luminosity | 2b01e2e497bc8f992d23ecabf99536cc759af1acf2482197f602d22eec20513e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Size 2.0MB
Sample261016-e4mvpag18y
SHA256 2b01e2e497bc8f992d23ecabf99536cc759af1acf2482197f602d22eec20513e
MD5 371d6af259f163977316d1f4b73d64d2
SHA1 51e954c183fb94e412ebcd6c73777895916c8a86
SHA512 4938ea8e84cce02846faf59c2c2957b09899495d4316acea67da0513757517d9fe991318d2e61e4f79ad3a64a08b0cb33c53bda6cbcbda9e448fa95ee82196fa
SSDEEP 49152:vSxC1sHFzalvA39JW3Vq6wixkPYRcilWihwVRFOVtA/B:v0gK39J8ZxKYRcilXgRn/B
TLSH
T1A9A523152BFB60D9F33EAB7D4BF6FD66DA26E332250677EE0001E3554822840DE91A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 6 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

pid	Process
2432	schtasks.exe
2132	schtasks.exe
1936	schtasks.exe
1884	schtasks.exe
5408	schtasks.exe
108	schtasks.exe

Executes dropped EXE 12 IoCs

pid	Process
4500	books.exe
2864	books.exe
4544	books.exe
1164	books.exe
6136	Security.exe
5516	Security.exe
5536	Security.exe
5864	Security.exe
4652	Security.exe
1272	Security.exe
4772	Security.exe
3476	Security.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	books.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	books.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 2864	4500	books.exe	95
PID 4544 set thread context of 1164	4544	books.exe	102
PID 6136 set thread context of 5536	6136	Security.exe	113
PID 5864 set thread context of 1272	5864	Security.exe	123
PID 4772 set thread context of 3476	4772	Security.exe	129

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Security\Security.exe	books.exe
File created	C:\Program Files (x86)\Security\Security.exe	books.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	books.exe
File created	C:\Windows\assembly\Desktop.ini	books.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	books.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	books.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	books.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	books.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	books.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Security.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe
2864	books.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	books.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5576	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
Token: SeDebugPrivilege	4500	books.exe
Token: SeDebugPrivilege	4544	books.exe
Token: SeDebugPrivilege	2864	books.exe
Token: SeDebugPrivilege	6136	Security.exe
Token: SeDebugPrivilege	5864	Security.exe
Token: SeDebugPrivilege	4772	Security.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2864	books.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 4500	5576	jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe	90
PID 4500 wrote to memory of 5844	4500	books.exe	91
PID 4500 wrote to memory of 1884	4500	books.exe	93
PID 4500 wrote to memory of 2864	4500	books.exe	95
PID 4500 wrote to memory of 2864	4500	books.exe	95
PID 4500 wrote to memory of 2864	4500	books.exe	95
PID 4500 wrote to memory of 2864	4500	books.exe	95
PID 4500 wrote to memory of 2864	4500	books.exe	95
PID 4544 wrote to memory of 1540	4544	books.exe	98
PID 4544 wrote to memory of 5408	4544	books.exe	100
PID 4544 wrote to memory of 1164	4544	books.exe	102
PID 4544 wrote to memory of 1164	4544	books.exe	102
PID 4544 wrote to memory of 1164	4544	books.exe	102
PID 4544 wrote to memory of 1164	4544	books.exe	102
PID 4544 wrote to memory of 1164	4544	books.exe	102
PID 2864 wrote to memory of 108	2864	books.exe	103
PID 6136 wrote to memory of 1820	6136	Security.exe	107
PID 6136 wrote to memory of 2432	6136	Security.exe	110
PID 6136 wrote to memory of 5516	6136	Security.exe	112
PID 6136 wrote to memory of 5536	6136	Security.exe	113
PID 6136 wrote to memory of 5536	6136	Security.exe	113
PID 6136 wrote to memory of 5536	6136	Security.exe	113
PID 6136 wrote to memory of 5536	6136	Security.exe	113
PID 6136 wrote to memory of 5536	6136	Security.exe	113
PID 2864 wrote to memory of 3676	2864	books.exe	115
PID 5864 wrote to memory of 3404	5864	Security.exe	118
PID 5864 wrote to memory of 2132	5864	Security.exe	120
PID 5864 wrote to memory of 4652	5864	Security.exe	122
PID 5864 wrote to memory of 1272	5864	Security.exe	123
PID 5864 wrote to memory of 1272	5864	Security.exe	123
PID 5864 wrote to memory of 1272	5864	Security.exe	123
PID 5864 wrote to memory of 1272	5864	Security.exe	123
PID 5864 wrote to memory of 1272	5864	Security.exe	123
PID 2864 wrote to memory of 4772	2864	books.exe	124
PID 2864 wrote to memory of 4772	2864	books.exe	124
PID 2864 wrote to memory of 4772	2864	books.exe	124
PID 2864 wrote to memory of 4772	2864	books.exe	124
PID 4772 wrote to memory of 4764	4772	Security.exe	125
PID 4772 wrote to memory of 1936	4772	Security.exe	127
PID 4772 wrote to memory of 3476	4772	Security.exe	129
PID 4772 wrote to memory of 3476	4772	Security.exe	129
PID 4772 wrote to memory of 3476	4772	Security.exe	129
PID 4772 wrote to memory of 3476	4772	Security.exe	129
PID 4772 wrote to memory of 3476	4772	Security.exe	129

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.bww.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Users\Admin\AppData\Roaming\books.exe
  "C:\Users\Admin\AppData\Roaming\books.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5844
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\1883120685.xml"
    3⤵
    - Family: Luminosity
    - System Location Discovery: System Language Discovery
    PID:1884
- - C:\Users\Admin\AppData\Roaming\books.exe
    "C:\Users\Admin\AppData\Roaming\books.exe "
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "Security" /tr "'C:\Program Files (x86)\Security\Security.exe' /startup" /sc MINUTE /f /rl highest
      4⤵
      Family: Luminosity
      System Location Discovery: System Language Discovery
      PID:108
  - - C:\Windows\SysWOW64\REG.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Security" /d "cmd /c """start """Security""" """C:\Program Files (x86)\Security\Security.exe"""" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:3676

C:\Users\Admin\AppData\Roaming\books.exe
C:\Users\Admin\AppData\Roaming\books.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1540
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\1143191533.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Users\Admin\AppData\Roaming\books.exe
  "C:\Users\Admin\AppData\Roaming\books.exe "
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1164

C:\Program Files (x86)\Security\Security.exe
"C:\Program Files (x86)\Security\Security.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1820
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\1312097984.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe "
  2⤵
  - Executes dropped EXE
  PID:5516
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5536

C:\Program Files (x86)\Security\Security.exe
"C:\Program Files (x86)\Security\Security.exe" /startup
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\337297291.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe /startup"
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe /startup"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1272

C:\Program Files (x86)\Security\Security.exe
"C:\Program Files (x86)\Security\Security.exe" /startup
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Delete /TN "Update\Updater" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4764
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Updater" /XML "C:\Users\Admin\AppData\Local\Temp\2102562396.xml"
  2⤵
  - Family: Luminosity
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1936
- C:\Program Files (x86)\Security\Security.exe
  "C:\Program Files (x86)\Security\Security.exe /startup"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1312097984.xml

Path C:\Users\Admin\AppData\Local\Temp\1312097984.xml
Size 1KB
SHA256 efada68322424c810506f0972deb318d390c58adbbce88a9d4a93843ad6f0034
MD5 ae7f98a7c82c52dbeb7be20b4d1ff207
SHA1 34efce97de3df307d1897e56b988ff04af29dfde
SHA512 963095ac6ba993c357a96ac1c98e9237a78821d23f6236f7166db80c9c68f7f45f5b276f9a1275e7a854a9cd5bfed56cfa2b51bf3a9ec6d42cadcda1715c62b3
TLSH
T1493110649CC0BA176572413AE3525682EF6787B70A570039F4CC4B7F2FB61862143577
MD5 SHA1 SHA512 TLSH

Submit Download

1883120685.xml

Path C:\Users\Admin\AppData\Local\Temp\1883120685.xml
Size 1KB
SHA256 7c5fa4593246c03218ff7e3095130ede415b6b4ab0e2eec45c7c85419afd9e29
MD5 631d819c3a721e4c78d280866528afa8
SHA1 c730473d67b87e2c2dc49950d56128688102b837
SHA512 c0df5e87083e156b1b50bf874e2ed3d195ccd452a0a26e3ccc95bc2ab709a68176f56985c06f0d19f4e7eaa42dfc95b8aee44bbfaebe81a9c16f8de063296d9a
TLSH
T12F3110649CC0BA0B6572413AE3529683EF7787B70A560039F4CC4BBF2FB61862143577
MD5 SHA1 SHA512 TLSH

Submit Download

books.exe

Path C:\Users\Admin\AppData\Roaming\books.exe
Size 2.0MB
SHA256 2b01e2e497bc8f992d23ecabf99536cc759af1acf2482197f602d22eec20513e
MD5 371d6af259f163977316d1f4b73d64d2
SHA1 51e954c183fb94e412ebcd6c73777895916c8a86
SHA512 4938ea8e84cce02846faf59c2c2957b09899495d4316acea67da0513757517d9fe991318d2e61e4f79ad3a64a08b0cb33c53bda6cbcbda9e448fa95ee82196fa
SSDEEP 49152:vSxC1sHFzalvA39JW3Vq6wixkPYRcilWihwVRFOVtA/B:v0gK39J8ZxKYRcilXgRn/B
TLSH
T1A9A523152BFB60D9F33EAB7D4BF6FD66DA26E332250677EE0001E3554822840DE91A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-7-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/2864-20-0x0000000074F00000-0x0000000075521000-memory.dmp

Download

memory/2864-9-0x0000000074F00000-0x0000000075521000-memory.dmp

Download

memory/4500-4-0x0000000074F00000-0x0000000075521000-memory.dmp

Download

memory/4500-10-0x0000000074F00000-0x0000000075521000-memory.dmp

Download

memory/4500-3-0x0000000074F00000-0x0000000075521000-memory.dmp

Download

memory/4772-36-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/4772-35-0x0000000005310000-0x0000000005327000-memory.dmp

Download

memory/4772-34-0x0000000005310000-0x0000000005327000-memory.dmp

Download

memory/4772-33-0x0000000005310000-0x0000000005327000-memory.dmp

Download

memory/4772-37-0x0000000005310000-0x0000000005327000-memory.dmp

Download

memory/4772-43-0x0000000005310000-0x0000000005327000-memory.dmp

Download

memory/5576-0-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/5576-1-0x0000000074F02000-0x0000000074F04000-memory.dmp

Download