KR102271269B1 - Recorded media recording of the malware classification device, method and program that is transformed according to the api level of the operating system - Google Patents

Abstract

A method for classifying malicious code, the method comprising: collecting system function information; generating API classification information by classifying the API level; extracting reference operation information according to the target API level of the application; extracting, for the application, information about transforming operations operating at different API levels; and classifying the malicious code according to the operation information.

Description

A device and method for classifying malicious codes that are transformed according to the API level of the operating system, and a recording medium for recording a program for performing the same

The present invention relates to an apparatus and method for classifying malicious code that is modified according to an API level of an operating system, and a recording medium recording a program for performing the same, and more particularly, to classify malicious code whose operation is modified according to different API levels. It relates to an apparatus, a method, and a recording medium recording a program for performing the same.

Diversity in hardware, operating system versions, application programming interface (API) levels, and original equipment manufacturers (OEMs) provides users with a broad product line, rich features and custom designs, but this diversity puts those devices at risk. also do it

For example, a delayed update of software installed on a device can pose a significant security risk to the device, leaving the device vulnerable to a variety of Common Vulnerability Exposures (CVEs), even if the hardware is capable of running the latest release.

In addition, in Android, fragmentation occurs in frameworks due to customization by device manufacturers. Currently, the latest Android version is the Pie version, which has been released for a long time, but the market share is only about 10.4%. Also, its share is evenly distributed across Lollipop, Marshmallow, Nougat, and Oreo versions. Each time a new version of these Android APIs is released, new functions are introduced to applications and devices. These changes affect new APIs, manifests, drivers, and hardware that internally define Android's behavior.

In this regard, the malware can evade the runtime permission policy of Android 6.0 (Marshmallow) by declaring that the target SDK (Software Development Kit) version is lower than 23, and in the case of Android. may be Accordingly, there is a need for a method for classifying malicious codes that operate differently in different operating system versions.

The technical problem to be solved by the present invention is to provide an apparatus and method for classifying malicious code whose operation is modified according to different API levels, and a recording medium recording a program for performing the same.

An aspect of the present invention, the method comprising: collecting system function information according to an API level of a mobile operating system; generating API classification information by classifying the API level according to preset level classification information; extracting reference operation information according to a target API level of an application executed in the mobile operating system; extracting, with respect to the application, information about a modification operation operating at an API level different from the target API level; and classifying the malicious code according to at least one of the reference action information and the modified action information.

In addition, the generating of the reference operation information may include extracting the reference operation information according to each target API level set in at least one or more applications executed in the mobile operating system.

In addition, the generating of the modified operation information may include, for at least one or more applications executed in the mobile operating system, at least one according to API classification information in which an API level different from a target API level at which each reference operation information is generated is provided. The above deformation motion information can be extracted.

The classifying of the malicious code may include: collecting the at least one or more reference operation information and the at least one or more modified operation information according to the API classification information; receiving, from at least one of extracting the reference motion information and extracting the modified motion information, at least one of reference motion information of another application or modified motion information; and classifying the other application according to a similarity calculated by comparing at least one of the reference motion information or the modified motion information of the other application with the collected at least one or more reference motion information and the at least one or more modified motion information. may further include.

In addition, the collecting of the system function information may include collecting system function information provided in at least one API level that is changed according to an update of the mobile operating system.

In addition, the level classification information may set an API level that is changed when the version of the mobile operating system is changed as a classification point.

Another aspect of the present invention may be a computer-readable recording medium in which a computer program for performing a malicious code classification method is recorded.

Another aspect of the present invention includes: an information collecting unit that collects system function information according to an API level of a mobile operating system, and classifies the API level according to preset level classification information to generate API classification information; an information extracting unit for extracting reference operation information according to a target API level of an application executed in the mobile operating system, and extracting, with respect to the application, modified operation information operating at an API level different from the target API level; and a malicious code classification unit that classifies malicious code according to at least one of the reference action information and the modified action information.

Also, the information extractor may extract reference operation information according to each target API level set in at least one or more applications executed in the mobile operating system.

