

                                            d98e33b66343e7c96158444127a117f6

                                            SHA1

                                            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                            SHA256

                                            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                            SHA512

                                            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                            Filesize

                                            2KB

                                            MD5

                                            968cb9309758126772781b83adb8a28f

                                            SHA1

                                            8da30e71accf186b2ba11da1797cf67f8f78b47c

                                            SHA256

                                            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                            SHA512

                                            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                            Filesize

                                            19KB

                                            MD5

                                            ab4ade7296afd46ae37241d94001a6c6

                                            SHA1

                                            cf155afdd265ed9da9703cb7f740f5f4d1d4dec7

                                            SHA256

                                            abec80243c916b2cb2ba6c45d34612b81cbf1eb5d0a1103d29923fe098807ae2

                                            SHA512

                                            b582204d5adb2a3688fd58822e463389a82b55124a1def4c53d1b65f2b6231dc842305c5cd75f3544b1567ce69c969584551619c091c22fe84c1b41f7f89c318

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                            Filesize

                                            19KB

                                            MD5

                                            ad01c4309c315e5286936edba1eefa8d

                                            SHA1

                                            c755df4e92565defe2449f1a849a84b62a1805d9

                                            SHA256

                                            8ad75cd51bbb43b7cf116c3068e867112328cc3d9f90e6a7ad27a670fe810745

                                            SHA512

                                            e2b55f43ed3ce58691528256713d0c8a5e8ae2aea2bb8e8d14104278631ed6ffe39eca80e3af3c063256c65ee06aa73ab41df30b870bfbaeaf5489f61b58a4c1

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                            Filesize

                                            19KB

                                            MD5

                                            c29b8ed26e3534a9d2b790b6dde20165

                                            SHA1

                                            e24c2200cf416b10411d0efa6e10053eec0b69be

                                            SHA256

                                            9d9dc3df1ec6cf42e6e4f3ff90950960e7a991f05676d1015fe81a1600b7e728

                                            SHA512

                                            eb09c7317876e59b728c41f6378f59dc35acbc9e6dec2fead54b50748cb297c75a2e665a208544370a8a1ff20288e5f65c348a36d38030ce37109bf401177e74

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                            Filesize

                                            19KB

                                            MD5

                                            c6a48a3157ced52eebd6e565f9712c82

                                            SHA1

                                            4b2bd22a1519d1ba2b3c5f983dee59ee15ab0749

                                            SHA256

                                            2722b37e7aad8e8043dfd6532cdbf2ad4491a8d52b9079d284a04ef22eecfdff

                                            SHA512

                                            ddec366d1030a2653b8f1458449f60c831a92a5785ff837d0b1da76afd08d4adea45e206f6928cce178b87885e099b336a52bb604c0925d934a8136caafecb35

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                            Filesize

                                            19KB

                                            MD5

                                            5c4fcd218270a89b3397eb2328ffd6e0

                                            SHA1

                                            180fdf99fbd0734c6ec0996b2527ccaa66f35909

                                            SHA256

                                            4400d04cbafe5f9d8c3ccf5aa878dcf43d6e64290aa0555caf1f01729ed0e9db

                                            SHA512

                                            9a5beb228e0faa276ff5032147aeb2e4d942884422d454c9c8f71c22eb9763b563a4e64119aa9a93a40af2063b48acb5fe44b059d6d9ad03c28d6eb25bc8ea14

                                          • C:\Windows\rss\csrss.exe

                                            Filesize

                                            4.2MB

                                            MD5

                                            1de3eaebddb8b0059fb279548dae5c5c

                                            SHA1

                                            d87c6c276c28d515be6bea13f4b9afcb7421ff2e

                                            SHA256

                                            d45911b03039aececd390f2613049358f9f31e5a1a7f7c56ad9323f1643d222e

                                            SHA512

                                            19d9ee019cffa93ba2bc205bf3dabf0b1f7719ab533348e37927aee4db5fd951980eacd152c70171ec6fded885fdafb0cfc541473f667e25946c66a3fd593be2

                                          • C:\Windows\windefender.exe

                                            Filesize

                                            2.0MB

                                            MD5

                                            8e67f58837092385dcf01e8a2b4f5783

                                            SHA1

                                            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                            SHA256

                                            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                            SHA512

                                            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                          • memory/2308-296-0x0000000000400000-0x00000000008DF000-memory.dmp

                                            Filesize

                                            4.9MB

                                          • memory/2308-281-0x0000000000400000-0x00000000008DF000-memory.dmp

                                            Filesize

                                            4.9MB

                                          • memory/2308-287-0x0000000000400000-0x00000000008DF000-memory.dmp

                                            Filesize

                                            4.9MB

                                          • memory/2344-113-0x00000000057C0000-0x0000000005B14000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/2344-117-0x0000000070800000-0x000000007084C000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/2344-100-0x0000000074900000-0x00000000750B0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/2344-102-0x0000000004960000-0x0000000004970000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2344-101-0x0000000004960000-0x0000000004970000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2344-131-0x0000000074900000-0x00000000750B0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/2344-129-0x000000007F5B0000-0x000000007F5C0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2344-116-0x0000000004960000-0x0000000004970000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2344-118-0x0000000070FC0000-0x0000000071314000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/2964-103-0x0000000004D40000-0x0000000005144000-memory.dmp

                                            Filesize

                                            4.0MB

                                          • memory/2964-128-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/2964-115-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/2964-65-0x0000000004D40000-0x0000000005144000-memory.dmp

                                            Filesize

                                            4.0MB

                                          • memory/2964-167-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/2964-66-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/3040-4-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/3040-11-0x0000000004E50000-0x000000000524E000-memory.dmp

                                            Filesize

                                            4.0MB

                                          • memory/3040-3-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/3040-2-0x0000000005250000-0x0000000005B3B000-memory.dmp

                                            Filesize

                                            8.9MB

                                          • memory/3040-1-0x0000000004E50000-0x000000000524E000-memory.dmp

                                            Filesize

                                            4.0MB

                                          • memory/3040-61-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/3040-25-0x0000000005250000-0x0000000005B3B000-memory.dmp

                                            Filesize

                                            8.9MB

                                          • memory/3040-63-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/3388-67-0x0000000074900000-0x00000000750B0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3388-80-0x0000000005240000-0x0000000005250000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3388-98-0x0000000074900000-0x00000000750B0000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3388-95-0x0000000007C30000-0x0000000007C44000-memory.dmp

                                            Filesize

                                            80KB

                                          • memory/3388-94-0x0000000007BC0000-0x0000000007BD1000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/3388-93-0x00000000078B0000-0x0000000007953000-memory.dmp

                                            Filesize

                                            652KB

                                          • memory/3388-83-0x0000000070FA0000-0x00000000712F4000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/3388-82-0x0000000070800000-0x000000007084C000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/3388-81-0x000000007F450000-0x000000007F460000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3388-68-0x0000000005240000-0x0000000005250000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3388-70-0x0000000006090000-0x00000000063E4000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/3388-79-0x0000000006710000-0x000000000675C000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/3504-34-0x0000000074860000-0x0000000075010000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3504-29-0x0000000006840000-0x0000000006884000-memory.dmp

                                            Filesize

                                            272KB

                                          • memory/3504-53-0x0000000007BC0000-0x0000000007BD1000-memory.dmp

                                            Filesize

                                            68KB

                                          • memory/3504-55-0x0000000005010000-0x0000000005020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3504-54-0x0000000007C00000-0x0000000007C0E000-memory.dmp

                                            Filesize

                                            56KB

                                          • memory/3504-56-0x0000000007C20000-0x0000000007C34000-memory.dmp

                                            Filesize

                                            80KB

                                          • memory/3504-62-0x0000000074860000-0x0000000075010000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3504-58-0x0000000007C60000-0x0000000007C68000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/3504-51-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/3504-36-0x0000000005010000-0x0000000005020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3504-37-0x0000000007A80000-0x0000000007AB2000-memory.dmp

                                            Filesize

                                            200KB

                                          • memory/3504-39-0x0000000070890000-0x0000000070BE4000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/3504-50-0x0000000007AC0000-0x0000000007B63000-memory.dmp

                                            Filesize

                                            652KB

                                          • memory/3504-49-0x0000000007A60000-0x0000000007A7E000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/3504-38-0x0000000070700000-0x000000007074C000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/3504-57-0x0000000007C70000-0x0000000007C8A000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/3504-35-0x000000007F220000-0x000000007F230000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3504-33-0x00000000078C0000-0x00000000078DA000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/3504-32-0x0000000007F20000-0x000000000859A000-memory.dmp

                                            Filesize

                                            6.5MB

                                          • memory/3504-31-0x0000000007820000-0x0000000007896000-memory.dmp

                                            Filesize

                                            472KB

                                          • memory/3504-30-0x0000000005010000-0x0000000005020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3504-52-0x0000000007CC0000-0x0000000007D56000-memory.dmp

                                            Filesize

                                            600KB

                                          • memory/3504-5-0x0000000074860000-0x0000000075010000-memory.dmp

                                            Filesize

                                            7.7MB

                                          • memory/3504-27-0x00000000068C0000-0x000000000690C000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/3504-26-0x0000000006450000-0x000000000646E000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/3504-24-0x0000000006010000-0x0000000006364000-memory.dmp

                                            Filesize

                                            3.3MB

                                          • memory/3504-14-0x0000000005EA0000-0x0000000005F06000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/3504-13-0x0000000005E30000-0x0000000005E96000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/3504-12-0x00000000055B0000-0x00000000055D2000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/3504-9-0x0000000005650000-0x0000000005C78000-memory.dmp

                                            Filesize

                                            6.2MB

                                          • memory/3504-6-0x0000000005010000-0x0000000005020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3504-8-0x0000000005010000-0x0000000005020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/3504-7-0x0000000002E40000-0x0000000002E76000-memory.dmp

                                            Filesize

                                            216KB

                                          • memory/4296-278-0x0000000000400000-0x00000000008DF000-memory.dmp

                                            Filesize

                                            4.9MB

                                          • memory/4372-279-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-283-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-286-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-271-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-288-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-291-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-294-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4372-297-0x0000000000400000-0x000000000310E000-memory.dmp

                                            Filesize

                                            45.1MB

                                          • memory/4960-132-0x0000000074900000-0x00000000750B0000-memory.dmp

                                            Filesize

                                            7.7MB