Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 17:08
Static task
static1
Behavioral task
behavioral1
Sample
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f18ee353e998df41e42bba9b08f8c2bb
-
SHA1
9d2999a9f0b48f3daf58138746ed63ce7fff87c5
-
SHA256
16fff93cc6b11e2340af9b406d49c5ef8f219019ddd5c985c4cd0035d25318e3
-
SHA512
b7223defc6dea444aa664547a5506bb4dc59bc0c5b300b7747a47ce12aabbba8bb687b85d247e8972062cf052c1ddb462f06b18beb7087fcb0619d77867bc220
-
SSDEEP
12288:4w7QsLhBN9aTom5Ou3jOh3jr+GBGnr+9q0psu9kVss6NC0ENbkjWd:Thf9aTXEu3YjBGnjis1KTY0E2j
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
sammorris@askoblue.com - Password:
london12#
Extracted
nanocore
1.2.2.0
185.140.53.52:4488
f373bcfb-36f5-4636-8770-9da829010f62
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-06-03T23:05:48.798919236Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4488
-
default_group
AUGUST
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f373bcfb-36f5-4636-8770-9da829010f62
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.140.53.52
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\sammorris.exe family_agenttesla behavioral2/memory/4340-45-0x0000000000AC0000-0x0000000000AFC000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exeexplories.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation explories.exe -
Executes dropped EXE 3 IoCs
Processes:
explories.exesammorris.exeInstallUtil.exepid process 2840 explories.exe 4340 sammorris.exe 1772 InstallUtil.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1832-6-0x00000000063F0000-0x0000000006418000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explories = "C:\\Users\\Admin\\AppData\\Roaming\\explories.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Subsystem = "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe" InstallUtil.exe -
Processes:
InstallUtil.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
explories.exedescription pid process target process PID 2840 set thread context of 1772 2840 explories.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File opened for modification C:\Program Files (x86)\DSL Subsystem\dslss.exe InstallUtil.exe File created C:\Program Files (x86)\DSL Subsystem\dslss.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 452 schtasks.exe 2072 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exeexplories.exesammorris.exeInstallUtil.exepid process 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe 2840 explories.exe 2840 explories.exe 4340 sammorris.exe 4340 sammorris.exe 1772 InstallUtil.exe 1772 InstallUtil.exe 1772 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
InstallUtil.exepid process 1772 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exeexplories.exesammorris.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe Token: SeDebugPrivilege 2840 explories.exe Token: SeDebugPrivilege 4340 sammorris.exe Token: SeDebugPrivilege 1772 InstallUtil.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.execmd.exeexplories.exeInstallUtil.exedescription pid process target process PID 1832 wrote to memory of 1192 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe cmd.exe PID 1832 wrote to memory of 1192 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe cmd.exe PID 1832 wrote to memory of 1192 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe cmd.exe PID 1192 wrote to memory of 4112 1192 cmd.exe reg.exe PID 1192 wrote to memory of 4112 1192 cmd.exe reg.exe PID 1192 wrote to memory of 4112 1192 cmd.exe reg.exe PID 1832 wrote to memory of 2840 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe explories.exe PID 1832 wrote to memory of 2840 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe explories.exe PID 1832 wrote to memory of 2840 1832 f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe explories.exe PID 2840 wrote to memory of 4340 2840 explories.exe sammorris.exe PID 2840 wrote to memory of 4340 2840 explories.exe sammorris.exe PID 2840 wrote to memory of 4340 2840 explories.exe sammorris.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 2840 wrote to memory of 1772 2840 explories.exe InstallUtil.exe PID 1772 wrote to memory of 452 1772 InstallUtil.exe schtasks.exe PID 1772 wrote to memory of 452 1772 InstallUtil.exe schtasks.exe PID 1772 wrote to memory of 452 1772 InstallUtil.exe schtasks.exe PID 1772 wrote to memory of 2072 1772 InstallUtil.exe schtasks.exe PID 1772 wrote to memory of 2072 1772 InstallUtil.exe schtasks.exe PID 1772 wrote to memory of 2072 1772 InstallUtil.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f18ee353e998df41e42bba9b08f8c2bb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explories" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explories.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explories" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explories.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\explories.exe"C:\Users\Admin\AppData\Roaming\explories.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sammorris.exe"C:\Users\Admin\AppData\Roaming\sammorris.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DSL Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6BB5.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DSL Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6C62.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\Temp\tmp6BB5.tmpFilesize
1KB
MD5f7eb19c49b51cdff67a25c6876a78241
SHA16d86be501c2fb57b50292a55d3983b7eee8a688d
SHA256c9dab73a0044021d2acbc3952b19dea98cdfd838afc633197bd1bd12d2562fba
SHA5121e94e363f9d4d0dcdfe0a8457642fcfe4f81dff0b39f1d1f00deab9291e133cd40b48c097dfe52c356d4a15c383e0aa08fae28b136937bcc57d5e01861716740
-
C:\Users\Admin\AppData\Roaming\explories.exeFilesize
1.3MB
MD5f18ee353e998df41e42bba9b08f8c2bb
SHA19d2999a9f0b48f3daf58138746ed63ce7fff87c5
SHA25616fff93cc6b11e2340af9b406d49c5ef8f219019ddd5c985c4cd0035d25318e3
SHA512b7223defc6dea444aa664547a5506bb4dc59bc0c5b300b7747a47ce12aabbba8bb687b85d247e8972062cf052c1ddb462f06b18beb7087fcb0619d77867bc220
-
C:\Users\Admin\AppData\Roaming\sammorris.exeFilesize
216KB
MD573fb6676b0ac7ac3b8ed03aa722d27a4
SHA100b96f9a5e7d24417521cd132ac59a70cfafbadc
SHA2567ffed1437958571da174fa7ad51fa462e95c82151364739e0099155fabda41a8
SHA512882ba0df42594d2936cb34dec1b2fc986a3bdc9b2f7a14b7b7e18af5b8c4fec01ebb2636d7ea8e9fe41fb635f1104792def1570dc0393dc4a474b223f6e61ed7
-
memory/1772-54-0x0000000004DB0000-0x0000000004DBA000-memory.dmpFilesize
40KB
-
memory/1772-49-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1772-69-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/1772-68-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1772-64-0x0000000006030000-0x000000000603A000-memory.dmpFilesize
40KB
-
memory/1772-63-0x0000000005EF0000-0x0000000005F0E000-memory.dmpFilesize
120KB
-
memory/1772-62-0x0000000005E60000-0x0000000005E6A000-memory.dmpFilesize
40KB
-
memory/1772-53-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1832-4-0x0000000004EA0000-0x0000000004F3C000-memory.dmpFilesize
624KB
-
memory/1832-14-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/1832-3-0x0000000004E00000-0x0000000004E92000-memory.dmpFilesize
584KB
-
memory/1832-27-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1832-8-0x0000000006480000-0x00000000064A2000-memory.dmpFilesize
136KB
-
memory/1832-9-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/1832-10-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1832-1-0x00000000002A0000-0x00000000003F4000-memory.dmpFilesize
1.3MB
-
memory/1832-6-0x00000000063F0000-0x0000000006418000-memory.dmpFilesize
160KB
-
memory/1832-7-0x00000000064C0000-0x0000000006526000-memory.dmpFilesize
408KB
-
memory/1832-5-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/1832-0-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/1832-11-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/1832-2-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/2840-31-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/2840-29-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/2840-52-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/2840-26-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/2840-46-0x0000000009E60000-0x0000000009E66000-memory.dmpFilesize
24KB
-
memory/2840-42-0x0000000007820000-0x0000000007834000-memory.dmpFilesize
80KB
-
memory/2840-30-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/2840-28-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/4340-48-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/4340-65-0x00000000057B0000-0x00000000057C8000-memory.dmpFilesize
96KB
-
memory/4340-66-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/4340-67-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/4340-45-0x0000000000AC0000-0x0000000000AFC000-memory.dmpFilesize
240KB
-
memory/4340-44-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB