Analysis
-
max time kernel
135s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:53
Static task
static1
Behavioral task
behavioral1
Sample
a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe
Resource
win10v2004-20230220-en
General
-
Target
a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe
-
Size
713KB
-
MD5
205dc0e4775f6a76606070a68bde089b
-
SHA1
55c2a844f61b9d7e98d84b557f9d82024a4172eb
-
SHA256
a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670
-
SHA512
27622c98711484742251f6bca3bea404cb979d21ba1beee67c234dd83c5df96520635b3195ac65d3d802b769de8d5f44ca0aa1bdbe5fa053b6078ef9c6be23f5
-
SSDEEP
12288:mSibsV1r1eXRKAaCwprt7hyU/+BGN95KKVLQFkW31fBBv409iS9uB:Q4zr6EAaCurt9bGBGN95KlFJ39gc9u
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
Processes:
jr155826.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr155826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr155826.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/212-159-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-162-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-160-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-164-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-166-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-171-0x0000000004C60000-0x0000000004C70000-memory.dmp family_redline behavioral1/memory/212-172-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-168-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-174-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-176-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-178-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-180-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-182-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-184-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-186-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-188-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-190-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-192-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-194-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-196-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-198-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-200-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-202-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-204-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-206-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-208-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-210-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-212-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-214-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-216-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-218-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-220-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/212-222-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
zinW6705.exejr155826.exeku638698.exelr892963.exepid process 1424 zinW6705.exe 1904 jr155826.exe 212 ku638698.exe 4328 lr892963.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
jr155826.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr155826.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zinW6705.exea578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinW6705.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinW6705.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 524 sc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3540 212 WerFault.exe ku638698.exe 3984 3760 WerFault.exe a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
jr155826.exeku638698.exelr892963.exepid process 1904 jr155826.exe 1904 jr155826.exe 212 ku638698.exe 212 ku638698.exe 4328 lr892963.exe 4328 lr892963.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jr155826.exeku638698.exelr892963.exedescription pid process Token: SeDebugPrivilege 1904 jr155826.exe Token: SeDebugPrivilege 212 ku638698.exe Token: SeDebugPrivilege 4328 lr892963.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exezinW6705.exedescription pid process target process PID 3760 wrote to memory of 1424 3760 a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe zinW6705.exe PID 3760 wrote to memory of 1424 3760 a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe zinW6705.exe PID 3760 wrote to memory of 1424 3760 a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe zinW6705.exe PID 1424 wrote to memory of 1904 1424 zinW6705.exe jr155826.exe PID 1424 wrote to memory of 1904 1424 zinW6705.exe jr155826.exe PID 1424 wrote to memory of 212 1424 zinW6705.exe ku638698.exe PID 1424 wrote to memory of 212 1424 zinW6705.exe ku638698.exe PID 1424 wrote to memory of 212 1424 zinW6705.exe ku638698.exe PID 3760 wrote to memory of 4328 3760 a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe lr892963.exe PID 3760 wrote to memory of 4328 3760 a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe lr892963.exe PID 3760 wrote to memory of 4328 3760 a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe lr892963.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe"C:\Users\Admin\AppData\Local\Temp\a578c1f90e2b849008145caafa58de43f5ccf0a61918bce73212b6d9da9db670.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr892963.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr892963.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 212 -ip 2121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3760 -ip 37601⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr892963.exeFilesize
175KB
MD5c5dd023f8011ccb36487cbb5c9d0badf
SHA1a67e24c344df3cefdd1dc924db45ca67e101e3d4
SHA2567016afd4aa13923a95ff6fd67b2e42b91f55fd31e20930af14f289cd9b19ec0c
SHA5122373e18ce0dc56b3067e3b989fc857e0b1c337dc3bf00e3066c082de5d4879f11d8d4d020473f2b56eeb67e1effb919e5af7442c762c273943a6fc25f58a5412
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr892963.exeFilesize
175KB
MD5c5dd023f8011ccb36487cbb5c9d0badf
SHA1a67e24c344df3cefdd1dc924db45ca67e101e3d4
