0c5aa4cd6c78c66cbb7e9489f249ec49b8566e5d947730cffd29a4627377d444

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe
Size

898KB
MD5

819494a0d10353aa9659b8fa8a339ea5
SHA1

853f9c388cdc541ce6631af3d4cd44dbe0c01a38
SHA256

0c5aa4cd6c78c66cbb7e9489f249ec49b8566e5d947730cffd29a4627377d444
SHA512

3b96458d967132268e8f97e74f0458ede8a04269ae75db3c14ca03a2322b1487845ac65abb86f3bc103d7410985a18e05108c16ee23992a21fc7a2c40616e710
SSDEEP

24576:VxGaFDpekdGp9Z1SlfscwzX0eCYRK+ILTfBLXSYo:Oau9nSSVkJ7+CK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp

Loads dropped DLL 10 IoCs

pid	Process
2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
1664	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28
PID 2984 wrote to memory of 1664	2984	819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\is-05NNV.tmp\819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-05NNV.tmp\819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp" /SL5="$40016,498928,146432,C:\Users\Admin\AppData\Local\Temp\819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Modifies system certificate store
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1929977cad4fb11b19af3d20f1356ee5

SHA1
f3547a7cf1acef14d7d7de94844ce62ab406f1da

SHA256
2d3fc7e43e37ac014609b0c58b052692b0c1912f751079cd57343bcc0a7b8efb

SHA512
111509df3c5d3ca6f3b415bfa8742991152238a4c54d2bfd8fcea3f417892efb977fdb44526a069ee9f452c4ee5cdaaf2073a203881b8c8b2c7d052c05fdb354

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\is-05NNV.tmp\819494a0d10353aa9659b8fa8a339ea5_JaffaCakes118.tmp

Filesize
1.1MB

MD5
53d53cb910b764c67c7bc5f46bfe38a2

SHA1
acb9ae29d4ab5857fe3c837bc8c571f0aadb3351

SHA256
f1c6a977297caf94eb3b07259116aa9412f5b2f11a48833104c5582f32f2b499

SHA512
dba598908f5123d2f45ef40c1619b827055bf4a49904024957008daeccd561b02d70fe95d8a3531e5dfbb290e7a9454d858c297d09fcbd48c151b11456099da9

Download Submit
\Users\Admin\AppData\Local\Temp\is-N9B4D.tmp\InnoSetupHelper.dll

Filesize
81KB

MD5
f0a34e1b4fcf7bf515c63dc4a8ebe349

SHA1
e7f254b30b3254850d95753005f16e9b3a82ce2a

SHA256
51f1c6b2f2fa40a645556f5be64eec7425e604406ef90573a5e9a0e9df7c8780

SHA512
0ba1af4131266a2fe29f0f48d918f1921b2de7e26d84624dc639cd8175c0a6397c23fb9bcab44d68fa8598e66b0373e01dd81a53e26a099ceaa4ae467fa81bb2

Download Submit
\Users\Admin\AppData\Local\Temp\is-N9B4D.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-N9B4D.tmp\cinshlpr.dll

Filesize
191KB

MD5
67a2873ab35dbcb4834d3b4582e99f11

SHA1
c72adfd291edb1c8b9931a158622b9c9ac3eb678

SHA256
530520fd9e20e3677df29943621a0c01acb995147169826bf175f88890b2ccae

SHA512
591d969dbc3763c9a28d01edea10d156893c6ec44ce6fe938a63a48f8481cb201e5cbe4a0b65adbeb2a9dd763034e1d224febd35f20ce34690d2c16aca944eb0

Download Submit
\Users\Admin\AppData\Local\Temp\is-N9B4D.tmp\innocallback.dll

Filesize
69KB

MD5
c161e8bee1e81d8d4f75ceb3a619f879

SHA1
5c1319bfe5529c93e371faa616dcbf32fc7b0aaa

SHA256
1ce3e9e0bdca3aef9b68a7672696c11ac493bd2153d013c92aa078006c8184de

SHA512
a6ac4418024b6e3bb2e490492ef9a2e0236a5a349cfcbb3256a646769dd9fdf144a2b1260cac42dda70c9cf98437dccb6ca0eb22548f2667ed6da906ecb861da

Download Submit
\Users\Admin\AppData\Local\Temp\is-N9B4D.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
\Users\Admin\AppData\Local\Temp\is-N9B4D.tmp\webbrowser.dll

Filesize
425KB

MD5
b576c4fdd6d0d3db25e2917ff3cd95a4

SHA1
3724f3708b4f8f76e9c8ff8c2f7bed70fc976d2d

SHA256
0ad1dc0094ad376eee23433b9416e8e1d7f6326a50c1f7bce5957f119ecc0e7e

SHA512
1a5e88a297b694dc7fe45756e5ef77abce5d1d45ef0a975f0278d8ce06cd32032ae34b62f436f83bc02463cab17802eca6bf1ab48930eceabdb3b72f45fbeefb

Download Submit
memory/1664-10-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1664-35-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1664-25-0x00000000005C0000-0x00000000005D5000-memory.dmp

Filesize
84KB

Download
memory/1664-21-0x0000000003160000-0x00000000031D0000-memory.dmp

Filesize
448KB

Download
memory/1664-152-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1664-153-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1664-158-0x00000000005C0000-0x00000000005D5000-memory.dmp

Filesize
84KB

Download
memory/1664-156-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1664-157-0x0000000003160000-0x00000000031D0000-memory.dmp

Filesize
448KB

Download
memory/2984-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2984-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2984-155-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download