danabot | ef6fc7bf417d763f9c7c8c9bf723ce7d3b4acbeb4cc47e65bcb3d6b8f143fee2

Analysis

max time kernel
145s
max time network
101s
platform
windows10_x64
resource
win10v20210408
submitted
23-07-2021 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exe
Size

1.1MB
MD5

ff776b2fb6736075adfcb1739a180491
SHA1

1c5cb0eb48f441d8493f7c5f6428d7af8c1c9abb
SHA256

ef6fc7bf417d763f9c7c8c9bf723ce7d3b4acbeb4cc47e65bcb3d6b8f143fee2
SHA512

58fe0bb6f3dcda9831332d0dfcd0d5a92d58ed1107a3d246c4b092be384535be0d1d33ca9728b6944be171e3fa62663608e27ca7834a725b6ca9f81fcba853c7

Score

10^/10

danabot 4 banker discovery spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1987

Botnet

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB

rsa_privkey.plain

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

flow pid process

13 3840 rundll32.exe
14 3180 RUNDLL32.EXE
Loads dropped DLL 3 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

pid process

3840 rundll32.exe
3180 RUNDLL32.EXE
3180 RUNDLL32.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Program Files directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\PROGRA~3\Jvgzbfh.tmp rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
13	3840	rundll32.exe
14	3180	RUNDLL32.EXE

pid	process
3840	rundll32.exe
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE

description	ioc	process
File created	C:\PROGRA~3\Jvgzbfh.tmp	rundll32.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXE

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

RUNDLL32.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E9DF1375B9623BBA44E242FFDEFD671CD3FC7CCD	RUNDLL32.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\E9DF1375B9623BBA44E242FFDEFD671CD3FC7CCD\Blob = 030000000100000014000000e9df1375b9623bba44e242ffdefd671cd3fc7ccd20000000010000009902000030820295308201fea00302010202087a0f6d0277ff8083300d06092a864886f70d01010b050030653137303506035504030c2e5379386d616e74656320456e7465727072697365204d6f62696c6520526f6f7420666f72204d6963726f736f6674311d301b060355040a0c1453796d616e74656320436f72706f726174696f6e310b3009060355040613025553301e170d3139303732343131353031305a170d3233303732333131353031305a30653137303506035504030c2e5379386d616e74656320456e7465727072697365204d6f62696c6520526f6f7420666f72204d6963726f736f6674311d301b060355040a0c1453796d616e74656320436f72706f726174696f6e310b300906035504061302555330819f300d06092a864886f70d010101050003818d0030818902818100daedb87fccb34fb459a90debe7d04bc2fb136770cedec13a9dac7f47dc5ae178f5b5bf251d0a0a130e5dad512fc61b24a8158d71300bbda03a095dffd9e36ba094115a5891a04e3e9fec905343514837c11fcc6ebbb872f7ea58b579c6ab31433315c634db45f13ace1fb3861c18c0050db209184a29d23e687e953b9f120ab30203010001a34e304c300f0603551d130101ff040530030101ff30390603551d1104323030822e5379386d616e74656320456e7465727072697365204d6f62696c6520526f6f7420666f72204d6963726f736f6674300d06092a864886f70d01010b05000381810083daaa0500dade1fdd57805a4613f13d5194bfbb806ee9abd6d2a2bc02f08a27f4a2f5ef2392865d4846b3b00b82beda6f5cbb7d0d8d6bc43360d5cbbc7caba7b32f28646bd791babb5f88ca3a51e514c1b351c21c8769d447be46b3724d120a97ad7399313b7b13ea05e5538ab031fcc67f3f3a6a8de474678871f3f78e88fb	RUNDLL32.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

pid	process
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
3180	RUNDLL32.EXE
3180	RUNDLL32.EXE
612	powershell.exe
612	powershell.exe
612	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RUNDLL32.EXEpowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3180 RUNDLL32.EXE
Token: SeDebugPrivilege 3868 powershell.exe
Token: SeDebugPrivilege 612 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid process

3180 RUNDLL32.EXE

description	pid	process
Token: SeDebugPrivilege	3180	RUNDLL32.EXE
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	process	target process
PID 652 wrote to memory of 3840	652	SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exe	rundll32.exe
PID 652 wrote to memory of 3840	652	SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exe	rundll32.exe
PID 652 wrote to memory of 3840	652	SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exe	rundll32.exe
PID 3840 wrote to memory of 3180	3840	rundll32.exe	RUNDLL32.EXE
PID 3840 wrote to memory of 3180	3840	rundll32.exe	RUNDLL32.EXE
PID 3840 wrote to memory of 3180	3840	rundll32.exe	RUNDLL32.EXE
PID 3180 wrote to memory of 3868	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3868	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 3868	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 612	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 612	3180	RUNDLL32.EXE	powershell.exe
PID 3180 wrote to memory of 612	3180	RUNDLL32.EXE	powershell.exe
PID 612 wrote to memory of 3316	612	powershell.exe	nslookup.exe
PID 612 wrote to memory of 3316	612	powershell.exe	nslookup.exe
PID 612 wrote to memory of 3316	612	powershell.exe	nslookup.exe
PID 3180 wrote to memory of 392	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 392	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 392	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 2156	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 2156	3180	RUNDLL32.EXE	schtasks.exe
PID 3180 wrote to memory of 2156	3180	RUNDLL32.EXE	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.25613.13438.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.TMP,S C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\SECURI~1.TMP,PhUpVjI4Sw==
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpAE61.tmp.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpD228.tmp.ps1"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\SysWOW64\nslookup.exe
"C:\Windows\system32\nslookup.exe" -type=any localhost
5⤵
PID:3316

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
4⤵
PID:392

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
4⤵
PID:2156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Jvgzbfh.tmp
MD5
28af8cb2774479463f175bc7b7635092

SHA1
a870d7de7f76cd66e7716b3ef4af412aae0a7a63

SHA256
bcacc0f1afb24b1f902acc8caae2679c850ce8c3e08daaff51d6ebfe70d969c1

SHA512
ac69eb7993fd5cd15ed4b96a0220c86dfb629e7029021804b01569d0290572b834834b6a577c350d0d3e93f8615713e002622eea3f43ae24e4753e96435e7c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
47eebe401625bbc55e75dbfb72e9e89a

SHA1
db3b2135942d2532c59b9788253638eb77e5995e

SHA256
f1cd56000c44bbdb6880b5b133731f493fe8cba8198c5a861da6ae7b489ed0c3

SHA512
590b149863d58be346e7927c28501375cc570858d2f156d234b03d68b86c5c0667a1038e2b6f6639172bf95638ca9f7c70f45270951abbcdf43b1be853b81d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
a7ef6688ede0147d9c7a749b58b36cb9

SHA1
9c5e2a3c79d5d9f92481f2fdeb19ea75c1a25a51

SHA256
1fa960f983c218e05ff55ebe72a70150444e4f6e7e67d06757f36062374f5e45

SHA512
e5ab3b8459ed5fbb993174478c38700623a4b39a05c497184978a632e31a6a336275d3a34e5faebc199ac98fb23df3349197331d6a670d359045a299bd27b5d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SECURI~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAE61.tmp.ps1
MD5
f814b98ae69d7fd2b9fbf551bffc2cdb

SHA1
b444721f782c8c95b596f3ae6c48df3cdebb5639

SHA256
2a475d219a2fd103e3315b49e5ab18aceb6fe753b790650517b40a1dc231fe14

SHA512
e0fa42451c89563abe96a360d04f6dbbcd6ec8bc4c8ccca7e835b8e4873a8f7728ffd95b8c90769fb8f96b827765ed40a5fa2bc63325b3e54bd51edb85e50e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAE62.tmp
MD5
c416c12d1b2b1da8c8655e393b544362

SHA1
fb1a43cd8e1c556c2d25f361f42a21293c29e447

SHA256
0600d59103840dff210778179fdfba904dcb737a4bfdb35384608698c86ea046

SHA512
cb6d3636be4330aa2fd577c3636d0b7165f92ee817e98f21180ba0c918eb76f4e38f025086593a0e508234ca981cfec2c53482b0e9cc0acfa885fefbdf89913c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD228.tmp.ps1
MD5
03ea9a201837d9f83648b8e2be75eb9f

SHA1
ef8f54b94d108e0dd6ad1ee0442a78b2dfd3b25c

SHA256
3e519f7854e76faf3d0248b2610928261b2dd5e3f06887bf2e944e964d26c8bf

SHA512
a4e0396e863afa64b83181022dcd5207ddc1905d0c7bf51c3e0c5b98f7f41dfe089a4448c118f875877724992aec7882d2901bb67d19bd00e94ee65d483c18eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD229.tmp
MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
\Users\Admin\AppData\Local\Temp\SECURI~1.TMP
MD5
c92a53cc671aa0e174d0697f7b6e35e9

SHA1
a2dd513e7988b2e2d56b4bede0840093ad2ac4bb

SHA256
aaf22f0fb83992b924ada07e7f7353c8cda6a208330aefc1e5127fcccc9e2aea

SHA512
e158f8318b2715a8176d15b5778632c99fbea5217f5921ce9da2737e3f63049c75a1982577c65f938b4dd62b853adbee80d0af0251dceae3f395a6ec87602e8d

Download Submit
memory/392-189-0x0000000000000000-mapping.dmp

Download
memory/612-175-0x00000000081D0000-0x00000000081D1000-memory.dmp

Filesize
4KB

Download
memory/612-177-0x0000000006E12000-0x0000000006E13000-memory.dmp

Filesize
4KB

Download
memory/612-176-0x0000000006E10000-0x0000000006E11000-memory.dmp

Filesize
4KB

Download
memory/612-190-0x0000000006E13000-0x0000000006E14000-memory.dmp

Filesize
4KB

Download
memory/612-172-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/612-163-0x0000000000000000-mapping.dmp

Download
memory/652-116-0x0000000000400000-0x000000000097F000-memory.dmp

Filesize
5.5MB

Download
memory/652-115-0x0000000002870000-0x0000000002970000-memory.dmp

Filesize
1024KB

Download
memory/2156-191-0x0000000000000000-mapping.dmp

Download
memory/3180-131-0x0000000004900000-0x0000000005B96000-memory.dmp

Filesize
18.6MB

Download
memory/3180-132-0x0000000002C10000-0x0000000002C11000-memory.dmp

Filesize
4KB

Download
memory/3180-125-0x0000000000000000-mapping.dmp

Download
memory/3180-128-0x0000000002AB0000-0x0000000002C0E000-memory.dmp

Filesize
1.4MB

Download
memory/3316-186-0x0000000000000000-mapping.dmp

Download
memory/3840-130-0x0000000005080000-0x0000000006316000-memory.dmp

Filesize
18.6MB

Download
memory/3840-114-0x0000000000000000-mapping.dmp

Download
memory/3868-145-0x00000000081F0000-0x00000000081F1000-memory.dmp

Filesize
4KB

Download
memory/3868-140-0x0000000007200000-0x0000000007201000-memory.dmp

Filesize
4KB

Download
memory/3868-146-0x0000000008010000-0x0000000008011000-memory.dmp

Filesize
4KB

Download
memory/3868-162-0x00000000035A3000-0x00000000035A4000-memory.dmp

Filesize
4KB

Download
memory/3868-148-0x00000000081D0000-0x00000000081D1000-memory.dmp

Filesize
4KB

Download
memory/3868-144-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/3868-143-0x00000000035A2000-0x00000000035A3000-memory.dmp

Filesize
4KB

Download
memory/3868-142-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/3868-141-0x0000000007870000-0x0000000007871000-memory.dmp

Filesize
4KB

Download
memory/3868-159-0x00000000099C0000-0x00000000099C1000-memory.dmp

Filesize
4KB

Download
memory/3868-137-0x0000000000000000-mapping.dmp

Download
memory/3868-158-0x0000000009720000-0x0000000009721000-memory.dmp

Filesize
4KB

Download
memory/3868-157-0x000000000A180000-0x000000000A181000-memory.dmp

Filesize
4KB

Download
memory/3868-152-0x0000000007500000-0x0000000007501000-memory.dmp

Filesize
4KB

Download
memory/3868-147-0x00000000082D0000-0x00000000082D1000-memory.dmp

Filesize
4KB

Download
memory/3868-150-0x00000000089E0000-0x00000000089E1000-memory.dmp

Filesize
4KB

Download
memory/3868-149-0x0000000008B90000-0x0000000008B91000-memory.dmp

Filesize
4KB

Download