Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 09:00

General

  • Target

    JaffaCakes118_c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92.exe

  • Size

    4.3MB

  • MD5

    10ba676ce3bb9fe9d94f6bfa33271d1d

  • SHA1

    052fc31dae5b8117ec51145d56196ac7702ab739

  • SHA256

    c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92

  • SHA512

    19d7a6621858e7ea83432a48b1bcb5a85c57c29db2e65325ab838e8139876c39726b82e4fa02b19f238e283d7386e69bea9923fb3a240f8cb195c530dded58c0

  • SSDEEP

    98304:OI3lU8qHdqa2fpMOusgXI9h76h2adjmiDl3EJXxfRiwR:OEE4a2usF7IkiDGXxfF

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba family
  • Glupteba payload 22 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3148
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:3364
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe /301-301
        3⤵
        • Executes dropped EXE
        • Manipulates WinMonFS driver.
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:948
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:3660
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3344
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 764
          3⤵
          • Program crash
          PID:3388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3452 -ip 3452
      1⤵
        PID:400

      Network

      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        140.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        trumops.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        trumops.com
        IN TXT
        Response
        trumops.com
        IN TXT
        .v=spf1 include:_incspfcheck.mailspike.net ?all
      • flag-us
        DNS
        retoti.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        retoti.com
        IN TXT
        Response
        retoti.com
        IN TXT
        .v=spf1 include:_incspfcheck.mailspike.net ?all
      • flag-us
        DNS
        logs.trumops.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        logs.trumops.com
        IN TXT
        Response
      • flag-us
        DNS
        logs.retoti.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        logs.retoti.com
        IN TXT
        Response
      • flag-us
        DNS
        5b19999c-bc36-4d7f-a7c9-f1c1e45cc469.uuid.trumops.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        5b19999c-bc36-4d7f-a7c9-f1c1e45cc469.uuid.trumops.com
        IN TXT
        Response
      • flag-us
        DNS
        server16.trumops.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        server16.trumops.com
        IN A
        Response
        server16.trumops.com
        IN A
        44.221.84.105
      • flag-us
        DNS
        105.84.221.44.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        105.84.221.44.in-addr.arpa
        IN PTR
        Response
        105.84.221.44.in-addr.arpa
        IN PTR
        ec2-44-221-84-105 compute-1 amazonawscom
      • flag-us
        DNS
        196.249.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.249.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        197.87.175.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        197.87.175.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.210.23.2.in-addr.arpa
        IN PTR
        Response
        88.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-88deploystaticakamaitechnologiescom
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        29.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        29.243.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        server16.retoti.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        server16.retoti.com
        IN A
        Response
        server16.retoti.com
        IN A
        44.221.84.105
      • flag-us
        DNS
        raw.githubusercontent.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        raw.githubusercontent.com
        IN A
        Response
        raw.githubusercontent.com
        IN A
        185.199.108.133
        raw.githubusercontent.com
        IN A
        185.199.109.133
        raw.githubusercontent.com
        IN A
        185.199.111.133
        raw.githubusercontent.com
        IN A
        185.199.110.133
      • flag-us
        DNS
        133.108.199.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.108.199.185.in-addr.arpa
        IN PTR
        Response
        133.108.199.185.in-addr.arpa
        IN PTR
        cdn-185-199-108-133githubcom
      • flag-us
        DNS
        blackie.c3-soft.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        blackie.c3-soft.com
        IN A
        Response
        blackie.c3-soft.com
        IN A
        208.88.16.38
      • flag-us
        DNS
        electrum.bitaroo.net
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        electrum.bitaroo.net
        IN A
        Response
        electrum.bitaroo.net
        IN A
        168.119.33.233
      • flag-us
        DNS
        electrum.dcn.io
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        electrum.dcn.io
        IN A
        Response
        electrum.dcn.io
        IN CNAME
        www.dcn.io
        www.dcn.io
        IN A
        162.248.7.51
      • flag-us
        DNS
        233.33.119.168.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        233.33.119.168.in-addr.arpa
        IN PTR
        Response
        233.33.119.168.in-addr.arpa
        IN PTR
        static23333119168clients your-serverde
      • flag-us
        DNS
        electrum.hsmiths.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        electrum.hsmiths.com
        IN A
        Response
        electrum.hsmiths.com
        IN CNAME
        electrumhsmiths.hodlister.co
        electrumhsmiths.hodlister.co
        IN A
        45.154.252.104
      • flag-us
        DNS
        electrum5.hodlister.co
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        electrum5.hodlister.co
        IN A
        Response
        electrum5.hodlister.co
        IN A
        45.154.252.109
      • flag-us
        DNS
        ex.btcmp.com
        csrss.exe
        Remote address:
        8.8.8.8:53
        Request
        ex.btcmp.com
        IN A
        Response
        ex.btcmp.com
        IN A
        217.115.11.163
      • flag-us
        DNS
        109.252.154.45.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        109.252.154.45.in-addr.arpa
        IN PTR
        Response
        109.252.154.45.in-addr.arpa
        IN PTR
        electrumx-9electrumorg
      • 44.221.84.105:443
        server16.trumops.com
        tls
        csrss.exe
        14.6kB
        9.2kB
        30
        25
      • 44.221.84.105:443
        server16.trumops.com
        tls
        csrss.exe
        1.7kB
        4.9kB
        9
        8
      • 44.221.84.105:443
        server16.retoti.com
        tls
        csrss.exe
        1.6kB
        5.2kB
        8
        8
      • 185.199.108.133:443
        raw.githubusercontent.com
        tls
        csrss.exe
        1.1kB
        6.9kB
        11
        14
      • 159.65.53.177:50001
        csrss.exe
        156 B
        3
      • 208.88.16.38:57001
        blackie.c3-soft.com
        csrss.exe
        260 B
        200 B
        5
        5
      • 168.119.33.233:50001
        electrum.bitaroo.net
        csrss.exe
        485 B
        11.5kB
        9
        12
      • 162.248.7.51:50001
        electrum.dcn.io
        csrss.exe
        208 B
        160 B
        4
        4
      • 45.154.252.104:50001
        electrum.hsmiths.com
        csrss.exe
        260 B
        200 B
        5
        5
      • 45.154.252.109:50002
        electrum5.hodlister.co
        tls
        csrss.exe
        959 B
        4.1kB
        11
        9
      • 217.115.11.163:50002
        ex.btcmp.com
        csrss.exe
        104 B
        80 B
        2
        2
      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        140.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        140.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        trumops.com
        dns
        csrss.exe
        57 B
        116 B
        1
        1

        DNS Request

        trumops.com

      • 8.8.8.8:53
        retoti.com
        dns
        csrss.exe
        56 B
        115 B
        1
        1

        DNS Request

        retoti.com

      • 8.8.8.8:53
        logs.trumops.com
        dns
        csrss.exe
        62 B
        121 B
        1
        1

        DNS Request

        logs.trumops.com

      • 8.8.8.8:53
        logs.retoti.com
        dns
        csrss.exe
        61 B
        120 B
        1
        1

        DNS Request

        logs.retoti.com

      • 8.8.8.8:53
        5b19999c-bc36-4d7f-a7c9-f1c1e45cc469.uuid.trumops.com
        dns
        csrss.exe
        99 B
        158 B
        1
        1

        DNS Request

        5b19999c-bc36-4d7f-a7c9-f1c1e45cc469.uuid.trumops.com

      • 8.8.8.8:53
        server16.trumops.com
        dns
        csrss.exe
        66 B
        82 B
        1
        1

        DNS Request

        server16.trumops.com

        DNS Response

        44.221.84.105

      • 8.8.8.8:53
        105.84.221.44.in-addr.arpa
        dns
        72 B
        127 B
        1
        1

        DNS Request

        105.84.221.44.in-addr.arpa

      • 8.8.8.8:53
        196.249.167.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        196.249.167.52.in-addr.arpa

      • 8.8.8.8:53
        197.87.175.4.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        197.87.175.4.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        88.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        88.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        29.243.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        29.243.111.52.in-addr.arpa

      • 8.8.8.8:53
        server16.retoti.com
        dns
        csrss.exe
        65 B
        81 B
        1
        1

        DNS Request

        server16.retoti.com

        DNS Response

        44.221.84.105

      • 8.8.8.8:53
        raw.githubusercontent.com
        dns
        csrss.exe
        71 B
        135 B
        1
        1

        DNS Request

        raw.githubusercontent.com

        DNS Response

        185.199.108.133
        185.199.109.133
        185.199.111.133
        185.199.110.133

      • 8.8.8.8:53
        133.108.199.185.in-addr.arpa
        dns
        74 B
        118 B
        1
        1

        DNS Request

        133.108.199.185.in-addr.arpa

      • 8.8.8.8:53
        blackie.c3-soft.com
        dns
        csrss.exe
        65 B
        81 B
        1
        1

        DNS Request

        blackie.c3-soft.com

        DNS Response

        208.88.16.38

      • 8.8.8.8:53
        electrum.bitaroo.net
        dns
        csrss.exe
        66 B
        82 B
        1
        1

        DNS Request

        electrum.bitaroo.net

        DNS Response

        168.119.33.233

      • 8.8.8.8:53
        electrum.dcn.io
        dns
        csrss.exe
        61 B
        95 B
        1
        1

        DNS Request

        electrum.dcn.io

        DNS Response

        162.248.7.51

      • 8.8.8.8:53
        233.33.119.168.in-addr.arpa
        dns
        73 B
        131 B
        1
        1

        DNS Request

        233.33.119.168.in-addr.arpa

      • 8.8.8.8:53
        electrum.hsmiths.com
        dns
        csrss.exe
        66 B
        124 B
        1
        1

        DNS Request

        electrum.hsmiths.com

        DNS Response

        45.154.252.104

      • 8.8.8.8:53
        electrum5.hodlister.co
        dns
        csrss.exe
        68 B
        84 B
        1
        1

        DNS Request

        electrum5.hodlister.co

        DNS Response

        45.154.252.109

      • 8.8.8.8:53
        ex.btcmp.com
        dns
        csrss.exe
        58 B
        74 B
        1
        1

        DNS Request

        ex.btcmp.com

        DNS Response

        217.115.11.163

      • 8.8.8.8:53
        109.252.154.45.in-addr.arpa
        dns
        73 B
        111 B
        1
        1

        DNS Request

        109.252.154.45.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

        Filesize

        281KB

        MD5

        d98e33b66343e7c96158444127a117f6

        SHA1

        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

        SHA256

        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

        SHA512

        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

      • C:\Windows\rss\csrss.exe

        Filesize

        4.3MB

        MD5

        10ba676ce3bb9fe9d94f6bfa33271d1d

        SHA1

        052fc31dae5b8117ec51145d56196ac7702ab739

        SHA256

        c8483e8e4c6269ca0ed0c8ad7a38530ae9571a37eadc746cfb3ad7df6af67f92

        SHA512

        19d7a6621858e7ea83432a48b1bcb5a85c57c29db2e65325ab838e8139876c39726b82e4fa02b19f238e283d7386e69bea9923fb3a240f8cb195c530dded58c0

      • memory/3148-2-0x0000000004980000-0x0000000005222000-memory.dmp

        Filesize

        8.6MB

      • memory/3148-3-0x0000000000400000-0x0000000000CBD000-memory.dmp

        Filesize

        8.7MB

      • memory/3148-6-0x0000000000400000-0x0000000000CBD000-memory.dmp

        Filesize

        8.7MB

      • memory/3148-5-0x0000000004980000-0x0000000005222000-memory.dmp

        Filesize

        8.6MB

      • memory/3148-4-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/3148-1-0x0000000004560000-0x0000000004978000-memory.dmp

        Filesize

        4.1MB

      • memory/3452-8-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/3452-9-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/3452-16-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/3452-10-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-28-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-30-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-25-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-26-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-27-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-18-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-29-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-24-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-31-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-32-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-33-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-34-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-35-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      • memory/5060-36-0x0000000000400000-0x00000000027AA000-memory.dmp

        Filesize

        35.7MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.