hxxp://8ui0lafgkj[.]online/

Analysis

max time kernel
74s
max time network
79s
platform
windows10_x64
resource
win10-en-20210920
submitted
30-09-2021 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://8ui0lafgkj.online/
Sample

210930-sk7mmsaac2

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ipapi.co
15 ipapi.co
16 ipapi.co

flow	ioc
14	ipapi.co
15	ipapi.co
16	ipapi.co

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30914061"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2672698502"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c66ab60db6d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2661861236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "339796302"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30914061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339779708"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2661861236"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000db752b2b690ae638f1eb01f0bf8420bd6f4c68d5ae04b970c2c1e3f75ad95533000000000e80000000020000200000002db7f708d296f12b73cbab0a6a5c648a11fdf71a700163b227726bcc1e16f5932000000070c5a3ded5d7064a1b8e124c6fdffdf86f2a31785933e7eb8b80b5f9fbf38b5e4000000012d0b725d29904c63aad04e266b71272dfa4241b82e72dc82ee7dcc8142cab497233770d430cf8dab639330840c8dc39a9e04ea56a3be03308ccab3f13b816ce	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000003bc1a93c1334373633c2feab5c790e2bb2436a0e73a390e4631b73cf599eb171000000000e80000000020000200000008fb4b536c721b896182a3a504d984cb79e22ec8c13394c23eab7f5f5043124df20000000bd80167bcf0149d286d661b19d85eef338f2e892944e7ea91753f1f77325543f4000000023316c6226f8b556b13c2166bfb0607c1d66435f423118d5c142f511b979071cec13704611e368fbe8f3f4d123d77d85fb3c8d9c7297947fd203ea3196b07cf1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9F3A422-2200-11EC-AF2E-F210A7A01805} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\401u0sam5w.online\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30914061"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507f1bb40db6d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2085ac8e0db6d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "339828294"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d0000000002000000000010660000000100002000000091c3f8a434ba42ea2e82f98d0f99b0f43f947ab2dc2f1b842bbe19ad67fbd5c4000000000e8000000002000020000000f5822bbd8f4732c5baab5dad2d328a6752dd531770d8e6bed6febc59e7e32b5020000000a924f1d9c117f408a69e9225101dba6464f2fe8ee87e83f1c97b33e79d4a9b4c40000000e3ae8cafddb59e6d20b1a28216afad156aecbb903430a317c007dee4f187f5c7012dd6bc74f59f594748bb32bae32e758c093bf153b004e855037be6693da58e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DOMStorage\401u0sam5w.online	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2372 iexplore.exe

pid	process
2372	iexplore.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

IEXPLORE.EXE

description	pid	process
Token: SeShutdownPrivilege	2660	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2660	IEXPLORE.EXE
Token: SeShutdownPrivilege	2660	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2660	IEXPLORE.EXE
Token: SeShutdownPrivilege	2660	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2660	IEXPLORE.EXE
Token: SeShutdownPrivilege	2660	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2660	IEXPLORE.EXE
Token: SeShutdownPrivilege	2660	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2660	IEXPLORE.EXE
Token: SeShutdownPrivilege	2660	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2660	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2372 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2372 iexplore.exe
2372 iexplore.exe
2660 IEXPLORE.EXE
2660 IEXPLORE.EXE
2660 IEXPLORE.EXE
2660 IEXPLORE.EXE

pid	process
2372	iexplore.exe

pid	process
2372	iexplore.exe
2372	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2372 wrote to memory of 2660	2372	iexplore.exe	IEXPLORE.EXE
PID 2372 wrote to memory of 2660	2372	iexplore.exe	IEXPLORE.EXE
PID 2372 wrote to memory of 2660	2372	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://8ui0lafgkj.online/
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
MD5
a82ea341b092497dcd9ca799d103e663

SHA1
5ef4d50ecee035c99d5b347f6203d70fe1bb30f3

SHA256
016bb12b95c627a4524a2bd5abf18836070f5cd065925e64b8880d37774592bb

SHA512
55c202e2bd3640547d226774ef68900a28e00277b3235175d3d462d00b24092320dd738f303a8daec545de9159ea4d69a8d6a68016f981c53b28a0b85b7bd1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
d302a1fb716166b280c2accd4491966e

SHA1
9eff2394f8616a4567f3eb895747ddf81fa68207

SHA256
ce29369602f384184b8fc7be24fa322fe70da4590f73921eada2cf12774a4afc

SHA512
c2b90c30f558518426cd0135a06dfc7d1c986635a9effffa34af80a8adaf566002d17288409b838452510212f774f5b75f2772e4acc20d7b19ad6f99751dc9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
MD5
c2f9315e025039524fd6bd6f4115a730

SHA1
49649564167aa881a06f8f1cd3907aeb54a14faf

SHA256
81984c7c749b9d1ba9629d0975cd981654ad5b8142d7d73256000603e60b533f

SHA512
abbddf769e5c5960b5f35be73d93480e1a3c800b92f7ef49ba024b05e5192fd69101864a2fb17a59d37c4de31a8df1a10ff820d2a7d89b6e05a826f650824ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA
MD5
0ba177be5a1b55f073bdcfc9c330f411

SHA1
c017401eb9e1b4bd90f76a166fc97a6f2f42983b

SHA256
4015a7fc4d5758658b7ff5625de9ec36abc3e3fe9cf4389ebd57f5398915004b

SHA512
90699f2e39b5adb20edfdd92eeb5189e17d055c094f98431ade496104f4337535f1c00f5242412a5d30155fc842f24b3debf46572f1cfdf303458944becbc25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
f0ca6893bea0fd1fd002e6c8c714fafd

SHA1
482759e34a9af3dfdb6c1cb90e176e3d6ecef447

SHA256
83e8119b681817d6e9211bdad87ebee907494547908bc68359d130b0c20a4669

SHA512
e58b5889d49052dad2241ba04e2b0144261f922e55f9d3198963e4417d42dfef02d43fa06e7122f25665af701fb6b55f72a3cf20ee76b5cf31e8e8824ff3d787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
MD5
526043119ff501962c7d0af0b5b542d9

SHA1
a136ef09250c04471a35ed7aed25edf983ef04be

SHA256
5258ca8b42b4ca27bd04e8e7344d27c8acbe4ba83c8a151d086fa5218355d115

SHA512
79953a3d6a96af350d5c418d5b7182ab3a98b203c91043bce242d71693b789a51a39c74b1e2f03f28c9bb9a66ba6b6882e21d61ae49ba6d094d9b3d071a5cfe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\4N4IOKWB.cookie
MD5
b864699759d243306654ffeff909de0d

SHA1
aead4353250fed4c0a6915e09aa39af37ff65241

SHA256
4926117e97814a98ada28ba44b91e14d1fff9733c6f4e3d63c2b413fdf7fe82f

SHA512
24abb888428d23c026bc3cd5b63df916512c0ac8c8d2638e38045363ee97e1a17a27544f8439da5cc325f50bc2544b820fe825af9ee92dbd79ffc26239f57f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\FSQFF9J6.cookie
MD5
d0b7f2f41df4734b334fb5f50d8ce027

SHA1
92604a4fd1e2b2f8c213d2df6726d18cec529ed2

SHA256
34c3148a7221ac22d6b0c894ab187455c149e05b97b810d013b0fe4426235574

SHA512
e311ccaff4616271f991bdd5e16799b3a3dfb1cf14ca86cc09874d50714adcb3f3f701bfe4ff23b2c1942330058290780d2235dee2c3d175af03a93fa5fa32f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MFB3DYRV.cookie
MD5
c5f0bfc8dd4ee8e243eb0ba8eeda7d65

SHA1
e5466421ac9a70bf3bee16e05f23dd2d68b47718

SHA256
03ab7aa0be24abec50bbccdf2f99736c6368e4232258cf7423b0b61b09a064d2

SHA512
a38665f49cd26d87c3b34447f1aab8b9a09231943013d8d34ac39a5d254a3b946089597b4aecbf4253e1333167c307245686a7d11ca586edf6960169607e8c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YLES0RFA.cookie
MD5
72bbd4b50ee85bdb7eb7fe64634d2c00

SHA1
14e72fde86e085ef6ed9c8a9d1ba8652c11a91d3

SHA256
f5eb221e3a4b91c3228126043ecad2cb7d46f6d7537477a84933cfed3101582d

SHA512
246388952db7b02aa442b57c177a74ccfd361f75e7fdf8f834d1f16f436ec341946809dd108db2886dfd2be37c6a50db91e16f3dad138fdd58ef469c8d33e471

Download Submit
memory/2372-115-0x00007FF96EC00000-0x00007FF96EC6B000-memory.dmp

Filesize
428KB

Download
memory/2660-116-0x0000000000000000-mapping.dmp

Download