d2ee6c424bf11c946e3d86f24fbaf1b92f7f0a87ce74fc31eea56991089159be

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Size 791KB
Sample260916-wpthcsstc1
SHA256 d2ee6c424bf11c946e3d86f24fbaf1b92f7f0a87ce74fc31eea56991089159be
MD5 af7433de38d4263b8dc389099f0e0c13
SHA1 c55d67d4fd13b6d5a4ef21da791a1d5041356f08
SHA512 a3129542a7b7fcb2097f15744a094b08769d8be218f20561041e0eddd63c9a723b7fef5c75f0554d6808e68a9253ed9b39728a8e1e0287246bc0b82485ee9fae
SSDEEP 6144:3pqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCm:3pqiC/2OGAtkCP4cejGSOpRK3CnIiG
TLSH
T1B4058E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe

Executes dropped EXE 2 IoCs

pid	Process
5868	system3_.exe
4700	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4384-0-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral2/files/0x000a00000001b1f4-7.dat	autoit_exe
behavioral2/memory/4700-10-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral2/memory/4384-36-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral2/memory/5868-38-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2060	cmd.exe
1772	cmd.exe
4864	cmd.exe
5176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4384	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
4384	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
5868	system3_.exe
5868	system3_.exe
4700	system3_.exe
4700	system3_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3808	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2060	4384	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe	87
PID 2060 wrote to memory of 4900	2060	cmd.exe	89
PID 4384 wrote to memory of 1772	4384	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe	90
PID 1772 wrote to memory of 2712	1772	cmd.exe	92
PID 5868 wrote to memory of 4864	5868	system3_.exe	97
PID 4864 wrote to memory of 1260	4864	cmd.exe	100
PID 5868 wrote to memory of 5176	5868	system3_.exe	101
PID 3808 wrote to memory of 4700	3808	explorer.exe	103
PID 5176 wrote to memory of 2172	5176	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:2000

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

DB1D8414D7476F1600F87016F0D4E3DD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DB1D8414D7476F1600F87016F0D4E3DD
Size 308B
SHA256 16f760c48a00d8058b8a52b622b30cb63a37f8eec7ca2ad01bd4ac7bcfaaca8c
MD5 0f9fd1da699bf2960e43cb2355a0e4a4
SHA1 ea305fee7889721b3eb5fcb4e885abadc951eaf9
SHA512 6ef8af1cc5bd0e24e6f6a83ff91aeea085b8915100e5afc67d7ab6bc83cd4183a0bbba2ed92ec17d2e5f92f82e37ec8fb7f99ff1f4b92ce8a47d943ecf068cd3
TLSH
T128E02680B66D26811270E400E8D5C4072CB8A0D99E0D70015950DBD55497AC6E9452C9
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 e40c6e77bdd41a8608aeceac19815dde9db0a9b6c258166647944cd1d81ccddd
MD5 98ce0cd1596a038856d567fe14c6ec98
SHA1 2674b5f53db727bb9469b65b868d04187f013999
SHA512 ef99f758cb3908511dbbec4e00be7c3e4e0799e0a34143242db1dd4246118e3336ceb4dda5072aaf38ead1a9890b54fa021bafe31f42eefe2a4272d9cc5d5dfe
TLSH
T1D8C09B4C777543ADF070197F595286404FFED615DD5383645F701158856DA424CF5D07
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 cb799746454e521078f8490136a73e044eac9e47f3187c6eebadc869d88ba8a1
MD5 a0a00e617cebe7d5be4555365503ab01
SHA1 05ddb9c64abe8dac8289e6eae2d3290c1a52cbf9
SHA512 cf28293fd34f9effe39c40fa3e53028d09168bcd5a53591f5440473d3cf023b18a74636a7c768f583a99689ee88ee08cf637ba874fc0f74923560491fdb83f35
TLSH
T1C3C09B5473654759F10D117D7DD5570457B54106F6D7C3044BB41134851D6400871D45
MD5 SHA1 SHA512 TLSH

Submit Download

DB1D8414D7476F1600F87016F0D4E3DD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DB1D8414D7476F1600F87016F0D4E3DD
Size 192B
SHA256 3a44e3a8a2281125af1c30fa4d04375ccfac958ea1428dbbdaecd521ccdb0465
MD5 1f27df0b7dac17d3278ba8de208976a2
SHA1 04f377ecce6988862ec50d69f2c7675380bc7256
SHA512 1f07f190a53983c44f7e3a6f419675e567b52331d0f89db8ee628ec20911ecf0f6d3d5b541f264250428d309eb8e856bbc8002f0f65fc27ddec2cfdc32a90cb1
TLSH
T158C02B283B770304F212013E08F1DF2243F8A504D1518F4E1FF0023A962F5022C31F04
MD5 SHA1 SHA512 TLSH

Submit Download

setting[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0LTBB212\setting[2].htm
Size 178B
SHA256 2215b6324712a5453264d05ba2a50d3475a3aca173dfe1bbc46d711722487089
MD5 c423622cf60c65d6aad4acea13b9f447
SHA1 35f82dd6da0f2ec19dc2feb3d02db26266520305
SHA512 4b59628af34c8bed6f7f626a6f229cdf25be59399baf0e792d90f0075ffee94ac969a71de6d57dd481248d7e5bc26b92cc052021a68ede3c37079eb38f93e702
TLSH
T18CC012696B532C9874973A3951C39160E1DC50202299041112604607B08B1A79DC23D5
MD5 SHA1 SHA512 TLSH

Submit Download

setting[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1NI6S3Y\setting[2].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 791KB
SHA256 d2ee6c424bf11c946e3d86f24fbaf1b92f7f0a87ce74fc31eea56991089159be
MD5 af7433de38d4263b8dc389099f0e0c13
SHA1 c55d67d4fd13b6d5a4ef21da791a1d5041356f08
SHA512 a3129542a7b7fcb2097f15744a094b08769d8be218f20561041e0eddd63c9a723b7fef5c75f0554d6808e68a9253ed9b39728a8e1e0287246bc0b82485ee9fae
SSDEEP 6144:3pqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCm:3pqiC/2OGAtkCP4cejGSOpRK3CnIiG
TLSH
T1B4058E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4384-0-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4384-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/4384-36-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4700-10-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/5868-38-0x0000000000400000-0x00000000004DC000-memory.dmp

Download