Analysis
-
max time kernel
112s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
15-09-2024 00:36
General
-
Target
105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe
-
Size
146KB
-
MD5
a5f2eeb4c5cbb2c2ff3b103e304c4a37
-
SHA1
604025da6efc564ae2b3b92c33eb3a2995ca81a4
-
SHA256
105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398
-
SHA512
96e766e4f3aefacada98a5336320db9d26c5d7d5d150125183e5415786b57d46b3383880910cfbdcd0928960d4abcaeba19c0854b0fb4a863391f0b13617bf4e
-
SSDEEP
1536:NzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDrZ5bKzpnSPyZxedH4UnFgDXv0R:eqJogYkcSNm9V7DmSPNHnFsvCT
Malware Config
Extracted
C:\RCl10Ol9q.README.txt
328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2
Signatures
-
Renames multiple (10646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 32 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe"C:\Users\Admin\AppData\Local\Temp\105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\8691.tmp"C:\ProgramData\8691.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8691.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{6963CE1D-316B-43BC-894E-9C517949B64D}.xps" 1337083425947700002⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55adb34a66cfd3984f31474eb6f95b9bc
SHA18d92f2cebf5fbbd15288f7c613034e1bf8332892
SHA25673b6d74d89c16b1773c434d574b201cf46586ec6f0e5a6d7859962a691720580
SHA512013146745fce52505b414b069c5c5bc11a422fb6ae115ad55701a469699a1a5cccb8c3e4bd6e2f9d0375b1eed32b4eba34b52edc69652acdb79ba8e0b3d7732d
-
Filesize
47KB
MD5e7d8aff8a096d40a32873b414f1e4b4b
SHA121dca4980ce1fe21ab53d2bec5af9d77af782418
SHA25601d846651cd236f52898e227ebc3714c5db6f06c25a95de45311d4c78e6dc93e
SHA51200bcb27185020bfc4db049ab7f101642c82a5745058c6e63fe5708e1e802c992233baef8732bae7f4555285742d81133720c4a6d291779c6bcef82e0d8c35fc0
-
Filesize
43KB
MD5a55c8673ff64469abe13a320d3c43a6c
SHA143cec407adad27814ed7c5e3aa178e6df83dbedc
SHA256770a0a662a0d435aa0082b5dd060011c0dcd30e285c557fb07b7d634d018840e
SHA512fdcdc8e3bb5b05e288ebc28f15879b94373ccb28896d35e0fca4b5391a49d0fb656b7b80a9fd462a62768f1c4dfa8bc69fa49e57d880d124a86ab8df1ef49c8b
-
Filesize
17KB
MD592a7490842348039bd63343985ad6ab0
SHA12ec785db0e19271687e09f3af283dcdde08fe6b3
SHA256edddcda06a5a44aff87f687358d3d9fbb6e8c2e7d268ee857bc8ff967c26ad8f
SHA5121a61780bf046515dd42200b78739327b8ac98aa6e5208937aed7107b6799efbbce03141c40fea2026f6f415ac3773f9e4e637a3bc9d4fdc8d37e06b427be5887
-
Filesize
92KB
MD51c9f9253cc45f8eaaba83e861197320e
SHA1f6ad6b07fce9846a6f5798df618d6b7b412ddbbe
SHA2565604cd3ae7edfbd11341dd0b7a38c3128ac01027befb293d136fa9304906aa5f
SHA5127898ae5c5c62afbec5bed7a62dff30b221d915cc10440acad025ed3cf8ad0db4e217c1c7a569ff87bd5465eec2d4e0c1f14fc06d5800c77b0f4ab9554c733a4e
-
Filesize
10KB
MD563f6d38f8dab943b4727b45a0005c413
SHA1e2c6a4518ac8a1be185ffa28181d3e090b9cc62a
SHA256fb39ad8b5d35161423080e97c6632bda26fcf2bcc35ca5454ada623bd434bc05
SHA5123050b03ec4decc33df8a0195c3cf1505b1c9c1da3759de602e521c92b28ef122ff482bd1a58fe631f7566480f6dba88536076e2eaa1a29e355dea2b3a4c46076
-
Filesize
7KB