In addition, the information extraction unit, for at least one or more applications executed in the mobile operating system, at least one or more variant operation information according to API classification information provided with an API level different from the target API level at which each reference operation information is generated can be extracted.

In addition, the malicious code classification unit collects the at least one or more reference operation information and the at least one or more modified operation information according to the API classification information, and collects at least one of the reference operation information or the modified operation information of another application from the information extracting unit. According to a similarity calculated by receiving one piece of information and comparing at least one of the reference motion information or the modified motion information of the other application with the collected at least one or more reference motion information and the at least one or more modified motion information Different applications can be classified.

According to one aspect of the present invention described above, there is provided an apparatus and method for classifying malicious code that is modified according to the API level of an operating system, and a recording medium recording a program for performing the same, thereby providing malicious code whose operation is modified according to different API levels. can be classified.

1 is a schematic diagram of a malicious code classification system for classifying malicious code according to an embodiment of the present invention.
2 is a control block diagram of a malicious code classification apparatus according to an embodiment of the present invention.
3 is a schematic diagram illustrating a method of collecting operation information of an application according to an embodiment of the present invention.
4 is a schematic diagram illustrating a method for classifying a malicious code according to an embodiment of the present invention.
5 is a flowchart of a malicious code classification method according to an embodiment of the present invention.
6 is a detailed flowchart of the step of classifying the malicious code of FIG.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0023] Reference is made to the accompanying drawings, which show by way of illustration specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein with respect to one embodiment may be implemented in other embodiments without departing from the spirit and scope of the invention. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the invention, if properly described, is limited only by the appended claims, along with all scope equivalents to those claimed. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a schematic diagram of a malicious code classification system for classifying malicious code according to an embodiment of the present invention.

The malicious code classification system 100 may collect system function information according to the API level 110 for the mobile operating system.

In this case, the API may include system function information that is called by the application 180 and performs an operation, and the API may partially change system function information when the mobile operating system is updated. It can be understood that the API level 110 is designated so as to distinguish an API that is changed according to an update of the operating system.

Meanwhile, the system function information of the API may indicate a programming language provided to perform an operation called from the application 180 , which may include a class, a method, a variable, and the like.

In addition, the system function information may be added to the API according to the API level 110 or support by the operating system manufacturer may be stopped. Table 1 is a table showing classes and methods that have been removed or discontinued depending on the Android version.

Referring to Table 1, it can be understood that the names listed in the first column are the names of the Android version, and in the first row, AC means an additional class, DC means a break class, AM means an additional method, and DM means a break method.

Accordingly, it is possible to check the number of classes and methods added or stopped according to the Android version update.

On the other hand, in the version update of a mobile operating system such as Android, the version name is maintained, but there may be an update in which the API level 110 is changed, and there may be an update in which both the version name and the API level 110 are changed. .

In this regard, the malicious code classification system 100 may classify according to the level classification information 120 to generate the API classification information 130 .

Here, the level classification information 120 may be information set to classify the plurality of API levels 110 into at least one bundle based on an important update of the mobile operating system.

For example, in Android, API level 110 exists from 1 to 26, and API level 110 is classified based on level 16 and level 21 among API levels 110 in which the name of the Android version changes, and API classification information 130 may be generated, and in this case, the API classification information 130 includes the first level classification 131a including the API level 110 from the 1st level to the 15th level, and the 16th level to the 20th level. It may be classified into a second level classification 131b including the API level 110 and a third level classification 131c including the API level 110 from the 21st level to the 26th level.

On the other hand, the number of API levels 110 described here, the number of level classifications 131 included in the API classification information 130 classified according to the level classification information 120, etc. It should be understood that changes may be made without departing from it.

The malicious code classification system 100 may extract the reference operation information 140 according to the target API level 110 of the application 180 executed in the mobile operating system.

Here, the target API level 110 may mean an API level 110 at which execution of the application 180 is recommended, and the target API level 110 may have a set value in the application 180 .

