{"id":4296,"date":"2026-06-08T17:57:17","date_gmt":"2026-06-08T14:57:17","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4296"},"modified":"2026-06-08T17:57:17","modified_gmt":"2026-06-08T14:57:17","slug":"how-to-collect-quarantined-files-using-quarantine-dumper-tool","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/how-to-collect-quarantined-files-using-quarantine-dumper-tool\/","title":{"rendered":"How to collect quarantined files using Quarantine Dumper Tool"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>How to collect the quarantined files on an affected Windows machine using WithSecure Quarantine Dumper, and then submit the files for analysis.\u00a0<\/p>\n<h3>Resolution:<\/h3>\n<p>Collect quarantined files using WithSecure Quarantine Dumper by following the instructions below:<\/p>\n<ol>\n<li>Click on this\u00a0link to\u00a0download \u00a0to a location of your choice, for example,\u00a0c:\\temp:\n<ul>\n<li>32bit version: <a href=\"https:\/\/download.withsecure.com\/support\/tools\/wsdumpqrt\/wsdumpqrt.exe\" target=\"_blank\" rel=\"noopener\">https:\/\/download.withsecure.com\/support\/tools\/wsdumpqrt\/wsdumpqrt.exe<\/a><\/li>\n<li>64bit version: <a href=\"https:\/\/download.withsecure.com\/support\/tools\/wsdumpqrt\/wsdumpqrt64.exe\" target=\"_blank\" rel=\"noopener\">https:\/\/download.withsecure.com\/support\/tools\/wsdumpqrt\/wsdumpqrt64.exe<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Launch Command Prompt (CMD).<\/li>\n<li>Navigate the directory to the location you\u00a0selected in step 1. For example, type <span style=\"font-family: courier new,courier,monospace;\">cd c:\\temp\\ <\/span>and press <b>Enter <\/b>on your keyboard\u00a0to go to c:\\temp\\ folder.<\/li>\n<li>Type <span style=\"font-family: Courier New,Courier,monospace;\">w<\/span><span style=\"font-family: courier new,courier,monospace;\">sdumpqrt.exe -d c:\\temp\\<\/span>\u00a0to run the tool.<\/li>\n<li>Enter your administrator credentials when prompted. WithSecure license terms are now\u00a0shown.<\/li>\n<li>Scroll all the way to the end of the license terms before you can accept them.<\/li>\n<li>Press <b>E<\/b>\u00a0on your keyboard to accept the license terms.<\/li>\n<li>Press any key to complete the run. The\u00a0quarantined files will be collected in a file named <b>malware_samples.zip<\/b>\u00a0with the default password (infected) in the location you specified in step 1.\u00a0<\/li>\n<\/ol>\n<p>These are the parameters that can be used in the tool:\u200b<\/p>\n<ul>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">-d, &#8211;destination<\/span>: Destination directory for output (default: current admin desktop)<\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">-p, &#8211;password<\/span>: Password for output (default: &quot;infected&quot;)<\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">-v, &#8211;verbose<\/span>: Verbose output<\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">-a, &#8211;accept-eula<\/span>: Accept EULA<\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">-s, &#8211;silent<\/span>: Silent mode<\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">-l, &#8211;list<\/span>: Only list contents, nothing is written to disk<\/li>\n<\/ul>\n<p><b>Tip:<\/b> Running the <span style=\"font-family: Courier New,Courier,monospace;\">wsdumpqrt.exe<\/span> tool in command prompt without additional command line parameters will print out a short tool description and the extra parameters for using the tool.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Instructions on how to collect quarantined files on an affected Windows machine using F-Secure Quarantine Dumper and submit the files for analysis.<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4296","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013703","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:57:17","import_hash":"e13d8d9e3e69bcb1342d7fca9a10d1e9a9c11dc8","vanilla_article_id":29662,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29662-how-to-collect-quarantined-files-using-quarantine-dumper-tool","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4296","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4296"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4296"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}