MD56580bc63781e48e211ab6fdde6d2d348
SHA192b0aa10689a9f81aa1b3c61a068d68c66aab6a4
SHA256652830dc5991285c5f9fd94ffd1fafe04910566793ebab22456b96086c1da6ba
SHA512612623eb2db523edfcfbbfcc3fbbf1454e759efc7ef68a7c5ab4e7c2ab68e125387294f2f3ce46f96f3a8d34a21f1e9ecfac149cef55a6d48bb22c834befab37
-
Filesize
5KB
MD50658653af95cee23ef3d23f4de5ee05d
SHA14928f57cb070050d5816c122faea6763e1bdbf4d
SHA256c58ee3ab4247214aea3498fbcbf61d1818351f27e3c9957e8751274ac6928307
SHA512dc004967f056c8abeb75dbc674b43d2df191c9aca70197f32db16ac4bdeda73729c13a108150a14ce33c57c116804d4a84171a425352e2804844d0635b857cb9
-
Filesize
24KB
MD5824c218776391149407cdfcd458f20d8
SHA14d4f3686952a055923833bdd3849c7d503adae97
SHA2561d1b156ae1d5d9d03dc90af44244bf57e242ef75c056cace0c3fb6e34c957cbd
SHA512382f71e7e98520d11b6991aa8c1dd45a9ea10c2cb3a509d1af3bb11bad64108a7df03e5f6cc3771b945bd6227b96a32590ea9f70d52e40bc447f00fa43e92a19
-
Filesize
3KB
MD530cb46f3a44d78693a2611688f0fb96f
SHA113ff6a77d748933a193b9581a64d2b0be688e748
SHA256d0845cbc51797b8c9f9ef6339777e6182dbcf4eb682d60bb47f869a395b33c1a
SHA512275079bf12d0fc5dd3adaf3d004b7627dfa716e981fa2189a58064aeedf5fd27dc07a39a0603ae2152aaf467da2361c5db261ee0ed4f14c0d21d9b11b00f4db5
-
Filesize
9KB
MD5c7850422b72c1d52957dad5531f2dc28
SHA1388768af674a5e9a0d7d22ea8d228c00f0096a56
SHA256e10f28372f89bdc9811cc801bf70b6f1876fa494cb92dcba5fb8205ce6be68d1
SHA512eece1ab06c554bf0fd57e01a432c8060590822cb09ec99de5a9f5acbc389d7f395b9ef551e27b8eb58657315b99683136814a62a0070c03c76daea67cce8a175
-
Filesize
3KB
MD57a95d60251b2fef98790fc39746a46ce
SHA1bd6bb802f58fdc9cb5abc779a34a4f876c486675
SHA256bf5a64b89b0c54c6f8ac01eac9678217d6441e64c30f0a1e0d265a277cd69f1c
SHA512c936010512b4e74a201ea0fa95d42b7ea42341ab89d8ac574d800f7f7d00ee4619df0882a28e0115f156e80d8b4aec9e8c9ad402dcb394c31d6bc7f509b49267
-
Filesize
5KB
MD5b8d0d856cc37558f9963fcf76d9b0278
SHA1a10d106c69a15ba792bcd07146752bf7c903e4c3
SHA256a19d79eaffb20d919418a8db220557a430da1606c8d83f9df497d5ecffa92718
SHA51270dc21d8ad2baa5a934f4c0205fa94bb2d22ae2861bae46f5f330fe6c78e1be1fd558c666243c0e5e0f80d92b61edea4d53e31556f5372f89ae3a93dbc8fabd2
-
Filesize
3KB
MD55997886d68f951b65eb56819ca55d745
SHA193270ba742953d5c9eef994ada4196cc532865eb
SHA256bea10bc1fd639d4dba282bba82fbbcef4f10f12e98301134c9a4ce042cd0657a
SHA5124dd43e11b6db6e85b57e9046ef3729a9845c63f4e87ffad9694be301ce2c0db8235ba37270dab55a2c36332a747bc4a1b75aff57d9432e0296b1664953760c6e
-
Filesize
3KB
MD5cc4487ad92c9947e93a9accce70ef912
SHA1eb2d8a7989d890190070509e0533dfdbb8bdeb50
SHA2562cce689a0382e12c1833a8b03c96d219f4d8004da3c9f9ab9f77b7ab407c243a
SHA512a411efceba01af5651271b017b2ad5c1e5d28f03aab1812d90962f0afe3001679ba89e77744f837a0052c37aa04dc117e66c21c39762821dccf8e46eb91781cd
-
Filesize
53KB
MD59836c992a197016238a266e13e1353c7
SHA1385bd95fa37f035272b4a788db06827d9c368592
SHA256cc4a298d8cfbcf46de165a90cdff3a376b35a6f7ebb60032cd51d3ad959276b5
SHA512878b9a2cc81f152a1528c4b53350de53da15ae6ece454720a7aa7a2c84a951eb42b063b9ce44e96aaef85d47d104d7e64c2d9efb764e644d49e81cbd4b8f786d
-
Filesize
3KB
