Analysis
- max time kernel
300s - max time network
304s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
29/07/2024, 05:01
General
- Target 15ed705f5209b09b1933020a8454b9146d4647ba607834b67e9215f103f74692.exe
- Size 1.8MB
- Sample240729-fnjzjaybmg
- SHA256 15ed705f5209b09b1933020a8454b9146d4647ba607834b67e9215f103f74692
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
20.52.165.210:39030
Extracted
-
stealc
-
QLL
-
http://85.28.47.70
-
url_path
/744f169d372be841.php
Extracted
-
redline
-
25072023
-
185.215.113.67:40960
Extracted
-
redline
-
Logs
-
185.215.113.9:9137
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detects Monster Stealer. 2 IoCs
- Monster
Monster is a Golang stealer that was discovered in 2024.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
- Downloads MZ/PE file
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 2 IoCs
- Executes dropped EXE 22 IoCs
- Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 2 IoCs
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 8 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\15ed705f5209b09b1933020a8454b9146d4647ba607834b67e9215f103f74692.exe"C:\Users\Admin\AppData\Local\Temp\15ed705f5209b09b1933020a8454b9146d4647ba607834b67e9215f103f74692.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_648_133667029033215879\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000003001\5447jsX.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\5447jsX.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Iyy0xD5xky.exe"C:\Users\Admin\AppData\Roaming\Iyy0xD5xky.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\aEZXdHq4Ie.exe"C:\Users\Admin\AppData\Roaming\aEZXdHq4Ie.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 4885⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI52322\Blsvr.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI52322\Blsvr.exeC:\Users\Admin\AppData\Local\Temp\_MEI52322\Blsvr.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
build.exe
crypted.exe
5447jsX.exe
crypteda.exe
2.exe
25072023.exe
pered.exe
2020.exe
buildred.exe
Authenticator.exe
axplong.exe
_bz2.pyd
_ctypes.pyd
_overlapped.pyd
_ssl.pyd
_helpers.pyd
_http_parser.pyd
_websocket.pyd
_rust.pyd
libffi-7.dll
libssl-1_1.dll
sqlite3.dll
unicodedata.pyd
Tmp1D76.tmp
VCRUNTIME140.dll
python310.dll
stub.exe
_asyncio.pyd
_cffi_backend.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_sqlite3.pyd
_http_writer.pyd
libcrypto-1_1.dll
_multidict.pyd
select.pyd
_quoting_c.pyd
python3.dll
memory/648-202-0x00007FF682090000-0x00007FF682B68000-memory.dmp
memory/648-254-0x00007FF682090000-0x00007FF682B68000-memory.dmp
memory/820-201-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-309-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-15-0x00000000000D1000-0x00000000000FF000-memory.dmp
memory/820-16-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-297-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-14-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-30-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-17-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-1674-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-1665-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-1661-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-381-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/820-18-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/872-214-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/872-203-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/876-292-0x0000000005FB0000-0x0000000006026000-memory.dmp
memory/876-295-0x0000000006870000-0x000000000688E000-memory.dmp
memory/876-253-0x0000000000B70000-0x0000000000BC2000-memory.dmp
memory/1360-175-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1360-149-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1360-152-0x0000000000400000-0x0000000000643000-memory.dmp
memory/1860-298-0x0000000000400000-0x000000000282D000-memory.dmp
memory/2112-294-0x0000000000FA0000-0x0000000001024000-memory.dmp
memory/2320-1843-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/2320-1845-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/4656-293-0x0000000000AD0000-0x0000000000B56000-memory.dmp
memory/4696-1872-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/4696-1870-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/4720-304-0x0000000005E00000-0x0000000005E50000-memory.dmp
memory/4720-174-0x0000000007B20000-0x0000000007B5E000-memory.dmp
memory/4720-151-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/4720-246-0x0000000008680000-0x00000000086E6000-memory.dmp
memory/4720-148-0x00000000053B0000-0x00000000058AE000-memory.dmp
memory/4720-93-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4720-165-0x00000000050F0000-0x00000000050FA000-memory.dmp
memory/4720-171-0x0000000006350000-0x0000000006956000-memory.dmp
memory/4720-172-0x0000000007BB0000-0x0000000007CBA000-memory.dmp
memory/4720-173-0x0000000007AC0000-0x0000000007AD2000-memory.dmp
memory/4720-307-0x0000000008B00000-0x0000000008CC2000-memory.dmp
memory/4720-308-0x0000000009200000-0x000000000972C000-memory.dmp
memory/4720-193-0x0000000007B60000-0x0000000007BAB000-memory.dmp
memory/4740-2-0x0000000000B51000-0x0000000000B7F000-memory.dmp
memory/4740-1-0x0000000077C34000-0x0000000077C35000-memory.dmp
memory/4740-13-0x0000000000B50000-0x000000000100B000-memory.dmp
memory/4740-4-0x0000000000B50000-0x000000000100B000-memory.dmp
memory/4740-3-0x0000000000B50000-0x000000000100B000-memory.dmp
memory/4740-0-0x0000000000B50000-0x000000000100B000-memory.dmp
memory/4760-289-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4760-228-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4760-229-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4760-226-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4760-225-0x0000000000400000-0x0000000000536000-memory.dmp
memory/4860-192-0x00007FF60A100000-0x00007FF60B33E000-memory.dmp
memory/5116-414-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-424-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-404-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-402-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-401-0x000002404F7A0000-0x000002404F7A1000-memory.dmp
memory/5116-408-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-410-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-412-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-416-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-418-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-428-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-426-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-406-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-422-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5116-420-0x000002404F7B0000-0x000002404F7B1000-memory.dmp
memory/5344-1740-0x0000000007000000-0x000000000704B000-memory.dmp
memory/5344-1722-0x0000000000F50000-0x0000000000FA2000-memory.dmp
memory/5792-1750-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/5792-1748-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/5892-1897-0x00000000000D0000-0x000000000058B000-memory.dmp
memory/5892-1899-0x00000000000D0000-0x000000000058B000-memory.dmp