Analysis
-
max time kernel
211s -
max time network
310s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2023 07:39
Static task
static1
Behavioral task
behavioral1
Sample
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe
Resource
win10v2004-20230220-en
General
-
Target
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe
-
Size
890KB
-
MD5
992b76f941ba8c766d32a4d3f9cad057
-
SHA1
06eeea44a2b10728c8fe26173438a5dd54c0394f
-
SHA256
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679
-
SHA512
39d59988e8f01f49aa670204e46fe8d1f3629f1fae5810f646bbb6ed8667f8bd4073502fb7048e53c178cfae0829d899d5f30ce4d5e0a1022537fc4531e59367
-
SSDEEP
24576:typkLYKK2ByJ1N3nrRVAKkjHqy2/CvETqhlB47aYRk:IpabCN3r8iqfB42YR
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
Processes:
y40431236.exep00590167.exe1.exer68855741.exepid process 1520 y40431236.exe 1292 p00590167.exe 984 1.exe 1736 r68855741.exe -
Loads dropped DLL 9 IoCs
Processes:
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exey40431236.exep00590167.exe1.exer68855741.exepid process 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe 1520 y40431236.exe 1520 y40431236.exe 1520 y40431236.exe 1292 p00590167.exe 1292 p00590167.exe 984 1.exe 1520 y40431236.exe 1736 r68855741.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exey40431236.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y40431236.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y40431236.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p00590167.exedescription pid process Token: SeDebugPrivilege 1292 p00590167.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exey40431236.exep00590167.exedescription pid process target process PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 996 wrote to memory of 1520 996 df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe y40431236.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1520 wrote to memory of 1292 1520 y40431236.exe p00590167.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1292 wrote to memory of 984 1292 p00590167.exe 1.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe PID 1520 wrote to memory of 1736 1520 y40431236.exe r68855741.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe"C:\Users\Admin\AppData\Local\Temp\df3c5dcfcf374a5a410dea7fddfc119489ce1425abb1f05b944223b48bcf8679.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y40431236.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y40431236.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68855741.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68855741.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y40431236.exeFilesize
590KB
MD5ea2ea8c4dabdd79a74c36ddcd2d378b0
SHA1562299a71e4fd6fe12e29bfeed73496ff74e5a71
SHA256bbf2c4ffb44c45de60f0b041aa6513db94668cec4b4eb6b85ca8d6ff4afcf69e
SHA5126adb6bb3aea995138f443dcec0849cb4c9d855afea91bfff52b6874f1657ccbd3872383d13e6daf3e87c084c7a0c19dd0b2de2b2985f65fc455807e49c571d48
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y40431236.exeFilesize
590KB
MD5ea2ea8c4dabdd79a74c36ddcd2d378b0
SHA1562299a71e4fd6fe12e29bfeed73496ff74e5a71
SHA256bbf2c4ffb44c45de60f0b041aa6513db94668cec4b4eb6b85ca8d6ff4afcf69e
SHA5126adb6bb3aea995138f443dcec0849cb4c9d855afea91bfff52b6874f1657ccbd3872383d13e6daf3e87c084c7a0c19dd0b2de2b2985f65fc455807e49c571d48
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeFilesize
530KB
MD591e086a705b39fe2725e2f0a4ea6a6fa
SHA1befbe637f4a4c0e29c4ed8392ff951ae5bcb5607
SHA256a56ba0236f097224e6e47a7b02228af21ac3f0f2dce57f40fdc395a09076ee25
SHA512b233b7c455c1cb7d131cfe2776a83317422e9afb560cf3cee04571d7a57d6db08adb0d21f65e9d878dca63fff7334102eaf7e83229a4917ddc7d85fab291d7d2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeFilesize
530KB
MD591e086a705b39fe2725e2f0a4ea6a6fa
SHA1befbe637f4a4c0e29c4ed8392ff951ae5bcb5607
SHA256a56ba0236f097224e6e47a7b02228af21ac3f0f2dce57f40fdc395a09076ee25
SHA512b233b7c455c1cb7d131cfe2776a83317422e9afb560cf3cee04571d7a57d6db08adb0d21f65e9d878dca63fff7334102eaf7e83229a4917ddc7d85fab291d7d2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeFilesize
530KB
MD591e086a705b39fe2725e2f0a4ea6a6fa
SHA1befbe637f4a4c0e29c4ed8392ff951ae5bcb5607
SHA256a56ba0236f097224e6e47a7b02228af21ac3f0f2dce57f40fdc395a09076ee25
SHA512b233b7c455c1cb7d131cfe2776a83317422e9afb560cf3cee04571d7a57d6db08adb0d21f65e9d878dca63fff7334102eaf7e83229a4917ddc7d85fab291d7d2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68855741.exeFilesize
168KB
MD57b1495899cbb5e357e95de078d19e0f7
SHA153b808cc582e5c48dc2fb06babe63cb3de96fdfe
SHA2560bc78a5bd8f1f6ca40c052b94f29f70ad1e95c7c375ac73a1d3404dcf9219f7b
SHA512e5e963a476f07bb3795f015f54882a5f391408bcc0c9a50e7715037c007c76e8f338f86cd8976ffa3f439558fe39fda71a56f300451181a6834ed0fd7b63e128
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68855741.exeFilesize
168KB
MD57b1495899cbb5e357e95de078d19e0f7
SHA153b808cc582e5c48dc2fb06babe63cb3de96fdfe
SHA2560bc78a5bd8f1f6ca40c052b94f29f70ad1e95c7c375ac73a1d3404dcf9219f7b
SHA512e5e963a476f07bb3795f015f54882a5f391408bcc0c9a50e7715037c007c76e8f338f86cd8976ffa3f439558fe39fda71a56f300451181a6834ed0fd7b63e128
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y40431236.exeFilesize
590KB
MD5ea2ea8c4dabdd79a74c36ddcd2d378b0
SHA1562299a71e4fd6fe12e29bfeed73496ff74e5a71
SHA256bbf2c4ffb44c45de60f0b041aa6513db94668cec4b4eb6b85ca8d6ff4afcf69e
SHA5126adb6bb3aea995138f443dcec0849cb4c9d855afea91bfff52b6874f1657ccbd3872383d13e6daf3e87c084c7a0c19dd0b2de2b2985f65fc455807e49c571d48
