Overview

overview

10

Static

static

10

2026-09-27...lc.exe

windows10-2004-x64

10

2026-09-27...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 09:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc.exe
  • Size 280KB
  • Sample260928-le22msaa59
  • SHA256 7df989268942cdecd5492c47ac4c81c5dc7f767c62c9449591b740e239946744
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasionevasionexecutionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs
    defense_evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs
    ransomwareevasion
  • Renames multiple (82) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops desktop.ini file(s) 10 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Modifies Security services 2 TTPs 2 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 20 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 56 IoCs
  • Executes a command shell one-liner 1 TTPs 19 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 35 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 54 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Modifies Security services
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1680
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cmd.exe /c del /s /q %USERPROFILE%\Documents\* >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\system32\cmd.exe
        cmd.exe /c del /s /q C:\Users\Admin\Documents\*
        3⤵
          PID:892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c calc.exe
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5916
        • C:\Windows\system32\calc.exe
          calc.exe
          3⤵
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Windows\System32\win32calc.exe
            "C:\Windows\System32\win32calc.exe"
            4⤵
              PID:3748
        • C:\Windows\system32\wermgr.exe
          "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1680" "860" "648" "844" "0" "0" "868" "820" "0" "0" "0" "0"
          2⤵
            PID:1820
          • C:\Windows\system32\wermgr.exe
            "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1680" "844" "548" "872" "0" "0" "852" "856" "0" "0" "0" "0"
            2⤵
              PID:2392
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cmd.exe /c del /s /q %USERPROFILE%\Documents\* >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4216
              • C:\Windows\system32\cmd.exe
                cmd.exe /c del /s /q C:\Users\Admin\Documents\*
                3⤵
                  PID:5968
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c notepad.exe
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:1608
                • C:\Windows\system32\notepad.exe
                  notepad.exe
                  3⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:5088
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} device partition=C: >nul 2>&1
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4844
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {bootmgr} device partition=C:
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:4144
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no >nul 2>&1
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:764
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} recoveryenabled no
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:3832
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} osdevice >nul 2>&1
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4224
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /deletevalue {default} osdevice
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:5476
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} device >nul 2>&1
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:2288
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /deletevalue {default} device
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1052
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} path \Windows\System32\nonexistent.exe >nul 2>&1
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4472
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} path \Windows\System32\nonexistent.exe
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:4836
            • C:\Windows\system32\dwm.exe
              "dwm.exe"
              1⤵
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2828
            • C:\Users\Admin\AppData\Local\Temp\2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc.exe
              C:\Users\Admin\AppData\Local\Temp\2026-09-27_02d704a59f18440660197cab23026636_cobalt-strike_icedid_stealc.exe
              1⤵
              • Modifies WinLogon for persistence
              • Modifies Windows Defender DisableAntiSpyware settings
              • Modifies Windows Defender Real-time Protection settings
              • Adds Run key to start application
              • Modifies Security services
              • Writes to the Master Boot Record (MBR)
              • Drops file in System32 directory
              • Sets desktop wallpaper using registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4240
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c msconfig.exe
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3944
                • C:\Windows\system32\msconfig.exe
                  msconfig.exe
                  3⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:2212
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c taskmgr.exe
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:2988
                • C:\Windows\system32\Taskmgr.exe
                  taskmgr.exe
                  3⤵
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:5540
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c notepad.exe
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4584
                • C:\Windows\notepad.exe
                  notepad.exe
                  3⤵
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:1108
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cmd.exe /c assoc >nul 2>&1
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4204
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c assoc
                  3⤵
                  • Executes a command shell one-liner
                  PID:4076
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c calc.exe
                2⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4664
                • C:\Windows\system32\calc.exe
                  calc.exe
                  3⤵
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:5100
                  • C:\Windows\System32\win32calc.exe
                    "C:\Windows\System32\win32calc.exe"
                    4⤵
                      PID:1028
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c mspaint.exe
                  2⤵
                  • Executes a command shell one-liner
                  PID:3532
                  • C:\Windows\system32\mspaint.exe
                    mspaint.exe
                    3⤵
                      PID:5284
                  • C:\Windows\system32\wermgr.exe
                    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4240" "576" "676" "568" "0" "0" "540" "560" "0" "0" "0" "0"
                    2⤵
                      PID:1244
                    • C:\Windows\system32\wermgr.exe
                      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4240" "860" "728" "576" "0" "0" "876" "836" "0" "0" "0" "0"
                      2⤵
                        PID:4600
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} device partition=C: >nul 2>&1
                        2⤵
                        • Executes a command shell one-liner
                        PID:5528
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {bootmgr} device partition=C:
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1404
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no >nul 2>&1
                        2⤵
                        • Executes a command shell one-liner
                        PID:3224
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} recoveryenabled no
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1408
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} osdevice >nul 2>&1
                        2⤵
                        • Executes a command shell one-liner
                        PID:4740
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /deletevalue {default} osdevice
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1088
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} device >nul 2>&1
                        2⤵
                        • Executes a command shell one-liner
                        PID:256
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /deletevalue {default} device
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1108
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c bcdedit /set {default} path \Windows\System32\nonexistent.exe >nul 2>&1
                        2⤵
                        • Executes a command shell one-liner
                        PID:2944
                        • C:\Windows\system32\bcdedit.exe
                          bcdedit /set {default} path \Windows\System32\nonexistent.exe
                          3⤵
                          • Modifies boot configuration data using bcdedit
                          PID:2072
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2608
                      • C:\Windows\system32\dwm.exe
                        "dwm.exe"
                        1⤵
                        • Checks SCSI registry key(s)
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5992
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1664
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                        1⤵
                          PID:2664
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                          1⤵
                            PID:1660
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                            1⤵
                            • Checks SCSI registry key(s)
                            PID:4928
                          • C:\Windows\system32\AUDIODG.EXE
                            C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x000000000000048C
                            1⤵
                              PID:1100
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                              1⤵
                                PID:1464
                              • C:\Windows\System32\ShellHost.exe
                                "C:\Windows\System32\ShellHost.exe"
                                1⤵
                                  PID:1692
                                • C:\Windows\system32\dwm.exe
                                  "dwm.exe"
                                  1⤵
                                  • Checks SCSI registry key(s)
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4636
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:840
                                  • C:\Windows\system32\dwm.exe
                                    "dwm.exe"
                                    1⤵
                                      PID:4592
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4480

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            Windows Command Shell

                                            1
                                            T1059.003

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Winlogon Helper DLL

                                            1
                                            T1547.004

                                            Create or Modify System Process

                                            2
                                            T1543

                                            Windows Service

                                            2
                                            T1543.003

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Winlogon Helper DLL

                                            1
                                            T1547.004

                                            Create or Modify System Process

                                            2
                                            T1543

                                            Windows Service

                                            2
                                            T1543.003

                                            Defense Evasion

                                            Impair Defenses

                                            3
                                            T1562

                                            Disable or Modify Tools

                                            2
                                            T1562.001

                                            Indicator Removal

                                            1
                                            T1070

                                            File Deletion

                                            1
                                            T1070.004

                                            Modify Registry

                                            7
                                            T1112

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Credential Access

                                            Discovery

                                            Peripheral Device Discovery

                                            1
                                            T1120

                                            Query Registry

                                            1
                                            T1012

                                            System Information Discovery

                                            1
                                            T1082

                                            Lateral Movement

                                            Collection

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Defacement

                                            1
                                            T1491

                                            Inhibit System Recovery

                                            1
                                            T1490

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            desktop.ini
                                            • Path C:\$Recycle.Bin\S-1-5-21-53044966-3830981193-2402648431-1000\desktop.ini
                                            • Size 129B
                                            • SHA256 0f6801dd51c46580a540ee6d297a3e4f9ce3cc2faa5a30b7a4b667a6ba76dd31
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            start2.bin
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
                                            • Size 3KB
                                            • SHA256 9252712e14be971bdde8bfd683f877fff90c36f350eb84b600c7e973224834ab
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            TileCache_100_3_PNGEncoded_Header.bin
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_3_PNGEncoded_Header.bin
                                            • Size 10KB
                                            • SHA256 268d245a283495323ca36dcf9b244e599909b29f92eb4302a967d33abfdf42c4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 607B
                                            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 595B
                                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 603B
                                            • SHA256 b7b24070b727abf4ec727ac789912c80dde8beeef4b6d6f1cd0811244932936a
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            bootmgr
                                            • Path C:\bootmgr
                                            • Size 4KB
                                            • SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            memory/5540-180-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-175-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-176-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-178-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-179-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-177-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-169-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download

                                            memory/5540-171-0x000001B352840000-0x000001B352841000-memory.dmp
                                            Download