MD538dcad1b9f1aa4d7deb629d1f3a216b6
SHA1d38913f1d7720cd3b20d736cc47ff87de48ddf37
SHA256e15c328397e97615034179b6abb466bcf6d7b40316b16633b5caefce42f5e938
SHA5126266152218c3cd6112c6f4472f594eb282cc80012c0ed9a4bda74b8876673c054f37ae31866f509a5aeee55b86f44b42f6ebd483fcbca131b8b6adc0606d925c
-
Filesize
4KB
MD5af8bc358e077a738e8a4b7f6eb72041e
SHA1de0e797d2ff11be7992800d2d95a110b0e6cda4f
SHA2565fbabffbad29a1a30497c5f0af2d4d809b9e2c54109f724b7de44a46862381d7
SHA5125daa91130a375aaa258436d354fc674725ca19a2e56ac7e06169d08a325713d83e731d9b57373697b00a0f363bce7e4d393862be8d5032bb63dfc5c78007f959
-
Filesize
3KB
MD5b5e09acabe7feeaa56cf5bd51903f5ac
SHA1c2c4cf0d896d5ffffcbc6bd5989c70de8e330a28
SHA256c6884333eba83b13f4ec42dbba11032d806b9415aff6cc9d6c8022d3e0f4afad
SHA512c965bcb34437a81d9d72d818dbcb8e827347a8cb81546511fcd7d9717f5603dce1b3005b72aa2163d008f3713ff55887e4dc2233e0d251eb6b13e1702fc4d91f
-
Filesize
49KB
MD5cf9a6bcfb4ad71ac89e3a42a5c4c00d5
SHA10a7f17cc46a81ce9f02be0b0e4f6cd0a6da12ffa
SHA256ca72dfa68e238181d83101e4754985069577e06963baf07c2995ab94ac6bf656
SHA512177ef3aa5d2665723ace774d725c3b6b8d2c1a38492db92f5bc41ffe0901e760cd5d08265bd237611fb3e626969314b57310741000d3315df611de830fb7bb01
-
Filesize
8KB
MD5c02ebaeeb1e5b44b323eb253325ac6f5
SHA18843bb0f4106929ab898fc14010b40834ced3bae
SHA25619066910c2f6c4c91f45d606e69083b61843de931fc3eb34924e5c83a533d101
SHA5128cf2fa906ca1ebbfdc1d30578559b3c68c1cd0007e41d50bacbc55c8ffae71ca2d20511718e9f7960df2b486d98cb2dbe1528c4a903373f0f61f477bc2c690bc
-
Filesize
16KB
MD5e09886a8e4a14cd7085d2d53a8acbcba
SHA19cf71e6727b614aeeb0eae41281c701ae3b52d51
SHA2562246ca61eea1c587e46feb63b1a3219bc572772fe19342f1b46001f98c89c4e9
SHA512cec7c1be0dc6a59788b021245d8e06c62f8436433e23c22bf41018d5b9c19731b2a9e467e985d08b330541466e4e9d68946e027a49e7417cc7c3e466d70e9096
-
Filesize
555KB
MD55bc57b8e2e7590349002ac62bfb8e6f8
SHA17e53a7774c3cc0a204fa1cab0004869e78b2814a
SHA256e2d7fa8b60d6fcf8d9afe7d50fdd6f6f3b5d3202e86635db01b6d732e8107e33
SHA512e4e1ba330a9967582339a232b7d73c5be2758f763d9f582c55f583c22a43c044db2197939cc67c670577299bde9df1f6485e8b5c3fc438301d103fa23aa66c66
-
Filesize
319KB
MD557c7b0a94744ce6523e9d5b3d87cf046
SHA19859cbdc1a458bcf9315d0d65ed2cdc562edda46
SHA2567abf4f426525438d6a14b2b653c1ba5c5eea8af774707a47b1c9d7e44156ebde
SHA51283a825effcc66ff29d1a15e9b9ba84d0a3b130a06eefe91df38b22b49c9259f98e8059c18e7e36eb52055c5627a4d7eaf64133ee1bcc482c3ab09f8388826c38
-
Filesize
35KB
MD5c19bc1a54b8ea1fd0241b4a8827851b8
SHA15f3b45c5f073d3583c6d70765d7b392554d4431c
SHA2566db75fdc6cbb380ee2644ae09f57378c761568b10912db6baa069f0fbf482f1a
SHA51203f88f279b2e778bf68a34bf45e0e6d8dda48d0e7b0077e953f3bac6f169628a20786a9a9e2b1ca2e3e588d989cc9971336ea5b526058bcf535fba0837a4720e
-
Filesize
92KB
MD52580290b1e5712b0fefc38a6ff06e115
SHA11ce764c2d902db219bc764ed964cc234e3aa337a
SHA2563c850de2119d6311dff3e575797a476011d8272007d7dc82ae47771c9811d2a4
SHA5123101d88490dcf8717c504f7b791a236ba366060433aeb12d1b1d80b01bfe3b264ea787901a32ef6ec19c5e9be576bb0b19ef9ff15177644d05f6e2d80c3e28ce
