Analysis
-
max time kernel
211s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
09-02-2022 18:35
Static task
static1
Behavioral task
behavioral1
Sample
09022022.exe
Resource
win7-en-20211208
General
-
Target
09022022.exe
-
Size
265KB
-
MD5
37c86eea298f12684500f2083a2e4e7d
-
SHA1
4c84e078d068e2a79ddbc48d03459e87390cb756
-
SHA256
46adc5850ed556d130d5d35db220fc303d45d719960e7e4b4b56174e9cdd3850
-
SHA512
8a9ea9cf85e375a5b4b50789c6cf1041172400916a045c735987929c52081ff25748bfa404472c580261f8251f37973ba30ecdbc464f0546f702518ff87cd09a
Malware Config
Extracted
xloader
2.5
uar3
sgadvocats.com
mjscannabus.com
hilldaley.com
ksdollhouse.com
hotgiftboutique.com
purebloodsmeet.com
relaunched.info
cap-glove.com
productcollection.store
fulikyy.xyz
remoteaviationjobs.com
bestcleancrystal.com
virtualorganizationpartner.com
bookgocar.com
hattuafhv.quest
makonigroup.com
officecom-myaccount.com
malgorzata-lac.com
e-learningeducators.com
hygilaur.com
kgv-lachswehr.com
salazarcomunicacion.com
robopython.com
corporateequity.online
complianceservicegroup.com
aperza-ex.com
webflowusa.com
asesoriasfinancieras.xyz
missolivesbranches.com
numiquest.com
criskconsultancy.com
gotemup.com
themaptalk.com
lakebalboahalf.com
cateringfrenchcroissant.com
paddocklakerealestate.com
lojaquerosurprezza.store
courtneywhitearmusic.com
geovannimaquinadevendas.online
pricklypairjazz.com
engagedigi.com
conduitforthespirit.com
anaheimaletrail.com
wholesalemall.store
alertsbecu.com
gestion-kayfra.com
youcanstores.com
qsuo.net
formadv.info
dihesia.xyz
carrreir.com
twenteeminuteswithtee.com
realliferenewal.com
officialprokodsukses.icu
stanfordgrouploscabos.com
maxicashpromir.xyz
zysqshjs.com
trc-clicks.com
chsclbd.com
amdproduce.net
republicoflies.com
beaux-parents.com
lucrativeapp.com
milbombas.com
alexanderplaywear.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1264-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3952-143-0x0000000000800000-0x0000000000829000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
qgerjshzns.exeqgerjshzns.exepid process 1800 qgerjshzns.exe 1264 qgerjshzns.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
qgerjshzns.exeqgerjshzns.exeexplorer.exedescription pid process target process PID 1800 set thread context of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 1264 set thread context of 2412 1264 qgerjshzns.exe Explorer.EXE PID 3952 set thread context of 2412 3952 explorer.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 51 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132890817338552928" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.292449" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3932" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4112" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
qgerjshzns.exeexplorer.exepid process 1264 qgerjshzns.exe 1264 qgerjshzns.exe 1264 qgerjshzns.exe 1264 qgerjshzns.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe 3952 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
qgerjshzns.exeexplorer.exepid process 1264 qgerjshzns.exe 1264 qgerjshzns.exe 1264 qgerjshzns.exe 3952 explorer.exe 3952 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
qgerjshzns.exeexplorer.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1264 qgerjshzns.exe Token: SeDebugPrivilege 3952 explorer.exe Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
09022022.exeqgerjshzns.exeExplorer.EXEexplorer.exedescription pid process target process PID 3660 wrote to memory of 1800 3660 09022022.exe qgerjshzns.exe PID 3660 wrote to memory of 1800 3660 09022022.exe qgerjshzns.exe PID 3660 wrote to memory of 1800 3660 09022022.exe qgerjshzns.exe PID 1800 wrote to memory of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 1800 wrote to memory of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 1800 wrote to memory of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 1800 wrote to memory of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 1800 wrote to memory of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 1800 wrote to memory of 1264 1800 qgerjshzns.exe qgerjshzns.exe PID 2412 wrote to memory of 3952 2412 Explorer.EXE explorer.exe PID 2412 wrote to memory of 3952 2412 Explorer.EXE explorer.exe PID 2412 wrote to memory of 3952 2412 Explorer.EXE explorer.exe PID 3952 wrote to memory of 1428 3952 explorer.exe cmd.exe PID 3952 wrote to memory of 1428 3952 explorer.exe cmd.exe PID 3952 wrote to memory of 1428 3952 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09022022.exe"C:\Users\Admin\AppData\Local\Temp\09022022.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeC:\Users\Admin\AppData\Local\Temp\qgerjshzns.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeC:\Users\Admin\AppData\Local\Temp\qgerjshzns.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exe"3⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\akvjxtp6f43vMD5
14823dd88a486c9049dc8e39e95e8d6c
SHA1fe4faa49db61f5e4dce75a41bd4e3006b0f2fed8
SHA256ee11c5923f5ec6cc1c3db829cd59d9ee4a3cc85404c68e4ab90177f010eb13c8
SHA512e43f375eb42952580dab5f8acdd81a88e0b8c4de659b0406afd1599bbb044b71a53b353d67615fa4d2a1c7191e1e35d9e58d5ce6bdd18311e74df0f41201b560
-
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeMD5
61c6afe8eb1faafafbe8ee85d527d30e
SHA1c3ec3a8a18ab801d7191ae3c3fc08d1dae3bdf46
SHA256034f1d54ff9954dba589f77cf229352e339424a9f35199f23cb979c05bb889ed
SHA5124eff030db73d65b490ab20e58034f116dc123a24b22dfb9e7d82676544085b314e52148d868f1135b8e9d80ec78c4757b4461ec1fdd42f29fcac1a5e4e5a9591
-
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeMD5
61c6afe8eb1faafafbe8ee85d527d30e
SHA1c3ec3a8a18ab801d7191ae3c3fc08d1dae3bdf46
SHA256034f1d54ff9954dba589f77cf229352e339424a9f35199f23cb979c05bb889ed
SHA5124eff030db73d65b490ab20e58034f116dc123a24b22dfb9e7d82676544085b314e52148d868f1135b8e9d80ec78c4757b4461ec1fdd42f29fcac1a5e4e5a9591
-
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeMD5
61c6afe8eb1faafafbe8ee85d527d30e
SHA1c3ec3a8a18ab801d7191ae3c3fc08d1dae3bdf46
SHA256034f1d54ff9954dba589f77cf229352e339424a9f35199f23cb979c05bb889ed
SHA5124eff030db73d65b490ab20e58034f116dc123a24b22dfb9e7d82676544085b314e52148d868f1135b8e9d80ec78c4757b4461ec1fdd42f29fcac1a5e4e5a9591
-
C:\Users\Admin\AppData\Local\Temp\uxxvuqyvjaMD5
43572ef3180d3c5c33a5cf9d62a6d696
SHA1e079bf345f9b9133ecc1813839c4182ee6285802
SHA2563a09220007d41f44063d266b9cf59c30e85b22e3bf33546c272046f32ea32abe
SHA5129045ef3ea42ed91767e7b70c1e7641aaa44f2c6bd9a83f6db301a691b88e4e7e015e77fc6f578f49fad51f8e582563fa3fb68d8013c4078e3a62078b7684d7bd
-
memory/1264-137-0x00000000009E0000-0x0000000000D2A000-memory.dmpFilesize
3.3MB
-
memory/1264-134-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1264-138-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1264-139-0x00000000009C0000-0x00000000009D1000-memory.dmpFilesize
68KB
-
memory/2412-140-0x00000000088B0000-0x00000000089C5000-memory.dmpFilesize
1.1MB
-
memory/2412-145-0x0000000008B10000-0x0000000008C9D000-memory.dmpFilesize
1.6MB
-
memory/3952-141-0x0000000000C00000-0x0000000001033000-memory.dmpFilesize
4.2MB
-
memory/3952-142-0x0000000004C00000-0x0000000004F4A000-memory.dmpFilesize
3.3MB
-
memory/3952-143-0x0000000000800000-0x0000000000829000-memory.dmpFilesize
164KB
-
memory/3952-144-0x0000000004A30000-0x0000000004AC0000-memory.dmpFilesize
576KB