diff --git a/packages/windump.vm/tools/chocolateyinstall.ps1 b/packages/windump.vm/tools/chocolateyinstall.ps1
new file mode 100644
index 00000000..2898cf75
--- /dev/null
+++ b/packages/windump.vm/tools/chocolateyinstall.ps1
@@ -0,0 +1,39 @@
+$ErrorActionPreference = 'Stop'
+Import-Module vm.common -Force -DisableNameChecking
+
+$toolName = 'WinDump'
+$category = 'Networking'
+
+$zipUrl = 'https://github.com/hsluoyz/WinDump/releases/download/v0.3/WinDump-for-Npcap-0.3.zip'
+$zipSha256 = '7ed45fb06c8c9731ef095db627eaca23b445b2809041e164996121e49b24f5d4'
+
+try {
+    $toolDir = Join-Path ${Env:RAW_TOOLS_DIR} $toolName
+
+    # Remove files from previous zips for upgrade
+    VM-Remove-PreviousZipPackage ${Env:chocolateyPackageFolder}
+
+    # Download and unzip
+    $packageArgs = @{
+        packageName    = ${Env:ChocolateyPackageName}
+        unzipLocation  = $toolDir
+        url            = $zipUrl
+        checksum       = $zipSha256
+        checksumType   = 'sha256'
+        url64bit       = $zipUrl
+        checksum64     = $zipSha256
+    }
+    Install-ChocolateyZipPackage @packageArgs
+    VM-Assert-Path $toolDir
+
+    if ($env:PROCESSOR_ARCHITECTURE -eq "x86") {
+        $executablePath = Join-Path $toolDir "\x86\$toolName.exe" -Resolve
+    } else {
+        $executablePath = Join-Path $toolDir "\x64\$toolName.exe" -Resolve
+    }
+
+    VM-Install-Shortcut -toolName $toolName -category $category -executablePath $executablePath -consoleApp $true
+    Install-BinFile -Name $toolName -Path $executablePath
+} catch {
+    VM-Write-Log-Exception $_
+}
diff --git a/packages/windump.vm/tools/chocolateyuninstall.ps1 b/packages/windump.vm/tools/chocolateyuninstall.ps1
new file mode 100644
index 00000000..5f2340b1
--- /dev/null
+++ b/packages/windump.vm/tools/chocolateyuninstall.ps1
@@ -0,0 +1,7 @@
+$ErrorActionPreference = 'Continue'
+Import-Module vm.common -Force -DisableNameChecking
+
+$toolName = 'WinDump'
+$category = 'Networking'
+
+VM-Uninstall $toolName $category
diff --git a/packages/windump.vm/windump.vm.nuspec b/packages/windump.vm/windump.vm.nuspec
new file mode 100644
index 00000000..d9e97630
--- /dev/null
+++ b/packages/windump.vm/windump.vm.nuspec
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>windump.vm</id>
+    <version>0.3</version>
+    <authors>Riverbed Technology and hsluoyz</authors>
+    <description>Windows version of tcpdump, the command line network analyzer for UNIX</description>
+    <dependencies>
+      <dependency id="common.vm" />
+      <dependency id="npcap.vm" />
+    </dependencies>
+  </metadata>
+</package>