SHA2567016afd4aa13923a95ff6fd67b2e42b91f55fd31e20930af14f289cd9b19ec0c
SHA5122373e18ce0dc56b3067e3b989fc857e0b1c337dc3bf00e3066c082de5d4879f11d8d4d020473f2b56eeb67e1effb919e5af7442c762c273943a6fc25f58a5412
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exeFilesize
407KB
MD5cabb3463f51c332c467c2ff736fe05bb
SHA1aadc455ffed9978efd77f729064bb0d4b178f595
SHA2564fad65b6cabba38e0ec7b35cd8a81c916f5d73b24e5428a2107e115a1daad86d
SHA512b4146c8234fdfcbf3fdceee02951896dc408f98ffc93a255239e1e6943a1a960c8f29ffaffd70e14fcd4d4c18f64b83603efef8e7615f330082880e6c0aff9d4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinW6705.exeFilesize
407KB
MD5cabb3463f51c332c467c2ff736fe05bb
SHA1aadc455ffed9978efd77f729064bb0d4b178f595
SHA2564fad65b6cabba38e0ec7b35cd8a81c916f5d73b24e5428a2107e115a1daad86d
SHA512b4146c8234fdfcbf3fdceee02951896dc408f98ffc93a255239e1e6943a1a960c8f29ffaffd70e14fcd4d4c18f64b83603efef8e7615f330082880e6c0aff9d4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exeFilesize
11KB
MD55fa07e8ccf055edf11bd2372900432f0
SHA1ddc5d6fc54d06df47d85955411b5036334f194a0
SHA25681e8f55b18c82e85455874813ef9da8e01a50963ee05cf8a8763c05b146037c6
SHA512353b21e2294e81b3b324e9e2ad7157fbe8ad0ad5e51f2020d1ab080783c20c11ee176240f8a06b37bfc70f694a272981c3fea65729415d7bd0ecd00a7ae272ea
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr155826.exeFilesize
11KB
MD55fa07e8ccf055edf11bd2372900432f0
SHA1ddc5d6fc54d06df47d85955411b5036334f194a0
SHA25681e8f55b18c82e85455874813ef9da8e01a50963ee05cf8a8763c05b146037c6
SHA512353b21e2294e81b3b324e9e2ad7157fbe8ad0ad5e51f2020d1ab080783c20c11ee176240f8a06b37bfc70f694a272981c3fea65729415d7bd0ecd00a7ae272ea
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exeFilesize
380KB
MD56e32a72abf890a2c9a13c750398cc48d
SHA10e684f0273666a9129c94c15c7426dcf803928f4
SHA2568e26a07ce5e3e1a02b7f5eb9f6c8ef802ebc58fb8b2d9c2dd03b63cedfb76082
SHA512a52d4cb4d29f9c5d7029c168ca693b9b844525866eb6944ff72274ae6ba83a2657bade67028e15d16abc2e62a0b20f4470db769fa501ad34624790c9cc08aa77
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku638698.exeFilesize
380KB
MD56e32a72abf890a2c9a13c750398cc48d
SHA10e684f0273666a9129c94c15c7426dcf803928f4
SHA2568e26a07ce5e3e1a02b7f5eb9f6c8ef802ebc58fb8b2d9c2dd03b63cedfb76082
SHA512a52d4cb4d29f9c5d7029c168ca693b9b844525866eb6944ff72274ae6ba83a2657bade67028e15d16abc2e62a0b20f4470db769fa501ad34624790c9cc08aa77
-
memory/212-200-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-210-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-159-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-162-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-160-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-164-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-166-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-169-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-171-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-172-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-168-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-174-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-176-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-178-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-180-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-182-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-184-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-186-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-188-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-190-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-192-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-194-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-196-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-198-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-157-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-202-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-204-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-206-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-208-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-158-0x00000000071D0000-0x0000000007774000-memory.dmpFilesize
5.6MB
-
memory/212-212-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-214-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-216-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-218-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-220-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-222-0x0000000004C00000-0x0000000004C3F000-memory.dmpFilesize
252KB
-
memory/212-1067-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/212-1068-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/212-1069-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/212-1071-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/212-1070-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-1074-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/212-1075-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-1076-0x0000000008A90000-0x0000000008B22000-memory.dmpFilesize
584KB
-
memory/212-1077-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-1078-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-1079-0x0000000008C90000-0x0000000008E52000-memory.dmpFilesize
1.8MB
-
memory/212-1080-0x0000000008E60000-0x000000000938C000-memory.dmpFilesize
5.2MB
-
memory/212-1081-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/212-1082-0x00000000095F0000-0x0000000009666000-memory.dmpFilesize
472KB
-
memory/212-156-0x0000000002C60000-0x0000000002CAB000-memory.dmpFilesize
300KB
-
memory/212-1083-0x0000000009690000-0x00000000096E0000-memory.dmpFilesize
320KB
-
memory/1904-149-0x00000000001F0000-0x00000000001FA000-memory.dmpFilesize
40KB
-
memory/3760-148-0x0000000004A30000-0x0000000004ABB000-memory.dmpFilesize
556KB
-
memory/3760-150-0x0000000000400000-0x0000000002BE0000-memory.dmpFilesize
39.9MB
-
memory/4328-1091-0x00000000009D0000-0x0000000000A02000-memory.dmpFilesize
200KB
-
memory/4328-1092-0x00000000055D0000-0x00000000055E0000-memory.dmpFilesize
64KB