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
1KB
MD56c20c5b93268232ba3bcb18e6dd215af
SHA12008645dde0884ad7bed5732a4005968472e7ca2
SHA256ce7e57b1ee943eeb6ec10d4556da9b16f2cb02401109d60590bb8f78ddbde478
SHA5124a2465070eff7a0e3d99fe137634f2a7768f5df383f4b10fb00f214c40f4843e0712c117c1b0e422ce7650d3ae04e5d1b4993b7029f3007a52fb68e408a1346c
-
Filesize
14KB
MD522cdbc7a1ef3b83b5401a82b74adc38f
SHA1f2242156eef5caf483e4a00ac4491a29acb003d5
SHA25634a46763c6e611a919964cd7b518935308220cc995931f30c9556caee23f4c82
SHA512609b3213196176edfb246cd8ebd914bd9d348e0d5cc815e4c1757c8138feffb373e8e909269bc1b25f7ab61e051c5a7fa8448e9cab2e4909ff46ff79954971be
-
Filesize
17KB
MD5b3e27e4d949a384acf9bf4d49f6f0bb3
SHA1e5dae6ba2e1d639ddcbf8ecd343561aebe46ba2a
SHA256d0d012478f51a621689124f2bb212e28bc1404027861c8f6724efa371e90fce2
SHA51275760c9014eb5f4e95776cabbf564613a0ff27417fe4f286ab84f783d3ea2a71758e552cec583d4d75f33d74d96df76f3269e348387e501dd086b8d1b18873e7
-
Filesize
2KB
MD5b142e664948180b1f992208f5c9b8de9
SHA162b3e2e909585de6434754f0e0d49d643d31a651
SHA256510dd19bfa96cbc550fc6f76b14c2186afa6cfa5e7afc4f176d66ea6634b2e29
SHA5122fd1198d5ab66a5eabdc2a45f36a75f193404b0d65e77d8a5213c631b80ea58094adbfe4097b20aaca38b7e34460ee3655687ade9eab1262c3d538b779a72376
-
Filesize
19KB
MD55cf4e6060bae419911312a172e813234
SHA1f064ed712b8c1e529296a404438c62ed9ff52fc7
SHA256ad801dd8767b76e9d6895a2fa542cefa5e8c52e143bb4e526ee6781a4561322a
SHA5129ffad954df295b27322f13f5aacb259b54ca8f83b7d592f9cac9fef47be20b44a5c10962764ed8ec88eebf3adbf4cd61a3996e3d7f6338607b6f267666ca8b54
-
Filesize
10KB
MD50883bd5c463c5ae57e3cd84e8f2adcb7
SHA1376330e45c799379d3649de596635cbe499f99cd
SHA256cf338db863dd86bfcb7f14b5d6f511488b97fbb6ea9bffa88ca9d5576c89e517
SHA512ae2b641d2372c34d817a0f67d649dd723fa02354d930571191380ecc6ca3d6ad69b7d8dbe8e4b7f64db2d42d098d48f3f8f8f1ef20b07a174594eadd0fd51425
-
Filesize
11KB
MD543be0474482b1788a61d3e48f589d11f
SHA1401ee31aa5f53bbb0dbdbdc2f36508f360198e63
SHA25688b4cb4348ca01951fe9712ef654ff9e94ae652b056175955901b22dbc0b18a1
SHA5121f20d66481ecf07e663c874fff5a22b7184f4721e33545f105c022403f4a8f7ff45ee720ec6c952376f41075a7b0b13003ce1f4c2a136eb971547ebba14538c4
-
Filesize
846KB
MD5766f5efd9efca73b6dfd0fb3d648639f
SHA171928a29c3affb9715d92542ef4cf3472e7931fe
SHA2569111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc
SHA5121d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434
-
Filesize
146KB
MD5d93cc0ed554fbc743e67aed7b5d506bf
SHA14d26c0f97400b1adc4f33a65baaba1b927062521
SHA2564c4de3695174894f651fefb45751b0c733af99bf4fe4ddfeefd4e037227ab0c5
SHA512981f33477e346208ad75554374a732775ec2f38ee37ad93df6218d8a33b04b9ba465694d0f2ce96f5f99c5c10db1c087dbd318f05c545aa3e9462cc83d35f0fe
-
Filesize
129B
MD518487ef850a7c227d0602609208f5103
SHA181743b839afadcdfc669a127ee14bedea827a24f
SHA25668218650056038cb5ec9d4f3dcbbf1c6a6ee8d8d4040231f13b12ed418548a5f
SHA5129aab59f4a303c9ee70091582986236756af844aba063e98e871931e919a410e383c3c94459791df6a893233abe0815edf2b4a5a6006cfaadbd40d48c2deb17ca
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB