8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 196KB
Sample260819-vt1a2ayfre
SHA256 8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931
MD5 b8dc2090fb85701448b75ecba9a759aa
SHA1 57aba1de9b2973e01bc1fc5562f7b9f89336c3a9
SHA512 c189f2f32134c29096456676a34a27f01f42216cee5d890e3e3df1e1bd2c76fdeef92faaabd3b227a3eb5ee7422cbd9ad11b550f6ee58be49f379003f9e47a28
SSDEEP 6144:GD8A/ehUOqxaPB6WUSPbDddNSCpMW90KImQiXnhbsew:G4AwUOqxaPssvj
TLSH
T1D414385813AB897DD63D237EE0A1110507F46227C603E35E9EE5E4F95E2B313AB12B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --init"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" /setup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --wininit"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4544	cmd.exe
2832	cmd.exe
2924	cmd.exe
800	cmd.exe
2456	cmd.exe
3340	cmd.exe
1388	cmd.exe
3224	cmd.exe
3812	cmd.exe
676	cmd.exe
1572	cmd.exe
4176	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4788	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	WinLock.exe
4908	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	WinLock.exe
Token: SeDebugPrivilege	4788	taskkill.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4544	4908	WinLock.exe	100
PID 4908 wrote to memory of 4176	4908	WinLock.exe	101
PID 4908 wrote to memory of 1572	4908	WinLock.exe	102
PID 4908 wrote to memory of 800	4908	WinLock.exe	103
PID 4908 wrote to memory of 2924	4908	WinLock.exe	104
PID 4908 wrote to memory of 676	4908	WinLock.exe	105
PID 4908 wrote to memory of 4788	4908	WinLock.exe	106
PID 4176 wrote to memory of 864	4176	cmd.exe	116
PID 800 wrote to memory of 724	800	cmd.exe	118
PID 4544 wrote to memory of 4272	4544	cmd.exe	122
PID 2924 wrote to memory of 5032	2924	cmd.exe	123
PID 1572 wrote to memory of 2032	1572	cmd.exe	124
PID 676 wrote to memory of 5044	676	cmd.exe	125
PID 800 wrote to memory of 2228	800	cmd.exe	126
PID 4176 wrote to memory of 1216	4176	cmd.exe	127
PID 1572 wrote to memory of 1084	1572	cmd.exe	128
PID 676 wrote to memory of 3672	676	cmd.exe	129
PID 2924 wrote to memory of 5016	2924	cmd.exe	130
PID 4544 wrote to memory of 4396	4544	cmd.exe	131
PID 4908 wrote to memory of 2456	4908	WinLock.exe	141
PID 4908 wrote to memory of 3340	4908	WinLock.exe	142
PID 4908 wrote to memory of 2832	4908	WinLock.exe	143
PID 4908 wrote to memory of 3812	4908	WinLock.exe	144
PID 4908 wrote to memory of 3224	4908	WinLock.exe	145
PID 4908 wrote to memory of 1388	4908	WinLock.exe	147
PID 2456 wrote to memory of 3712	2456	cmd.exe	153
PID 3340 wrote to memory of 556	3340	cmd.exe	154
PID 2456 wrote to memory of 3780	2456	cmd.exe	155
PID 2832 wrote to memory of 4580	2832	cmd.exe	156
PID 1388 wrote to memory of 816	1388	cmd.exe	157
PID 3812 wrote to memory of 1948	3812	cmd.exe	158
PID 3812 wrote to memory of 4244	3812	cmd.exe	159
PID 3224 wrote to memory of 3400	3224	cmd.exe	160
PID 3340 wrote to memory of 1216	3340	cmd.exe	161
PID 3224 wrote to memory of 1812	3224	cmd.exe	162
PID 2832 wrote to memory of 3908	2832	cmd.exe	163
PID 1388 wrote to memory of 3464	1388	cmd.exe	164

Views/modifies file attributes 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1216	attrib.exe
556	attrib.exe
1216	attrib.exe
3464	attrib.exe
5032	attrib.exe
5044	attrib.exe
1084	attrib.exe
3672	attrib.exe
3712	attrib.exe
3400	attrib.exe
4244	attrib.exe
2032	attrib.exe
5016	attrib.exe
864	attrib.exe
4396	attrib.exe
3780	attrib.exe
4580	attrib.exe
816	attrib.exe
1948	attrib.exe
1812	attrib.exe
3908	attrib.exe
724	attrib.exe
4272	attrib.exe
2228	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4272
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:864
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2032
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:724
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5032
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5044
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3672
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:3712
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:3780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:556
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4580
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1948
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3400
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:816
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:3464

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --wininit
1⤵
PID:3356

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" /setup
1⤵
PID:3236

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --init
1⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinLock.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinLock.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 82B
SHA256 f70e49b46b2fff2d8ebd8fd87c5acd890190c8d079d6dcf300479ca831a8f38f
MD5 c35bf08be15b07794865ddd08183aa71
SHA1 e87cd30a0716b0689a7fe801ac2d3a7245af846a
SHA512 16249172870b55e0bd0e48cb7d0fefd09021eaa167ccab232bfb32539f775c296f3a6824c8482554942713f9cd8d6dbccc932b1c104de450fae3bd6598516485
TLSH
T10FA012052DA85545202211F33C32E18168BC984D200328500B10005700250C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 82B
SHA256 6a9887a5439bb5741efd74b1a80bab6b2fa593ba6cf07a152372e9bbebf72fba
MD5 a2fc28595fe0410559cf3b1e9e749437
SHA1 8131856717607b222b9b5832fa4d20758b80a30a
SHA512 913e0f55750a421f624078f5da100459a50771571c4f296c5012bf1c86d13eb3d220751e6ffcbdc64e2d61b03a2a2c75aac64ecc5c9565c2d517c2ac7961e0cb
TLSH
T15AA012042DB85546202311F33C32E141287C984D200328500B10005700250C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4908-0-0x0000000000CC0000-0x0000000000CF8000-memory.dmp

Download

memory/4908-1-0x000000001B860000-0x000000001B870000-memory.dmp

Download

memory/4908-19-0x000000001B860000-0x000000001B870000-memory.dmp

Download