2024-06-02_3cff79b285c74c8ab2086bfe63f9911e_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-02_3cff79b285c74c8ab2086bfe63f9911e_magniber_revil
Size

3.4MB
MD5

3cff79b285c74c8ab2086bfe63f9911e
SHA1

8029e28971ea0d132033877923a0161d87ed3eb3
SHA256

bd859c25ac69bcae4607949f551fb028b80193f5f1a64f54455a913b7b87825a
SHA512

15dff9ef1dbfd4f107af3c79cb5c01e08a900e70b4260fd8481da6fb08cb7cd455de007c001b6f4d49b0c796d3758c3a21459f441f33e896898960ad5423c24f
SSDEEP

98304:e8ekl6OO6lqezeUNB5VKgB9BrNXbN7Nr20u5:e8hQwHzeUNB5VKgfDbe

Score

1^/10

Malware Config

Signatures

Files

2024-06-02_3cff79b285c74c8ab2086bfe63f9911e_magniber_revil
.exe windows:5 windows x86 arch:x86

429fe502be0bdaf419c3dc03b2a37edd

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:69:10:70:7e:ca:0e:06:6a:ca:95:e7
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

03/06/2020, 07:32

Not After

05/07/2022, 02:42

Subject

CN=He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si,O=He Fei Yun Biao Xin Xi Ke Ji You Xian Gong Si,L=Hefei,ST=Anhui,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:ae:84:57:77:23:67:12:e2:a5:b4:d9
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

10/06/2020, 08:26

Not After

11/06/2022, 08:26

Subject

SERIALNUMBER=91340111MA2N4FCY9X,CN=Hefei Yunbiao Information Technology Co.\, Ltd.,O=Hefei Yunbiao Information Technology Co.\, Ltd.,L=Hefei,ST=Anhui,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054845464549,1.3.6.1.4.1.311.60.2.1.2=#1305414e485549,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

53:2f:00:14:b9:2e:b5:ff:f1:93:ff:28:e7:74:a9:81:02:54:e6:91:c4:b8:57:0f:5a:9d:10:ae:03:9f:5b:6f
Signer

Actual PE Digest

53:2f:00:14:b9:2e:b5:ff:f1:93:ff:28:e7:74:a9:81:02:54:e6:91:c4:b8:57:0f:5a:9d:10:ae:03:9f:5b:6f

Digest Algorithm

sha256

PE Digest Matches

true

d1:5f:5a:d6:17:c7:af:6e:59:97:1b:50:88:48:b8:91:13:d0:bb:ec
Signer

Actual PE Digest

d1:5f:5a:d6:17:c7:af:6e:59:97:1b:50:88:48:b8:91:13:d0:bb:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\gitlab\builds\yyT_Ky8z\0\marshal\cloudinputsetup\Release\uninst.pdb

Imports

kernel32

CloseHandle
WaitForSingleObject
CreateMutexW
GetTempPathW
DeleteCriticalSection
DecodePointer
RaiseException
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
CallNamedPipeA
WinExec
MoveFileExW
GetModuleHandleW
GetProcAddress
OutputDebugStringW
OutputDebugStringA
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RemoveDirectoryW
Sleep
GetLongPathNameW
GetModuleFileNameW
DeleteFileW
LocalFree
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
GetOEMCP
WideCharToMultiByte
FormatMessageW
FreeLibrary
LoadLibraryW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetCurrentThreadId
IsValidCodePage
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
RtlUnwind
GetCurrentDirectoryW
GetTickCount
FreeResource
ExitProcess
MultiByteToWideChar
GetACP
MulDiv
CreateDirectoryW
ReadFile
GetCurrentProcess
WriteFile
SetFilePointer
CreateFileW
DuplicateHandle
SystemTimeToFileTime
GetFileType
DosDateTimeToFileTime
GetFileSize
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocalTime
InterlockedIncrement
InterlockedDecrement
LocalAlloc
CreateToolhelp32Snapshot
GetVersionExW
GetFileSizeEx
GetExitCodeProcess
FindFirstFileW
FindClose
FindNextFileW
CopyFileW
CreateProcessW
Process32FirstW
Process32NextW
OpenProcess
WTSGetActiveConsoleSessionId
TerminateProcess
GetCurrentProcessId
GetDriveTypeW
GetDiskFreeSpaceExW
DeviceIoControl
GetVolumeInformationW
GetPrivateProfileStringW
MoveFileW
GetFileAttributesW
GetSystemDirectoryW
SetFilePointerEx
SetLastError
FormatMessageA
InitializeCriticalSection
CreateFileA
GetFileAttributesA
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
VerifyVersionInfoW
QueryPerformanceCounter
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
FlushConsoleInputBuffer
GetCurrentThread
GetThreadTimes
GetSystemTime
GlobalMemoryStatus
LoadLibraryA
IsDebuggerPresent
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
TryEnterCriticalSection
GetStringTypeW
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
GetFileAttributesExW
GetFullPathNameW
SetEndOfFile
AreFileApisANSI
GetCommandLineW
GetSystemDirectoryA
InterlockedExchange
InterlockedCompareExchange
GetPrivateProfileIntA
GetPrivateProfileStringA
GetUserDefaultLCID
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
ResetEvent

user32

SetFocus
BeginPaint
EndPaint
IsRectEmpty
GetUpdateRect
IsWindow
IsWindowVisible
IntersectRect
GetWindowRect
MapWindowPoints
CreateWindowExW
GetCursorPos
PtInRect
GetFocus
InvalidateRect
UnionRect
GetMessageW
TranslateMessage
DispatchMessageW
SetCapture
ReleaseCapture
PostMessageW
CharNextW
IsZoomed
GetMonitorInfoW
MonitorFromWindow
SetWindowRgn
MessageBoxW
wsprintfW
DefWindowProcW
ShowWindow
EnableWindow
LoadImageW
GetSystemMetrics
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
GetWindow
SetPropW
GetPropW
OffsetRect
wvsprintfW
SetCursor
CreateCaret
ShowCaret
HideCaret
GetCaretPos
SetCaretPos
ClientToScreen
GetSysColor
GetCaretBlinkTime
MoveWindow
GetWindowRgn
FillRect
DrawTextW
SetRect
CharPrevW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
DrawIconEx
DestroyIcon
InvalidateRgn
CreateAcceleratorTableW
GetGUIThreadInfo
GetProcessWindowStation
GetUserObjectInformationW
GetActiveWindow
IsIconic
ScreenToClient
GetKeyboardLayoutList
ActivateKeyboardLayout
GetKeyboardLayout
GetParent
GetKeyState
SetTimer
GetClientRect
SendMessageW
PostQuitMessage
KillTimer
MessageBeep
DestroyWindow
SetWindowLongW
GetWindowLongW
SetWindowPos
GetDC
ReleaseDC
CallWindowProcW

gdi32

CreateRectRgn
CreateDIBSection
GetDeviceCaps
CreateRoundRectRgn
GetTextMetricsW
SetWindowOrgEx
Rectangle
RestoreDC
BitBlt
SaveDC
SelectObject
CreateCompatibleBitmap
LineTo
CreateCompatibleDC
SelectClipRgn
CreatePen
CreateFontIndirectW
GetStockObject
GetObjectW
RoundRect
CreatePenIndirect
SetBkMode
SetTextColor
GetCharABCWidthsW
PtInRegion
GetTextExtentPoint32W
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
TextOutW
CombineRgn
StretchBlt
CreatePolygonRgn
CreatePatternBrush
SetStretchBltMode
SetBkColor
ExtTextOutW
CreateSolidBrush
DeleteDC
MoveToEx
DeleteObject
GetObjectA
GdiFlush

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
QueryServiceStatusEx
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetUserNameW
EqualSid
RegQueryValueW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
RegQueryValueExA
RegOpenKeyExA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyExW
SetFileSecurityW
DeregisterEventSource
CryptReleaseContext
RegCreateKeyExW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathA
SHGetFolderPathA
CommandLineToArgvW
SHChangeNotify
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHFileOperationW

ole32

CoCreateGuid
CoInitializeSecurity
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CLSIDFromString
OleLockRunning
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromProgID
CoSetProxyBlanket

ws2_32

shutdown
htonl
gethostname
gethostbyname
ioctlsocket
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
getservbyname

wldap32

ord46
ord14
ord216
ord208
ord219
ord142
ord41
ord301
ord147
ord133
ord79
ord145
ord167
ord127
ord27
ord26
ord118

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty

shlwapi

PathAddBackslashA
PathFileExistsA
PathRemoveBackslashW
PathAppendW
PathAddBackslashW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
PathAppendA

gdiplus

GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateLineBrushI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipCreateFontFromDC
GdipSetPixelOffsetMode
GdipDeleteFontFamily
GdipGetFamily
GdipDrawString
GdipDrawImageRectI
GdipGraphicsClear
GdipDrawImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth
GdipGetImageHeight
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdiplusStartup
GdipSetInterpolationMode
GdiplusShutdown
GdipSetCompositingQuality
GdipCreateBitmapFromScan0

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionFontW
ImmSetCompositionWindow
ImmGetDescriptionW

comctl32

_TrackMouseEvent
ord17

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

version

GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerQueryValueA

netapi32

Netbios

oleaut32

SysAllocString
VariantInit
VariantClear
SysFreeString

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 564KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

429fe502be0bdaf419c3dc03b2a37edd

Code Sign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

64:69:10:70:7e:ca:0e:06:6a:ca:95:e7Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

4b:ae:84:57:77:23:67:12:e2:a5:b4:d9Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

53:2f:00:14:b9:2e:b5:ff:f1:93:ff:28:e7:74:a9:81:02:54:e6:91:c4:b8:57:0f:5a:9d:10:ae:03:9f:5b:6fSigner

d1:5f:5a:d6:17:c7:af:6e:59:97:1b:50:88:48:b8:91:13:d0:bb:ecSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

wldap32

crypt32

shlwapi

gdiplus

imm32

comctl32

iphlpapi

psapi

wtsapi32

version

netapi32

oleaut32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 564KB - Virtual size: 564KB

.data Size: 66KB - Virtual size: 88KB

.rsrc Size: 319KB - Virtual size: 319KB

.reloc Size: 121KB - Virtual size: 120KB

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

64:69:10:70:7e:ca:0e:06:6a:ca:95:e7
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

4b:ae:84:57:77:23:67:12:e2:a5:b4:d9
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

53:2f:00:14:b9:2e:b5:ff:f1:93:ff:28:e7:74:a9:81:02:54:e6:91:c4:b8:57:0f:5a:9d:10:ae:03:9f:5b:6f
Signer

d1:5f:5a:d6:17:c7:af:6e:59:97:1b:50:88:48:b8:91:13:d0:bb:ec
Signer

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 564KB - Virtual size: 564KB

.data
Size: 66KB - Virtual size: 88KB

.rsrc
Size: 319KB - Virtual size: 319KB

.reloc
Size: 121KB - Virtual size: 120KB