Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 07:39
Behavioral task
behavioral1
Sample
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe
-
Size
43KB
-
MD5
fc41fa53d929a710c69082af94cc2547
-
SHA1
d7363e135c0eb0919dbbc309b63aa25812a161cf
-
SHA256
7155d35c0b7b12363bfcfad8d2692221c031612e2194743bbccf3b6754684aa7
-
SHA512
154e48be55c2c1a80539b1b282daf6f3caeff1e71e1bd703e50c1fd6e4075f0048d2924b43849a196ba271f080e4c7bd2a1dba84c77a67c8b16a08ad2e109cc6
-
SSDEEP
768:LpgDlh9nHtJbzwsp7YHHQXtSH0y9teIKVv/eHOVq1dtQYXmXH4:tgH9NJbRYHHSSUyQV30OQIYXmXH4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchosts.exepid process 3640 svchosts.exe -
Processes:
resource yara_rule behavioral2/memory/3932-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Windows\svchosts.exe upx behavioral2/memory/3932-58-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3640-92-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exedescription ioc process File created C:\windows\svchosts.exe fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe File opened for modification C:\windows\svchosts.exe fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101685" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e15d6e14f38454ea63b5f1bfd9517020000000002000000000010660000000100002000000081060da339c8450322e79473e911ece61f7bdebcd1dce974a9c49590fb665de0000000000e800000000200002000000011e173e9aeddd932e6c323e83c343520e1d4f6ea9afb66ca50ae8d5eb3f528232000000048c3f4dddc3d869a11f98f4eb072a6bd66b5e3f0c11b61e47a014b244e6ff0c44000000066cbc9ba6216ae55549f51781a5a6ad95f0437ea0ebb03b7bcc99cae22e834aad787caea47394b51c4d55833ce75893dc5a8065077a44c749e8a1f34b3fa78e9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4211516521" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d90600f692da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4272610603" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101685" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101685" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2570AFEC-FEE9-11EE-B9F7-4E42E906E3A8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4211516521" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00beffff592da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420363762" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e15d6e14f38454ea63b5f1bfd951702000000000200000000001066000000010000200000001815552ace0e6233a7554a4e37742c52e5a2146e04aab1c73e9b3308948f5e9d000000000e800000000200002000000099927055cdebb3ce3b7714a69589e20f7ef2d85abbf5cf089f7cb605c7f7782820000000a048664c8fcf7c4a6df15151a11e30a2f318e2851b9075df8522dda25546947840000000192a2a6ea9237b42a4789226dd1302245f8ddea19afec0aa0d980d396c18c852b821b95832daba26800c7f5fe6614bd5c83aeb866162da0dcb166d0d7f6fdd3c iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exepid process 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exesvchosts.exepid process 4556 iexplore.exe 3640 svchosts.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exesvchosts.exeiexplore.exeIEXPLORE.EXEpid process 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe 3640 svchosts.exe 4556 iexplore.exe 4556 iexplore.exe 1460 IEXPLORE.EXE 1460 IEXPLORE.EXE 1460 IEXPLORE.EXE 1460 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exeiexplore.exedescription pid process target process PID 3932 wrote to memory of 3640 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe svchosts.exe PID 3932 wrote to memory of 3640 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe svchosts.exe PID 3932 wrote to memory of 3640 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe svchosts.exe PID 3932 wrote to memory of 4556 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe iexplore.exe PID 3932 wrote to memory of 4556 3932 fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe iexplore.exe PID 4556 wrote to memory of 1460 4556 iexplore.exe IEXPLORE.EXE PID 4556 wrote to memory of 1460 4556 iexplore.exe IEXPLORE.EXE PID 4556 wrote to memory of 1460 4556 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc41fa53d929a710c69082af94cc2547_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\windows\svchosts.exeC:\windows\svchosts.exe auto2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\progra~1\Intern~1\iexplore.exeC:\\progra~1\\Intern~1\\iexplore.exe http://jianqiangzhe1.com/AddSetup.asp?id=137&localID=QM00013&isqq=32⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4556 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD54e981d0b7c38bdc36065b0244ef73c15
SHA1c9ec66cc6b2049c4801d9256cdf50bfa772227e8
SHA256ffde49ad889e401f6b4e5df21406b6bdee53635137333c4947f990013472d3e4
SHA512a77173d5b6759bf062a1a0766f7de0456958435b671ed4ca8dad2cc434b2a707d1cf0c3a6038886f7f5bbed030efff46028c7bd0b478f09a47283589b2851a30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD57a6f5afa4d1259d9f71aadbe9b88be14
SHA159224033840f779a2418ea22596f197ff59b6dfb
SHA256ab8da443c7f92919633d050136a5969ada6bdea107ad064e5370510d838f6588
SHA512e53845b9d8721413c3f4074bad3a10a02e89edd0dee2827b1e92fb5ba26d421b6c22968d0b9d6e5d5567e66d861a820a4f9dc7e8227b2922a09474f05ec1a3bb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Windows\svchosts.exeFilesize
43KB
MD5fc41fa53d929a710c69082af94cc2547
SHA1d7363e135c0eb0919dbbc309b63aa25812a161cf
SHA2567155d35c0b7b12363bfcfad8d2692221c031612e2194743bbccf3b6754684aa7
SHA512154e48be55c2c1a80539b1b282daf6f3caeff1e71e1bd703e50c1fd6e4075f0048d2924b43849a196ba271f080e4c7bd2a1dba84c77a67c8b16a08ad2e109cc6
-
memory/3640-92-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3932-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3932-58-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4556-38-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-42-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-18-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-19-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-20-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-21-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-23-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-24-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-26-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-28-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-29-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-30-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-31-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-32-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-34-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-36-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-37-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-16-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-39-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-40-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-41-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-17-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-43-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-44-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-48-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-49-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-50-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-51-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-52-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-57-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-15-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-65-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-66-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-67-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-68-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-69-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-71-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-72-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-74-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-14-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-13-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-11-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB
-
memory/4556-10-0x00007FFC9DF30000-0x00007FFC9DF9E000-memory.dmpFilesize
440KB