Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
nova lista narudzbi.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
nova lista narudzbi.exe
Resource
win10v2004-20220812-en
General
-
Target
nova lista narudzbi.exe
-
Size
653KB
-
MD5
aee1c3cee2eb1b49fc9859e0ff7d2200
-
SHA1
9681c6ae132eff2e323045b56c8e2b4b50c8757c
-
SHA256
96538581d475a33de24ff6e71dcf35df1c21d2d1304da1b002edfddd777b5fa6
-
SHA512
4b3110e954024cb78e28607ecd24eeaf9f1d1e370662015d17b2194ead6dc2fb3b021a5e93786c91627ab99c05ddf706f85dc1702bb885d4e760eab249cfa9a2
-
SSDEEP
12288:Xb+ehvt30D23pDnWFFP2LCevNE6S62avdPnjD:XSuveg4eFNXeaNnjD
Malware Config
Extracted
xloader
2.5
euv4
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
oprimanumerodos.com
launchclik.com
customapronsnow.com
thecuratedpour.com
20dzwww.com
encludemedia.com
kreativevisibility.net
mehfeels.com
oecmgroup.com
alert78.info
1207rossmoyne.com
spbutoto.com
t1uba.com
protection-onepa.com
byausorsm26-plala.xyz
bestpleasure4u.com
allmnlenem.quest
mobilpartes.com
fabio.tools
bubu3cin.com
nathanmartinez.digital
shristiprintingplaces.com
silkyflawless.com
berylgrote.top
laidbackfurniture.store
leatherman-neal.com
uschargeport.com
the-pumps.com
deepootech.com
drimev.com
seo-art.agency
jasabacklinkweb20.com
tracynicolalamond.com
dandtglaziers.com
vulacils.com
bendyourtongue.com
gulfund.com
ahmadfaizlajis.com
595531.com
metavillagehub.com
librairie-adrienne.com
77777.store
gongwenbo.com
game2plays.com
rematedeldia.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral2/memory/5012-132-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-134-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-135-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-136-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-138-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-139-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-140-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-141-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-137-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-143-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-144-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-145-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-142-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-147-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-148-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-149-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-150-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-146-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-151-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-152-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-153-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-154-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-156-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-157-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-158-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-159-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-155-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-161-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-162-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-163-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-164-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-160-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-166-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-167-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-168-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-165-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-170-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-171-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-172-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-169-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-173-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-174-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-175-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-176-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-177-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-178-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-179-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-180-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-181-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-182-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-183-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-184-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-185-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-186-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-187-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-188-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-189-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-190-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-192-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-191-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-194-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-193-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 behavioral2/memory/5012-195-0x0000000002280000-0x00000000022AA000-memory.dmp modiloader_stage2 -
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2588-303-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral2/memory/2588-357-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral2/memory/3124-360-0x00000000008F0000-0x0000000000919000-memory.dmp xloader behavioral2/memory/3124-364-0x00000000008F0000-0x0000000000919000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
nova lista narudzbi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Enyukuwp = "C:\\Users\\Public\\Libraries\\pwukuynE.url" nova lista narudzbi.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2588 set thread context of 760 2588 cmd.exe Explorer.EXE PID 3124 set thread context of 760 3124 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
nova lista narudzbi.execmd.exerundll32.exepid process 5012 nova lista narudzbi.exe 5012 nova lista narudzbi.exe 2588 cmd.exe 2588 cmd.exe 2588 cmd.exe 2588 cmd.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 760 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cmd.exerundll32.exepid process 2588 cmd.exe 2588 cmd.exe 2588 cmd.exe 3124 rundll32.exe 3124 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cmd.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 2588 cmd.exe Token: SeShutdownPrivilege 760 Explorer.EXE Token: SeCreatePagefilePrivilege 760 Explorer.EXE Token: SeShutdownPrivilege 760 Explorer.EXE Token: SeCreatePagefilePrivilege 760 Explorer.EXE Token: SeDebugPrivilege 3124 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
nova lista narudzbi.exeExplorer.EXErundll32.exedescription pid process target process PID 5012 wrote to memory of 2588 5012 nova lista narudzbi.exe cmd.exe PID 5012 wrote to memory of 2588 5012 nova lista narudzbi.exe cmd.exe PID 5012 wrote to memory of 2588 5012 nova lista narudzbi.exe cmd.exe PID 5012 wrote to memory of 2588 5012 nova lista narudzbi.exe cmd.exe PID 5012 wrote to memory of 2588 5012 nova lista narudzbi.exe cmd.exe PID 5012 wrote to memory of 2588 5012 nova lista narudzbi.exe cmd.exe PID 760 wrote to memory of 3124 760 Explorer.EXE rundll32.exe PID 760 wrote to memory of 3124 760 Explorer.EXE rundll32.exe PID 760 wrote to memory of 3124 760 Explorer.EXE rundll32.exe PID 3124 wrote to memory of 3392 3124 rundll32.exe cmd.exe PID 3124 wrote to memory of 3392 3124 rundll32.exe cmd.exe PID 3124 wrote to memory of 3392 3124 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nova lista narudzbi.exe"C:\Users\Admin\AppData\Local\Temp\nova lista narudzbi.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-365-0x0000000007E70000-0x0000000007F4D000-memory.dmpFilesize
884KB
-
memory/760-355-0x0000000002C10000-0x0000000002CDA000-memory.dmpFilesize
808KB
-
memory/760-363-0x0000000007E70000-0x0000000007F4D000-memory.dmpFilesize
884KB
-
memory/2588-357-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/2588-241-0x0000000000000000-mapping.dmp
-
memory/2588-303-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/2588-305-0x00000000021D0000-0x000000000251A000-memory.dmpFilesize
3.3MB
-
memory/2588-354-0x00000000020B0000-0x00000000020C1000-memory.dmpFilesize
68KB
-
memory/3124-364-0x00000000008F0000-0x0000000000919000-memory.dmpFilesize
164KB
-
memory/3124-360-0x00000000008F0000-0x0000000000919000-memory.dmpFilesize
164KB
-
memory/3124-361-0x00000000027F0000-0x0000000002B3A000-memory.dmpFilesize
3.3MB
-
memory/3124-359-0x0000000000550000-0x0000000000564000-memory.dmpFilesize
80KB
-
memory/3124-362-0x0000000002650000-0x00000000026E0000-memory.dmpFilesize
576KB
-
memory/3124-356-0x0000000000000000-mapping.dmp
-
memory/3392-358-0x0000000000000000-mapping.dmp
-
memory/5012-167-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-174-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-142-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-147-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-148-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-149-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-150-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-146-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-151-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-152-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-153-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-154-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-156-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-157-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-158-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-159-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-155-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-161-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-162-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-163-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-164-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-160-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-166-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-144-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-168-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-165-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-170-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-171-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-172-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-169-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-173-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-145-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-175-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-176-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-177-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-178-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-179-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-180-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-181-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-182-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-183-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-184-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-185-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-186-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-187-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-188-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-189-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-190-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-143-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-137-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-141-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-140-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-139-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-138-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-136-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-135-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-134-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-132-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-192-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-191-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-194-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-193-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB
-
memory/5012-195-0x0000000002280000-0x00000000022AA000-memory.dmpFilesize
168KB