Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/10/2026, 15:36
General
- Target Nuevo pedido de mercancías adjuntas.exe
- Size 767KB
- Sample261028-s17btad17k
- SHA256 28dcad782b408d7847f2e9bab490fbb17e3adb7a2632b0e4fe5da498bd24b77e
Malware Config
Extracted
-
xworm
-
5.0
-
vallxx.duckdns.org:4689
-
LZBDpGU2NGqFwoUo
-
install_file
USB.exe
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.brightlearning.com.my
-
Port
21
-
Username
-
Password
,Aept[$)OmwWgF+Y
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nuevo pedido de mercancías adjuntas.exe"C:\Users\Admin\AppData\Local\Temp\Nuevo pedido de mercancías adjuntas.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pcjpeb.exe"C:\Users\Admin\AppData\Local\Temp\pcjpeb.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\tzxkrr.exe"C:\Users\Admin\AppData\Local\Temp\tzxkrr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\uqwbji.exe"C:\Users\Admin\AppData\Local\Temp\uqwbji.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_6a0a7a27b9414acc87c76f756f3940ba.cs"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CCE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1533C05145C442478CE8506467C0EF25.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" 27963⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_847080fde9234769a183db74cef48130.cs"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5C0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC92FBF7CA7C9A4B1888EC5BD3AB14B4C.TMP"4⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kll5fot2exc\qzlkyddllkp.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kll5fot2exc\bc23rgnhwl5.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f2sce4ju\f2sce4ju.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF510.tmp" "c:\Users\Admin\AppData\Local\Temp\f2sce4ju\CSCCF88CC6299BC47FE9423505FE7DD2FCD.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kll5fot2exc\bc23rgnhwl5.exe"C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kll5fot2exc\bc23rgnhwl5.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kll5fot2exc\bc23rgnhwl5.exe"C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kll5fot2exc\bc23rgnhwl5.exe"5⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe6⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe6⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bc23rgnhwl5.exe
qzlkyddllkp.ps1
RES9CCE.tmp
RESD5C0.tmp
RESF510.tmp
RegAsm.exe
XXALLFILESXX.zip
_chacha20.pyd
_raw_aes.pyd
_raw_aesni.pyd
_BLAKE2s.pyd
_ghash_clmul.pyd
_ghash_portable.pyd
_poly1305.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_socket.pyd
_sqlite3.pyd
_wmi.pyd
base_library.zip
libffi-8.dll
python313.dll
select.pyd
sqlite3.dll
__PSScriptPolicyTest_lhhwrgiw.cod.ps1
f2sce4ju.dll
pcjpeb.exe
tzxkrr.exe
uqwbji.exe
CSC1533C05145C442478CE8506467C0EF25.TMP
CSCCF88CC6299BC47FE9423505FE7DD2FCD.TMP
f2sce4ju.0.cs
f2sce4ju.cmdline
guardian_src_6a0a7a27b9414acc87c76f756f3940ba.cs
memory/240-1707-0x00007FFB15080000-0x00007FFB151FF000-memory.dmp
memory/240-1739-0x00007FFB15080000-0x00007FFB151FF000-memory.dmp
memory/240-1734-0x00007FFB2AE90000-0x00007FFB2AEBB000-memory.dmp
memory/240-1735-0x00007FFB2AE80000-0x00007FFB2AE8F000-memory.dmp
memory/240-1736-0x00007FFB2AD60000-0x00007FFB2AD79000-memory.dmp
memory/240-1737-0x00007FFB2AD50000-0x00007FFB2AD5D000-memory.dmp
memory/240-1738-0x00007FFB2AD20000-0x00007FFB2AD45000-memory.dmp
memory/240-1731-0x00007FFB2B270000-0x00007FFB2B297000-memory.dmp
memory/240-1732-0x00007FFB2B240000-0x00007FFB2B24F000-memory.dmp
memory/240-1677-0x00007FFB15080000-0x00007FFB151FF000-memory.dmp
memory/240-1708-0x00007FFB2AC80000-0x00007FFB2AC8B000-memory.dmp
memory/240-1709-0x00007FFB2AC70000-0x00007FFB2AC7C000-memory.dmp
memory/240-1675-0x00007FFB2AD20000-0x00007FFB2AD45000-memory.dmp
memory/240-1706-0x00007FFB2AC90000-0x00007FFB2AC9B000-memory.dmp
memory/240-1703-0x00007FFB2ACA0000-0x00007FFB2ACAB000-memory.dmp
memory/240-1702-0x00007FFB2AD50000-0x00007FFB2AD5D000-memory.dmp
memory/240-1689-0x00007FFB2ACE0000-0x00007FFB2ACEC000-memory.dmp
memory/240-1698-0x00007FFB2ACB0000-0x00007FFB2ACBC000-memory.dmp
memory/240-1695-0x00007FFB2AE90000-0x00007FFB2AEBB000-memory.dmp
memory/240-1696-0x00007FFB2ACC0000-0x00007FFB2ACCC000-memory.dmp
memory/240-1692-0x00007FFB2ACD0000-0x00007FFB2ACDC000-memory.dmp
memory/240-1685-0x00007FFB2B270000-0x00007FFB2B297000-memory.dmp
memory/240-1686-0x00007FFB2ACF0000-0x00007FFB2AD02000-memory.dmp
memory/240-1682-0x00007FFB2AD10000-0x00007FFB2AD1B000-memory.dmp
memory/240-1733-0x00007FFB2B220000-0x00007FFB2B239000-memory.dmp
memory/240-1681-0x00007FFB0F440000-0x00007FFB0FAA4000-memory.dmp
memory/240-1705-0x00007FFB2AD20000-0x00007FFB2AD45000-memory.dmp
memory/240-1671-0x00007FFB2AD50000-0x00007FFB2AD5D000-memory.dmp
memory/240-1669-0x00007FFB2AD60000-0x00007FFB2AD79000-memory.dmp
memory/240-1658-0x00007FFB2B220000-0x00007FFB2B239000-memory.dmp
memory/240-1665-0x00007FFB2AE80000-0x00007FFB2AE8F000-memory.dmp
memory/240-1660-0x00007FFB2AE90000-0x00007FFB2AEBB000-memory.dmp
memory/240-1654-0x00007FFB2B240000-0x00007FFB2B24F000-memory.dmp
memory/240-1652-0x00007FFB2B270000-0x00007FFB2B297000-memory.dmp
memory/240-1647-0x00007FFB0F440000-0x00007FFB0FAA4000-memory.dmp
memory/240-1730-0x00007FFB0F440000-0x00007FFB0FAA4000-memory.dmp
memory/240-1742-0x00007FFB2ACE0000-0x00007FFB2ACEC000-memory.dmp
memory/240-1741-0x00007FFB2ACF0000-0x00007FFB2AD02000-memory.dmp
memory/240-1740-0x00007FFB2AD10000-0x00007FFB2AD1B000-memory.dmp
memory/2408-863-0x0000000000190000-0x0000000000198000-memory.dmp
memory/2652-850-0x0000000000CF0000-0x0000000000E04000-memory.dmp
memory/2652-1526-0x00000000097E0000-0x0000000009B3B000-memory.dmp
memory/2796-815-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2796-833-0x0000000008910000-0x000000000898C000-memory.dmp
memory/2796-1531-0x0000000008D40000-0x0000000009798000-memory.dmp
memory/2796-809-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2796-1530-0x0000000014870000-0x00000000156AC000-memory.dmp
memory/2796-812-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2796-813-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2796-814-0x00000000060B0000-0x0000000006116000-memory.dmp
memory/2796-810-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2796-852-0x0000000007350000-0x0000000007358000-memory.dmp
memory/2880-1542-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2880-1528-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2880-827-0x0000000004E00000-0x0000000004E32000-memory.dmp
memory/2880-828-0x00000000027A0000-0x00000000027C6000-memory.dmp
memory/2880-829-0x0000000004E90000-0x0000000004EB8000-memory.dmp
memory/2880-830-0x00000000027E0000-0x00000000027E8000-memory.dmp
memory/2880-825-0x00000000003F0000-0x00000000004A6000-memory.dmp
memory/2880-826-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/2880-1539-0x0000000005110000-0x0000000005118000-memory.dmp
memory/2880-1529-0x0000000004EF0000-0x0000000004F0A000-memory.dmp
memory/4664-5-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/4664-71-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-807-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-806-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-105-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-107-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-677-0x00000000099A0000-0x00000000099CA000-memory.dmp
memory/4664-676-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-64-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-101-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-59-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-675-0x0000000074F02000-0x0000000074F03000-memory.dmp
memory/4664-8-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-109-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-0-0x0000000074F02000-0x0000000074F03000-memory.dmp
memory/4664-99-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-1-0x00000000003C0000-0x0000000000486000-memory.dmp
memory/4664-97-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-13-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-95-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-93-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-91-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-111-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-87-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-83-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-113-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-77-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-75-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-45-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-49-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-9-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-115-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-73-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-117-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-81-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-69-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-119-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-121-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-670-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-57-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-671-0x0000000008E60000-0x00000000091BB000-memory.dmp
memory/4664-672-0x0000000008DB0000-0x0000000008DD2000-memory.dmp
memory/4664-61-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-65-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-674-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-79-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-673-0x0000000008E00000-0x0000000008E1A000-memory.dmp
memory/4664-123-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-67-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-811-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-4-0x0000000004FE0000-0x000000000507C000-memory.dmp
memory/4664-127-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-129-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-133-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-85-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-89-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-131-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-15-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-42-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-17-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-39-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-19-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-11-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-21-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-23-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-25-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-7-0x0000000008B20000-0x0000000008B86000-memory.dmp
memory/4664-27-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-6-0x0000000074EF0000-0x00000000756AC000-memory.dmp
memory/4664-103-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-29-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-31-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-33-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-35-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-125-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-3-0x0000000004EB0000-0x0000000004F42000-memory.dmp
memory/4664-2-0x00000000055A0000-0x0000000005B5A000-memory.dmp
memory/4664-38-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-43-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-47-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-51-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-53-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4664-55-0x0000000008B20000-0x0000000008BA4000-memory.dmp
memory/4876-851-0x0000000000080000-0x00000000000C0000-memory.dmp
memory/4876-1527-0x0000000005AD0000-0x0000000005B20000-memory.dmp
memory/4948-1545-0x00000000054D0000-0x000000000562A000-memory.dmp
memory/4948-1544-0x0000000002D70000-0x0000000002D8A000-memory.dmp
memory/4948-1543-0x0000000000890000-0x00000000008D0000-memory.dmp
memory/5316-1575-0x0000000006E10000-0x0000000006EA6000-memory.dmp
memory/5316-1576-0x0000000006D30000-0x0000000006D52000-memory.dmp
memory/5316-1574-0x00000000060F0000-0x00000000060F8000-memory.dmp
memory/5316-1560-0x0000000007490000-0x0000000007B0C000-memory.dmp
memory/5316-1561-0x0000000006020000-0x000000000603A000-memory.dmp
memory/5316-1558-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/5316-1557-0x0000000005B00000-0x0000000005B1E000-memory.dmp
memory/5316-1550-0x00000000055A0000-0x0000000005606000-memory.dmp
memory/5316-1549-0x0000000004EB0000-0x00000000054FA000-memory.dmp
memory/5316-1548-0x00000000022C0000-0x00000000022F6000-memory.dmp