Analysis
-
max time kernel
130s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 09:01
Static task
static1
Behavioral task
behavioral1
Sample
ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe
Resource
win10v2004-20230220-en
General
-
Target
ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe
-
Size
957KB
-
MD5
1066367e51504598d01235568b1e3160
-
SHA1
76fa608cea4e17fabfa913c6fa08ef4102f441fa
-
SHA256
ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87
-
SHA512
2dc94cd380f9ee167c840627ae2d7cd214f0c13bc4e29503c1af0d391151b04ed8ec6efe53488ebae94cf3881a93af2e15c2c35f1fc86c2956de7422f1a99f46
-
SSDEEP
24576:ny46CVotleLUkEfzhq0KVzUaDjV2BgZwahwIsWkHaTMdd:ySoDEUkw90zUaDp2BgZwxfWAl
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1412-4467-0x000000000AB50000-0x000000000B168000-memory.dmp redline_stealer -
Processes:
1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
26086113.exerk877764.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 26086113.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation rk877764.exe -
Executes dropped EXE 6 IoCs
Processes:
un556759.exe26086113.exe1.exerk877764.exe1.exesi264981.exepid process 4796 un556759.exe 1632 26086113.exe 4928 1.exe 4804 rk877764.exe 1412 1.exe 3432 si264981.exe -
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un556759.exeffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un556759.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un556759.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2176 1632 WerFault.exe 26086113.exe 4692 4804 WerFault.exe rk877764.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1.exepid process 4928 1.exe 4928 1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
26086113.exe1.exerk877764.exedescription pid process Token: SeDebugPrivilege 1632 26086113.exe Token: SeDebugPrivilege 4928 1.exe Token: SeDebugPrivilege 4804 rk877764.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exeun556759.exe26086113.exerk877764.exedescription pid process target process PID 2600 wrote to memory of 4796 2600 ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe un556759.exe PID 2600 wrote to memory of 4796 2600 ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe un556759.exe PID 2600 wrote to memory of 4796 2600 ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe un556759.exe PID 4796 wrote to memory of 1632 4796 un556759.exe 26086113.exe PID 4796 wrote to memory of 1632 4796 un556759.exe 26086113.exe PID 4796 wrote to memory of 1632 4796 un556759.exe 26086113.exe PID 1632 wrote to memory of 4928 1632 26086113.exe 1.exe PID 1632 wrote to memory of 4928 1632 26086113.exe 1.exe PID 4796 wrote to memory of 4804 4796 un556759.exe rk877764.exe PID 4796 wrote to memory of 4804 4796 un556759.exe rk877764.exe PID 4796 wrote to memory of 4804 4796 un556759.exe rk877764.exe PID 4804 wrote to memory of 1412 4804 rk877764.exe 1.exe PID 4804 wrote to memory of 1412 4804 rk877764.exe 1.exe PID 4804 wrote to memory of 1412 4804 rk877764.exe 1.exe PID 2600 wrote to memory of 3432 2600 ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe si264981.exe PID 2600 wrote to memory of 3432 2600 ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe si264981.exe PID 2600 wrote to memory of 3432 2600 ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe si264981.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe"C:\Users\Admin\AppData\Local\Temp\ffb08f8996da357e03cd5f99a542a1002d310e4d140e229a0b501646a9079f87.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556759.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556759.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\26086113.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\26086113.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 13844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk877764.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk877764.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 13764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si264981.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si264981.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1632 -ip 16321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4804 -ip 48041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si264981.exeFilesize
168KB
MD549a7cd8816549617e1f3170f4211ecfe
SHA1e0ddb22231e187a51d4bf9149318d9e589438b04
SHA25653cbec41e7270321735124077961f416a3e9a7191d0a3598c2bca57d0967000e
SHA512e70272c75b476a28d47bf79774ea7542ff451ad0a668875bda5617cc35c673182c69b3a06a4b4328c3a1a81f937b1cb90faac37410e511a0aa772339e4992de3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si264981.exeFilesize
168KB
MD549a7cd8816549617e1f3170f4211ecfe
SHA1e0ddb22231e187a51d4bf9149318d9e589438b04
SHA25653cbec41e7270321735124077961f416a3e9a7191d0a3598c2bca57d0967000e
SHA512e70272c75b476a28d47bf79774ea7542ff451ad0a668875bda5617cc35c673182c69b3a06a4b4328c3a1a81f937b1cb90faac37410e511a0aa772339e4992de3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556759.exeFilesize
803KB
MD532043255442fd325dcf3968fcebfd730
SHA1e386f9ddc5f19a362ba3c33b7a8c3e1b9e2192e4
SHA2561dd8fdc387c5938e4597cecd0304111d18d5a11985c5619abbd0a680393fed86
SHA51257b64ae9fbdb1a819bcb74930d032b73bba666285c170d4b5ba313c1c583a1151cc2320e97a7496dca4d9cbf940dc64dec678d368d5552c9ddd3a8347ff5eda1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556759.exeFilesize
803KB
MD532043255442fd325dcf3968fcebfd730
SHA1e386f9ddc5f19a362ba3c33b7a8c3e1b9e2192e4
SHA2561dd8fdc387c5938e4597cecd0304111d18d5a11985c5619abbd0a680393fed86
SHA51257b64ae9fbdb1a819bcb74930d032b73bba666285c170d4b5ba313c1c583a1151cc2320e97a7496dca4d9cbf940dc64dec678d368d5552c9ddd3a8347ff5eda1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\26086113.exeFilesize
479KB
MD52dfd8ea770548c4db22810ca92d3fba2
SHA1408d04f70ed0379ae77f26482bb56168e62a864a
SHA25656d8d7b43b0e9f3c6b5db5ed5c0acc146b8d033680075c56f14879f60a0436a0
SHA512d0d1c4ad74d47d7da6cf1231b76d1a29e4a1ea8f57d638e4bc84b7257756b01266b7576cdbc7d3c7b77c67c2d9f0c7e0c7e239b8f53e7a30285a57f60a6d37cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\26086113.exeFilesize
479KB
MD52dfd8ea770548c4db22810ca92d3fba2
SHA1408d04f70ed0379ae77f26482bb56168e62a864a
SHA25656d8d7b43b0e9f3c6b5db5ed5c0acc146b8d033680075c56f14879f60a0436a0
SHA512d0d1c4ad74d47d7da6cf1231b76d1a29e4a1ea8f57d638e4bc84b7257756b01266b7576cdbc7d3c7b77c67c2d9f0c7e0c7e239b8f53e7a30285a57f60a6d37cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk877764.exeFilesize
539KB
MD5ff7277c4bce50a0e64489a0006e6049f
SHA102f27c7cbe10c58cd1633aa41eb80708b941669d
SHA2560ddc40d0489f54557d3c329ac047e7787dec381e614bd9b7e833af427c720391
SHA5129d37c026288570f77846932ba5728fe2deaa13f9deaaee34ff008ee52b5b0b22a5aa0cadfa3654f5ff729e10cb43f6294ca7378dbc96add2c7c6eaf0000ae555
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk877764.exeFilesize
539KB
MD5ff7277c4bce50a0e64489a0006e6049f
SHA102f27c7cbe10c58cd1633aa41eb80708b941669d
SHA2560ddc40d0489f54557d3c329ac047e7787dec381e614bd9b7e833af427c720391
SHA5129d37c026288570f77846932ba5728fe2deaa13f9deaaee34ff008ee52b5b0b22a5aa0cadfa3654f5ff729e10cb43f6294ca7378dbc96add2c7c6eaf0000ae555
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/1412-4475-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/1412-4467-0x000000000AB50000-0x000000000B168000-memory.dmpFilesize
6.1MB
-
memory/1412-4465-0x0000000000800000-0x000000000082E000-memory.dmpFilesize
184KB
-
memory/1412-4469-0x000000000A640000-0x000000000A74A000-memory.dmpFilesize
1.0MB
-
memory/1412-4474-0x000000000A570000-0x000000000A582000-memory.dmpFilesize
72KB
-
memory/1412-4476-0x000000000A5D0000-0x000000000A60C000-memory.dmpFilesize
240KB
-
memory/1412-4478-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/1632-195-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-2295-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1632-173-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-175-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-177-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-179-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-181-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-183-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-185-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-187-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-189-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-191-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-193-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-169-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-197-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-201-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-199-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-203-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-205-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-207-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-209-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-211-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-213-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-215-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-2281-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1632-171-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-2296-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1632-167-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-2297-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1632-148-0x0000000005020000-0x00000000055C4000-memory.dmpFilesize
5.6MB
-
memory/1632-149-0x0000000000820000-0x000000000086C000-memory.dmpFilesize
304KB
-
memory/1632-150-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1632-165-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-163-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-161-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-157-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-151-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/1632-159-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-155-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-153-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/1632-152-0x0000000002990000-0x00000000029E1000-memory.dmpFilesize
324KB
-
memory/3432-4473-0x0000000000670000-0x00000000006A0000-memory.dmpFilesize
192KB
-
memory/3432-4477-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/3432-4479-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4804-4466-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/4804-2375-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/4804-2373-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/4804-2372-0x0000000000830000-0x000000000088B000-memory.dmpFilesize
364KB
-
memory/4928-2293-0x0000000000EA0000-0x0000000000EAA000-memory.dmpFilesize
40KB