37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransomware/WanaDecrypt0r.exe
Size 7.7MB
Sample260929-pffftazzc1
SHA256 37747ef98d4574a4fb8b87039526f4e6f6ff6e0c654eb9dcf13833e7e27a6149
MD5 80ae91891bdb20fc9ffbc35af0e1352b
SHA1 2c4606168d8491f3d6ad17f5e2cc4eba28dbd638
SHA512 4c34d95fd6b3fde9781c1be1e8cb3a8fc94d920844e8c79a74d54b33b62374129983fbc1c2e4e5b6e21d301a0bea039a6d165f248ebcb9d60389d4d6b2fe9d25
SSDEEP 196608:2r2eYdDAXurHSuhHToAUPNfGU5vXvE4LDdIOZ+:2KdEXuXhHTodRGkXs4/PA
TLSH
T189863365A3C599F9FEB3E93C96630245D3B63C061720C5DB02D986527E376F02A3A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe
5932	powershell.exe

Loads dropped DLL 5 IoCs

pid	Process
3320	WanaDecrypt0r.exe
3320	WanaDecrypt0r.exe
3320	WanaDecrypt0r.exe
3320	WanaDecrypt0r.exe
3320	WanaDecrypt0r.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeBackground.bmp"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeBackground.bmp"	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe
5932	powershell.exe
5932	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3320	2212	WanaDecrypt0r.exe	89
PID 3320 wrote to memory of 2476	3320	WanaDecrypt0r.exe	90
PID 2476 wrote to memory of 5216	2476	powershell.exe	92
PID 5216 wrote to memory of 3828	5216	csc.exe	93
PID 2476 wrote to memory of 5932	2476	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe
"C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe
  "C:\Users\Admin\AppData\Local\Temp\ransomware\WanaDecrypt0r.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\Run.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ncwfywq0\ncwfywq0.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5216
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2764.tmp" "c:\Users\Admin\AppData\Local\Temp\ncwfywq0\CSCDD4DF2915EBB4C63A1A434D536E4A94.TMP"
        5⤵
        
        PID:3828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\WinUpdateCache\LockScreen.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8f115b2f85ada340d5c18856c6fabbc6ac1dc6fce9c7294d9d216a63fec333f3
MD5 152a8a213f0bb60e3a57cc8b53f780e7
SHA1 0702bf4f40b7960cd5a81cc5825e02c22693af64
SHA512 4d1cc55e809003f0cceba53add5ecea6790ebd2d2cffc856cd8457009c35c2413f501503f248ddba26d3acb488e9a3c8b6d7c67695f8b838e0c005bc1bf4b9a3
TLSH
T108216833B3DC8615D899413A50CEEC1036B6C7DB80DECF6B7B85D649A53F699CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

RES2764.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2764.tmp
Size 1KB
SHA256 839126d35a709f51988743996193648236e772d0c1c496cb24f9464bd906bc41
MD5 a762dc678b74270e0d8aabb5b03c0655
SHA1 53b988564f763979d646548ecdcce47ddae53aaf
SHA512 d68c2733d8f2f6f482fd791aa8dbd2a799726d9bb9db95b53f8d61ecbc349a1ad67e0d988efc646565d99929325491e6016704b5aff7b4a2a1c42abe4e89cbeb
TLSH
T1A7218C0493E9871FF0B74732A9F6232FA575FD64DFA2579A8840022D2C51504EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

FileCryptography.psm1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\FileCryptography.psm1
Size 14KB
SHA256 bb970dffceeedeac03b78e0500d19d23a2cf7a8d80362912ba216d0a5e8eb5db
MD5 a528542f33dcb34418bae828deaa8b3e
SHA1 a56f9a88600d549b3ba831e977f036e46b6a50bd
SHA512 683020b8963ffe336679e1552d187a01713718790264ecad81da3c238338980444a7578b77da82b3143b2c03af1340d55a3786ea02e04b4ee9f5e84248c04272
SSDEEP 192:tm1oaf6XeydX5+wA8kMuL6ufzUL6ih6iPCD7Iu/kGyUB4p1CUFLDv6/7JbABjVuH:tm1Lyt5+z3M+6PCDCUB4p4oLr6ajJ+
TLSH
T1286295543F969AD503C220B5EA3EEA448735862F90792F18FBCCD104BF9251CE6A9BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockScreen.ps1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\LockScreen.ps1
Size 4KB
SHA256 20b8d4a4415663decf6ab4f8955c7344d9273e5cf1bf0de411a5f61474789dae
MD5 e920d6359156f90ec5c43d7c07135360
SHA1 0c1efa1bafdc1fc287e5bd9b4a6b49e1656bb470
SHA512 6fb3d043e1a446189412b4055e35385b48b09bd90ea292702c7479d82db64d82c22db09748ce9f6df087aa7ef2d3999283b558709c15b4db30de2976cfad5b43
SSDEEP 96:lxD7b5D2eCQGWxMm+90c5s39slblPecDp5w5QjlcOGnBESywNKBj:lzywGqMm+90c5S9QRPecDpuKJcOG5ylV
TLSH
T12791442D7778D230A7D2A69DEAEBD885AD1A11365001D9043ADFE06CD76D025C3BB34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RanSim.ps1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\RanSim.ps1
Size 2KB
SHA256 4de8dd007b04ec7e26ce3610e8633bbcadf6284332d9ab1d84b6c8b3fd8c50f7
MD5 8a7c56f4344a3c64016b71b71e5994ff
SHA1 7f7f234c8364aa255cba3c070bfc77737e64b6d3
SHA512 05a23939818a7fc0d016f0eb870bf755b64f10d4d7b48f929ba71d131db63accefb429f4046b60f2efced3a5778629d31f3a916149182f88e7f15b37c09685ea
TLSH
T1FE512E123EE457E59651268BEF7DE0097318A4BF76597B14B8CDA2003F02B1805DAAF3
MD5 SHA1 SHA512 TLSH

Submit Download

Run.ps1

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\Run.ps1
Size 5KB
SHA256 134b1372b1a1c7a4c165d80bad8fbbb0d34ffcfb7beeb6d9449eef01418f1898
MD5 ad0a4988cdbf19163ac660bb8bff897a
SHA1 760cdbb5a588dbf51f96160a984477eb515f1335
SHA512 ac83e79bc7930a44a664776b29bc7045e2dffa69b0f1c92be48113ea7ef6783d85269dd1b85cb2984100c812b713c126f4ee3b07e45cf233a11f21e536fff42a
SSDEEP 96:lxjxVyJU5qpo71FA+BSQJ3GB3WcUh7Yy2yQym975sJ9v5h49+5M9N56AkKgj0ksZ:lJt5qW71FjBD4B3WcUh7Yy2yQym97+J4
TLSH
T19CB10A2F7F26C51C8B93C06B9ABED441DB2415A701B5A80671CDE1D49F0D934C3BFAA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\base_library.zip
Size 1.3MB
SHA256 9239f156b250cb337d7ead19b66df2b98df2ae2a5e7be7c7d77c6dd4405e144d
MD5 84989d2f5300ad618fd292eb5646606a
SHA1 31c8c2a39368007f3b6d5341c28d6d7f33e031b2
SHA512 b18f1ca8e568fe58ce826c6d9915d93bcb4be3c5e28c9c94f53e8eebfd36dacf6c68bb0f42a172164e1f823d57da590dc9dfc7ccba1bf3f78207a6a762e99d1d
SSDEEP 12288:iHbP1dm48lJGUmr/scrmn9bRO2Kfb9WcnVTVihlyixmpvQXMHYqNZ2/HliO:obP1dm48lJGU0p69bk9vhB2/HliO
TLSH
T17F55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a42\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1owcf3up.kwp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1owcf3up.kwp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ncwfywq0.dll

Path C:\Users\Admin\AppData\Local\Temp\ncwfywq0\ncwfywq0.dll
Size 3KB
SHA256 ba2a2cbb8e2cddb3f5703cfdf4e31afd5a985493035989b4b594354d6dd4c2ac
MD5 730184eac9f57efadccc5bcb8690c867
SHA1 bcc88ef69728ef02331dec6bbcc541f4bbc2ce69
SHA512 ff107f0fed78db20a8509e48a809d2168494ac59e35417d49340b8a2b7db80b16135279551968e91e1bc8ba0b976c00c2b3ab412160f24c859d30c00ae7ef491
TLSH
T1FE51D01667E8466BE8AB07316DF387633774F8149FB2A35D1980422C9C617681E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDD4DF2915EBB4C63A1A434D536E4A94.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ncwfywq0\CSCDD4DF2915EBB4C63A1A434D536E4A94.TMP
Size 652B
SHA256 c33978f342a564b17406a1cd7242714cb61e42cab9f34337c7cf5ac68116e7d2
MD5 8ecc7c2165ec4a91d34fc4e5c2a4b89d
SHA1 14a94515af665b1a0f49621ac371e460e067364d
SHA512 9bf680e28c1259fa10785b24220be978ffc88414e7f5eba54f1870fe40197cc74b2999674b4268d9a3d5ee8701b8864d1df7e3dbadd8c0f4d77f1f281f403d87
TLSH
T124F0820963F8430EF4F74B31BDF6636395A8BC64DE7293ED2440031D6C649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ncwfywq0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ncwfywq0\ncwfywq0.0.cs
Size 347B
SHA256 e81bfd35c30fa0f52ab9a07ac1edded6c6605ccecc1f88ba6a9cea0f540651c0
MD5 ad0af73a7d23a7288b7513b3465ca8a8
SHA1 0492129408e1b1ac32c9a28272c2c5341a76780b
SHA512 8df38ebf810240aa9c9d29f454e35d121b4a9bcd136655796f1c11e687754ec55ff06ba2d94a49bf7c5b3d2c7d707e1ec3743e96175bc9c6b81bc232d72fe628
TLSH
T1B1E0D824B7C79EB9805340171C43A0E46B32811A22EA7902FAD91120CECB5042532B69
MD5 SHA1 SHA512 TLSH

Submit Download

ncwfywq0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ncwfywq0\ncwfywq0.cmdline
Size 369B
SHA256 55cec749a1d8b0dc2bf4f4920d78880f381c34a419773508ed0d9892278d1459
MD5 36b759d99e537f70e5d2f96c819b5cfb
SHA1 24bcb13b0556a81d5620595aff60e456f63ad400
SHA512 431a8ffd601d7f508b99f64b8146dc7ca6fdc2d6454dd52b2167a73989a4cd366ab62d67c218b95b11942e79d57839359f63030ec001f4823c576fb60e211542
TLSH
T127E0C66A4687C27E87ED103F236AC6ACC272079729827FA49860848DE4370812BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2476-98-0x00000246D08C0000-0x00000246D08DE000-memory.dmp

Download

memory/2476-83-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-90-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-99-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-92-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-95-0x00000246D0870000-0x00000246D088E000-memory.dmp

Download

memory/2476-96-0x00000246D0B10000-0x00000246D0BC2000-memory.dmp

Download

memory/2476-97-0x00000246D0890000-0x00000246D089A000-memory.dmp

Download

memory/2476-89-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-85-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-91-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-82-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-121-0x00000246D08C0000-0x00000246D08C8000-memory.dmp

Download

memory/2476-79-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-78-0x00000246B8200000-0x00000246B8222000-memory.dmp

Download

memory/2476-77-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-123-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-76-0x00007FFDB6F60000-0x00007FFDB7904000-memory.dmp

Download

memory/2476-75-0x00007FFDB70EF000-0x00007FFDB70F0000-memory.dmp

Download