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\y40431236.exeFilesize
590KB
MD5ea2ea8c4dabdd79a74c36ddcd2d378b0
SHA1562299a71e4fd6fe12e29bfeed73496ff74e5a71
SHA256bbf2c4ffb44c45de60f0b041aa6513db94668cec4b4eb6b85ca8d6ff4afcf69e
SHA5126adb6bb3aea995138f443dcec0849cb4c9d855afea91bfff52b6874f1657ccbd3872383d13e6daf3e87c084c7a0c19dd0b2de2b2985f65fc455807e49c571d48
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeFilesize
530KB
MD591e086a705b39fe2725e2f0a4ea6a6fa
SHA1befbe637f4a4c0e29c4ed8392ff951ae5bcb5607
SHA256a56ba0236f097224e6e47a7b02228af21ac3f0f2dce57f40fdc395a09076ee25
SHA512b233b7c455c1cb7d131cfe2776a83317422e9afb560cf3cee04571d7a57d6db08adb0d21f65e9d878dca63fff7334102eaf7e83229a4917ddc7d85fab291d7d2
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeFilesize
530KB
MD591e086a705b39fe2725e2f0a4ea6a6fa
SHA1befbe637f4a4c0e29c4ed8392ff951ae5bcb5607
SHA256a56ba0236f097224e6e47a7b02228af21ac3f0f2dce57f40fdc395a09076ee25
SHA512b233b7c455c1cb7d131cfe2776a83317422e9afb560cf3cee04571d7a57d6db08adb0d21f65e9d878dca63fff7334102eaf7e83229a4917ddc7d85fab291d7d2
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\p00590167.exeFilesize
530KB
MD591e086a705b39fe2725e2f0a4ea6a6fa
SHA1befbe637f4a4c0e29c4ed8392ff951ae5bcb5607
SHA256a56ba0236f097224e6e47a7b02228af21ac3f0f2dce57f40fdc395a09076ee25
SHA512b233b7c455c1cb7d131cfe2776a83317422e9afb560cf3cee04571d7a57d6db08adb0d21f65e9d878dca63fff7334102eaf7e83229a4917ddc7d85fab291d7d2
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68855741.exeFilesize
168KB
MD57b1495899cbb5e357e95de078d19e0f7
SHA153b808cc582e5c48dc2fb06babe63cb3de96fdfe
SHA2560bc78a5bd8f1f6ca40c052b94f29f70ad1e95c7c375ac73a1d3404dcf9219f7b
SHA512e5e963a476f07bb3795f015f54882a5f391408bcc0c9a50e7715037c007c76e8f338f86cd8976ffa3f439558fe39fda71a56f300451181a6834ed0fd7b63e128
-
\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68855741.exeFilesize
168KB
MD57b1495899cbb5e357e95de078d19e0f7
SHA153b808cc582e5c48dc2fb06babe63cb3de96fdfe
SHA2560bc78a5bd8f1f6ca40c052b94f29f70ad1e95c7c375ac73a1d3404dcf9219f7b
SHA512e5e963a476f07bb3795f015f54882a5f391408bcc0c9a50e7715037c007c76e8f338f86cd8976ffa3f439558fe39fda71a56f300451181a6834ed0fd7b63e128
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/984-2260-0x0000000002650000-0x0000000002690000-memory.dmpFilesize
256KB
-
memory/984-2258-0x0000000002650000-0x0000000002690000-memory.dmpFilesize
256KB
-
memory/984-2255-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/984-2248-0x00000000009B0000-0x00000000009DE000-memory.dmpFilesize
184KB
-
memory/1292-121-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-138-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/1292-103-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-101-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-105-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-107-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-113-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-111-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-109-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-115-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-119-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-117-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-93-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-123-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-125-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-127-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-130-0x0000000000400000-0x0000000000A95000-memory.dmpFilesize
6.6MB
-
memory/1292-132-0x0000000000290000-0x00000000002EB000-memory.dmpFilesize
364KB
-
memory/1292-134-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/1292-133-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-129-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-136-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/1292-137-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-99-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-140-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-142-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-146-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-144-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-189-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/1292-188-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/1292-2236-0x0000000002970000-0x00000000029A2000-memory.dmpFilesize
200KB
-
memory/1292-95-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-97-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-91-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-89-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-87-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-85-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-83-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-81-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-80-0x00000000050B0000-0x0000000005110000-memory.dmpFilesize
384KB
-
memory/1292-2238-0x0000000005130000-0x0000000005170000-memory.dmpFilesize
256KB
-
memory/1292-78-0x0000000002900000-0x0000000002968000-memory.dmpFilesize
416KB
-
memory/1292-79-0x00000000050B0000-0x0000000005116000-memory.dmpFilesize
408KB
-
memory/1736-2257-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/1736-2259-0x0000000002420000-0x0000000002460000-memory.dmpFilesize
256KB
-
memory/1736-2256-0x0000000000B40000-0x0000000000B70000-memory.dmpFilesize
192KB
-
memory/1736-2261-0x0000000002420000-0x0000000002460000-memory.dmpFilesize
256KB