In addition, the reference operation information 140 may indicate an operation performed by the application 180 at the target API level 110 , and may include classes, methods, and variables used by the application 180 in the corresponding API level 110 . It may be information listing

The malicious code classification system 100 may extract information about the modification operation in which the application 180 operates at an API level 110 different from the target API level.

Here, the API level 110 different from the target API level 110 may mean an API level 110 included in the level classification 131 other than the level classification 131 including the target API level 110 . have.

For example, when the target API level 110 is level 5, the target API level 110 may be the API level 110 included in the first level classification 131a, and the other API level 110 is It may be the API level 110 included in the second level classification 131b and the third level classification 131c. At this time, the first level classification 131a generated by the target API level 110 sets the target API level 110 as the representative API, and the reference operation information 140 of the application 180 is performed in the representative API. The second level classification 131b and the third level classification 131c generated by different API levels 110, which can be extracted by operation, are different API classification information 130 and information included in the system function information, respectively. The difference may be extracted as an operation performed in the API of the API level 110 with the largest difference.

The malicious code classification system 100 extracts the reference operation information 140 and the modified operation information 150 from different applications 180 , and creates a database 160 of different operation information according to the API classification information 130 . can create

In this case, the different motion information may include the reference motion information 140 and the modified motion information 150 , and such motion information may be classified according to the API classification information 130 .

In addition, the database 160 classifies and collects different operation information according to the API classification information 130 , calculates the similarity of different operation information in the same API classification information 130 , and sets the similarity in advance. , it is possible to classify the corresponding at least one piece of operation information as the same malicious code.

Accordingly, the malicious code classification system 100 may classify the malicious code by the database generated according to at least one of the reference action information 140 and the modified action information 150 .

To this end, the malicious code classification system 100 may extract at least one of the reference operation information 140 and the modified operation information 150 of the new application 180 , and the malicious code classification system 100 uses the reference operation information 150 . The similarity is calculated by comparing at least one of the motion information 140 and the modified motion information 150 with at least one of the reference motion information 140 and the modified motion information 150 stored in the database 160 . and, when the degree of similarity satisfies a preset value, the new application 180 may be classified as a corresponding malicious code.

2 is a control block diagram of a malicious code classification apparatus according to an embodiment of the present invention.

The malicious code classification apparatus 200 may include an information collection unit 210 , an information extraction unit 220 , and a malicious code classification unit 230 .

The information collection unit 210 may collect system function information according to the API level 110 of the mobile operating system.

In this regard, the API may include system function information that is called by the application 180 and performs an operation, and the API may partially change system function information when the mobile operating system is updated. , it can be understood that the API level 110 is designated so as to distinguish the API that is changed according to the update of the mobile operating system.

At this time, the information collection unit 210 may collect at least one or more API levels 110 that are changed according to the update of the mobile operating system, and thus collect system function information provided in each API level 110 . can be understood as

The information collection unit 210 may classify the API level 110 according to the level classification information 120 to generate the API classification information 130 .

In this case, the information collection unit 210 may set the API level 110, which is changed when the version of the mobile operating system is changed, as a classification point. In this case, the change in the version of the mobile operating system may be understood as a change in the name indicating the version of the mobile operating system, for example, in the case of Android, the version of the Jelly Bean is changed to the version of KitKat or , or may mean a point of change from the Nougat version to the Oreo version.

The information extraction unit 220 may extract the reference operation information 140 according to the target API level 110 of the application 180 executed in the mobile operating system.

Here, the target API level may mean the API level 110 at which the execution of the application 180 is recommended, and the target API level may have a set value in the application 180 .

In addition, the reference operation information 140 may indicate an operation performed by the application 180 at the target API level, and source codes such as classes, methods, and variables used by the application 180 at the corresponding API level 110 . It may be information listing

Meanwhile, the information extractor 220 may extract the reference operation information 140 from at least one or more different applications 180 according to the target API level 110 set in each application 180 .

In this case, since target API levels 110 set in different applications 180 may be included in different level classifications 131 , reference operation information 140 extracted from different applications 180 may be classified at different levels. An operation of the application 180 at 131 may be indicated.

The information extracting unit 220, with respect to the application 180 from which the reference operation information 140 is extracted, operates at an API level 110 different from the target API level 110 from which the reference operation information 140 is extracted. Information 150 can be extracted.

In this case, the API level 110 different from the target API level 110 may be the API level 110 included in the different level classification 131 .

Meanwhile, the information extraction unit 220 extracts the transformation operation information 150 from at least one or more different applications 180 according to the target API level 110 set in each application 180 and the other API level 110 . Each can be extracted.

In this case, the API level 110 different from the target API level 110 may be an API level 110 included in a different level classification 131 , and a different API level 110 set in different applications 180 . may be included in different level classifications 131 , so the modified operation information 150 extracted from different applications 180 may indicate the operation of the application 180 in different level classifications 131 .

The malicious code classification unit 230 may classify the malicious code according to the operation information of at least one of the reference operation information 140 and the modified operation information 150 .

To this end, the malicious code classification unit 230 collects the reference operation information 140 and the modified operation information 150 extracted from different applications 180 , and divides the different operation information according to the API classification information 130 . A database 160 may be created.

In this case, the malicious code classification unit 230 may classify and collect different operation information in the database 160 according to the API classification information 130 .

Accordingly, the malicious code classification unit 230 may calculate the similarity of different operation information in the same API classification information 130 collected in the database 160, and when the similarity satisfies a preset value, At least one or more applications 180 from which corresponding operation information is extracted may be classified as the same malicious code.

As such, the malicious code classification unit 230 may generate the database 160 by collecting at least one or more pieces of reference operation information 140 and at least one or more pieces of modified operation information 150 according to the API classification information 130 . .

In this case, the application 180 from which the operation information collected to create the database 160 is extracted may include a plurality of applications 180 known as malicious codes in advance.

Also, the malicious code classification unit 230 may receive at least one of the reference operation information 140 and the modified operation information 150 extracted from the other application 180 from the information extraction unit 220 . , the other application 180 may be understood as an application 180 different from the application 180 from which the reference operation information 140 or the modified operation information 150 collected to generate the database 160 is extracted.

The malicious code classification unit 230 includes at least one of the reference action information 140 or the modified action information 150 of the other application 180 and at least one or more pieces of reference action information 140 collected in the database 160 and The other applications 180 may be classified according to a degree of similarity calculated by comparing at least one or more pieces of information about the deformation operation 150 .

At this time, the other application 180 classified as a malicious code compares at least one piece of motion information collected in the database 160 with the motion information extracted from the information extraction unit 220 to set the similarity level in advance. It may be the application 180 that satisfies the value, and in this case, comparing the operation information may be comparing the operation information extracted with respect to the same API classification information 130 .

3 is a schematic diagram illustrating a method of collecting operation information of an application according to an embodiment of the present invention.

Referring to FIG. 3 , it can be seen that the respective reference motion information 140a, 140b, 140c and the modified motion information 150a, 150b, and 150c are extracted from different applications 180a, 180b, and 180c, and accordingly , it can be confirmed that the database 160 collects different reference motion information 140a, 140b, 140c and modified motion information 150a, 150b, 150c according to each level classification 131a, 131b, and 131c.

In this case, the database 160 may classify and collect each operation information according to the API classification information 130 that is the basis of the corresponding operation information.

In addition, the reference operation information 140a, 140b, 140c of the different applications 180a, 180b, 180c is performed for the API of the level classification (131a, 131b, 131c) including the target API level 110, respectively. It may indicate a motion, and in this regard, the reference motion information 140a, 140b, 140c of the different applications 180a, 180b, 180c may be extracted from different level classifications 131a, 131b, and 131c.

Accordingly, the reference operation information 140 of the specific application 180 may be stored in the arbitrary level classification 131 , and the modified operation information 150 of the other application 180 may be stored.

4 is a schematic diagram illustrating a method for classifying a malicious code according to an embodiment of the present invention.

Referring to FIG. 4 , the reference motion information 140d and the variation motion information 150d extracted from another application 180d are collected in the database 160 for each level classification 131 , and the reference motion information 140 and the variation It can be confirmed that the similarity is generated by comparing the operation information 150 and the application 180d is classified as a malicious code when the similarity satisfies a preset value.

At this time, comparing the motion information 140 , 150 collected in the database 160 with the motion information 140d and 150d extracted from another application 180d is to determine the class, method, variable, etc. You can create similarities by comparing source codes.

Also, the degree of similarity may indicate a degree to which the motion information 140d and 150d extracted from another application 180d is similar to the motion information 140 and 150 collected in the database 160 .

5 is a flowchart of a malicious code classification method according to an embodiment of the present invention.

Since the malicious code classification method according to an embodiment of the present invention proceeds in substantially the same configuration as the malicious code classification apparatus 200 shown in FIG. 2 , the same components as the malicious code classification apparatus 200 of FIG. 2 are applied. The same reference numerals are given, and repeated descriptions will be omitted.

The malicious code classification method includes the steps of collecting system function information (500), generating API classification information (510), extracting reference action information (520), extracting modified action information (530), and malicious code classification. classifying the code (540).

Collecting system function information 500 may collect system function information according to the API level 110 of the mobile operating system.

In this case, the step 500 of collecting system function information may collect at least one or more API levels 110 that are changed according to the update of the mobile operating system, and accordingly, system functions provided in each API level 110 . It can be understood as collecting information.

In the step 510 of generating the API classification information, the API level 110 may be classified according to the level classification information 120 to generate the API classification information 130 .

In this case, the step 510 of generating the API classification information may set the API level 110, which is changed when the version of the mobile operating system is changed, as a classification point. In this case, the change in the version of the mobile operating system may be understood as a change in the name indicating the version of the mobile operating system.

In step 520 of extracting the reference operation information, the reference operation information 140 may be extracted according to the target API level 110 of the application 180 executed in the mobile operating system.

Meanwhile, in the step of extracting the reference operation information 520 , the reference operation information 140 is extracted from at least one or more different applications 180 according to the target API level 110 set in each application 180 , respectively. can

Step 530 of extracting the modified motion information is at an API level 110 different from the target API level 110 from which the reference motion information 140 is extracted with respect to the application 180 from which the reference motion information 140 is extracted. It is possible to extract the information on the deformed operation 150 that operates.

On the other hand, in the step 530 of extracting the transformation operation information, the transformation operation information according to the API level 110 different from the target API level 110 set in each application 180 from at least one or more different applications 180 . (150) can be extracted, respectively.

In the classifying operation 540 of the malicious code, the malicious code may be classified according to operation information of at least one of the reference operation information 140 and the modified operation information 150 .

To this end, the step 540 of classifying the malicious code collects the reference operation information 140 and the modified operation information 150 extracted from different applications 180 , and performs different operations according to the API classification information 130 . A database 160 of information may be created.

In this case, in the step of classifying the malicious code ( 540 ), different operation information may be classified according to the API classification information 130 and collected in the database 160 .

Accordingly, in the step 540 of classifying the malicious code, the similarity of different operation information in the same API classification information 130 collected in the database 160 may be calculated, and when the similarity satisfies a preset value, For example, at least one or more applications 180 from which corresponding operation information is extracted may be classified as the same malicious code.

In this way, in the step of classifying the malicious code (540), the database 160 is generated by collecting at least one or more reference action information 140 and at least one or more modified action information 150 according to the API classification information 130. can

In addition, the step of classifying the malicious code (540) includes the step of extracting reference action information from at least one of the reference action information 140 and the modified action information 150 extracted from the other application 180 in step 520 and It may be transmitted from at least one of the step 530 of extracting the deformation motion information.

Accordingly, in the step of classifying the malicious code ( 540 ), at least one of the reference action information 140 or the modified action information 150 of the other application 180 and at least one reference action collected in the database 160 . The other applications 180 may be classified according to a degree of similarity calculated by comparing the information 140 and the at least one piece of information about the transformation operation 150 .

6 is a detailed flowchart of the step of classifying the malicious code of FIG.

Classifying the malicious code ( 540 ) may further include collecting operation information ( 541 ), receiving operation information ( 542 ), and classifying the application ( 543 ).

In the step 541 of collecting motion information, the reference motion information 140 and the modified motion information 150 extracted from different applications 180 are collected, and a database of different motion information according to the API classification information 130 . (160) can be created.

The step 542 of receiving the motion information includes the step of extracting reference motion information from at least one of the reference motion information 140 and the modified motion information 150 extracted from the other application 180 ( 520 ) and the transforming motion. The information may be transmitted from at least one of the step 530 of extracting the information.

In the step of classifying the application ( 543 ), at least one of the reference operation information 140 or the modified operation information 150 of the other application 180 and at least one or more reference operation information 140 collected in the database 160 . And the other applications 180 may be classified according to a degree of similarity calculated by comparing at least one or more pieces of information about the transformation operation 150 .

Such a malicious code classification method may be implemented as an application or implemented in the form of program instructions that may be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination.

The program instructions recorded on the computer-readable recording medium are specially designed and configured for the present invention, and may be known and available to those skilled in the computer software field.

Examples of the computer-readable recording medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as a CD-ROM and DVD, and a magneto-optical medium such as a floppy disk. media), and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like.

Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

Although the above has been described with reference to the embodiments, those skilled in the art will understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the following claims. will be able

100: Malware classification system

Claims (11)

A method for classifying malicious code whose behavior is modified according to different API levels of a mobile operating system, the method comprising:
Collecting system function information according to the API level of the mobile operating system;
generating API classification information by classifying the API level according to preset level classification information;
extracting reference operation information according to a target API level of an application executed in the mobile operating system;
extracting, with respect to the application, information about a modification operation operating at an API level different from the target API level; and
classifying the malicious code according to at least one of the reference action information and the modified action information;
The generating of the reference operation information includes extracting the reference operation information according to each target API level set in at least one or more applications executed in the mobile operating system,
The generating of the modified operation information may include, for at least one or more applications executed in the mobile operating system, at least one or more transformations according to API classification information provided with an API level different from a target API level at which each reference operation information is generated. extract motion information,
Classifying the malicious code includes:
collecting the at least one or more reference motion information and the at least one or more modified motion information according to the API classification information;
receiving, from at least one of extracting the reference motion information and extracting the modified motion information, at least one of reference motion information of another application or modified motion information; and
classifying the other application according to a similarity calculated by comparing at least one of the reference operation information or the modified operation information of the other application with the collected at least one or more reference operation information and the at least one or more modified operation information; Including, malware classification method.
delete delete delete The method of claim 1, wherein the collecting of the system function information comprises:
A malicious code classification method for collecting system function information provided in at least one API level that is changed according to an update of the mobile operating system.
According to claim 1, wherein the level classification information,
A malicious code classification method for setting an API level that is changed when the version of the mobile operating system is changed as a classification point.
A computer-readable recording medium on which a computer program is recorded, for performing the malicious code classification method according to any one of claims 1 to 6.
an information collection unit that collects system function information according to an API level of a mobile operating system, and classifies the API level according to preset level classification information to generate API classification information;
an information extraction unit for extracting reference operation information according to a target API level of an application executed in the mobile operating system, and extracting, with respect to the application, modified operation information operating at an API level different from the target API level; and
and a malicious code classification unit for classifying malicious code according to at least one of the reference action information and the modified action information;
The information extracting unit extracts reference operation information according to each target API level set in at least one or more applications executed in the mobile operating system, and for at least one or more applications executed in the mobile operating system, each reference operation information extracts at least one or more transformation operation information according to API classification information provided with an API level different from the target API level generated,
The malicious code classification unit,
Collecting the at least one or more reference operation information and the at least one or more modified operation information according to the API classification information,
At least one of the reference motion information or the modified motion information of another application is received from the information extraction unit,
Classifying the other application according to a similarity calculated by comparing at least one of the reference operation information or the modified operation information of the other application with the collected at least one or more reference operation information and the at least one or more modified operation information code classification device.
delete delete delete

Images