Malware Analysis Report

2025-03-15 06:45

Sample ID 250123-bkgb1svlex
Target f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
SHA256 f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
Tags
fake2 orcus discovery persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8

Threat Level: Known bad

The file f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8 was found to be: Known bad.

Malicious Activity Summary

fake2 orcus discovery persistence rat spyware stealer

Orcus family

Orcus

Orcurs Rat Executable

Orcus main payload

Orcurs Rat Executable

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-23 01:11

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-23 01:11

Reported

2025-01-23 01:14

Platform

win7-20240903-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\fake2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\fake2\\fake2.exe\"" C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\fake2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\fake2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1968 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2428 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2428 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2428 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1968 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 1968 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 1968 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 1968 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 1968 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 1968 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 996 wrote to memory of 1544 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 996 wrote to memory of 1544 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 996 wrote to memory of 1544 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 2776 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2776 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2776 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2776 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2928 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2928 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2928 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 2928 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe

"C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bfr3shln.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8595.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8594.tmp"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

"C:\Users\Admin\AppData\Roaming\fake2\fake2.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {AFFECF9A-90A5-45AC-A5BA-A73BE1133D55} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

C:\Users\Admin\AppData\Roaming\fake2.exe

"C:\Users\Admin\AppData\Roaming\fake2.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Roaming\fake2\fake2.exe" 2776 /protectFile

C:\Users\Admin\AppData\Roaming\fake2.exe

"C:\Users\Admin\AppData\Roaming\fake2.exe" /watchProcess "C:\Users\Admin\AppData\Roaming\fake2\fake2.exe" 2776 "/protectFile"

Network

Country Destination Domain Proto
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp

Files

memory/1968-0-0x000007FEF5B8E000-0x000007FEF5B8F000-memory.dmp

memory/1968-1-0x0000000002130000-0x000000000218C000-memory.dmp

memory/1968-2-0x0000000000400000-0x000000000040E000-memory.dmp

memory/1968-3-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

memory/1968-4-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\bfr3shln.cmdline

MD5 ceafc081b003812cecd81a82f02fabae
SHA1 f418dfacec31131f35e15a08b136f46ef9532512
SHA256 700911825d2e2c50cdac3a67f4d12ac076e599a7468bb686451ec8a88718a67d
SHA512 e29be4c075424f0ccbdf4856e2477600d19dd7987de6ee0b2a51aa2f90ee7768ddb5198307232c760c88590a01ab1d4681f51bbd090a6050355c02d11ecff7b0

\??\c:\Users\Admin\AppData\Local\Temp\bfr3shln.0.cs

MD5 54511f23d6e93f391ec061e65eb8ecba
SHA1 cf4d8d8b57a36cfd710d41020e09d2816c692725
SHA256 66c5f9da5b51fbe62b5c8ca38dca18f90f226df574a4caf0ffdd0e5c1211edbe
SHA512 39f77b2a752f36918b4ccd286ac428302d37a8edd566a0226cd1c000a6fc029e8c05f8cc90de21143a678fcae62c28bf05e94d454c193f32c21a3448c0046116

memory/2428-10-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES8595.tmp

MD5 1f727fe360a2f92c4728f39ca48f4de2
SHA1 1fcb701711c667dff6fe9fbcf517cad8d6052782
SHA256 8eb1f67a119fc1438fcd80a04d3dea28afd9d699ac9f3a368cb50e7241e0a054
SHA512 9dfba258647e13d1fc4fce4bfb935fb6234355e89a30e176aa30a8a8950a195ab2c474c5f7a97ca0abc99f3d52728d6604e25445adafcd305f4cc337c3b948c3

\??\c:\Users\Admin\AppData\Local\Temp\CSC8594.tmp

MD5 8c00d634b7baf7d8f8db0151dbe17550
SHA1 3ab3d5588c38d17120934b271d56fbefc20ab391
SHA256 49994be07caa29d4d25b6a86ce33c29ec04c42232979c799612e57ca53fabbca
SHA512 279e4712dc8519d13ce9dae51fbd2efb877f19e97f753b32c1b2d714cd5ce4cd8484608b34288d80f8e3642269ed67a28cf263951eedc62333655b0e16df84b3

memory/2428-17-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

memory/1968-19-0x00000000005D0000-0x00000000005E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bfr3shln.dll

MD5 1bfe730d6e2b1cd6ff0356f15b3c80fd
SHA1 f1f7127827354ffe509f720ae7d3a89400f69104
SHA256 55d23ff2e9f88d234c3d5e199dbe8f6c7ce9bc1ee8b9476bfaa25286e33c3ea8
SHA512 615b510d73a3c131b4bbbac58970892987e12d6372cee992a2045f36a9cb65e79525d6c12fbef696ccbf63f7e552571330dbfa15b2eb661454adf7b6234eb0ce

memory/1968-21-0x0000000000430000-0x0000000000442000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe

MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/2852-29-0x0000000000210000-0x000000000021C000-memory.dmp

memory/2804-33-0x0000000000370000-0x000000000037C000-memory.dmp

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

MD5 b08bc930dc90e54bc888a9b8195ecc12
SHA1 3019337f580bdc0c54c01a79e5144143fe10f17d
SHA256 f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
SHA512 c3b8f048730ce8a0ac767bcdf970189af6034a2a7e6e7360b111f83008b32665c4f6cc9e23e4cbe8228931f1a0a56bfe1c89a776aafbbe49b898814fe38c3f20

memory/1968-42-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

memory/2776-43-0x0000000000EF0000-0x0000000000FDC000-memory.dmp

memory/2776-44-0x0000000000D00000-0x0000000000D4E000-memory.dmp

memory/2776-45-0x0000000000D70000-0x0000000000D88000-memory.dmp

memory/2776-46-0x0000000000D90000-0x0000000000DA0000-memory.dmp

C:\Users\Admin\AppData\Roaming\fake2.exe

MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

memory/2928-56-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-23 01:11

Reported

2025-01-23 01:14

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\fake2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fake2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\fake2\\fake2.exe\"" C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\fake2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\fake2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\fake2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2748 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2748 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 4500 wrote to memory of 4972 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 4500 wrote to memory of 4972 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2748 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2748 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 2748 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe C:\Users\Admin\AppData\Roaming\fake2\fake2.exe
PID 3852 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 3852 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 3852 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Roaming\fake2\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 4876 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 4876 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe
PID 4876 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Roaming\fake2.exe C:\Users\Admin\AppData\Roaming\fake2.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe

"C:\Users\Admin\AppData\Local\Temp\f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kx593qlt.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC1B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCC1A.tmp"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

"C:\Users\Admin\AppData\Roaming\fake2\fake2.exe"

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

C:\Users\Admin\AppData\Roaming\fake2.exe

"C:\Users\Admin\AppData\Roaming\fake2.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Roaming\fake2\fake2.exe" 3852 /protectFile

C:\Users\Admin\AppData\Roaming\fake2.exe

"C:\Users\Admin\AppData\Roaming\fake2.exe" /watchProcess "C:\Users\Admin\AppData\Roaming\fake2\fake2.exe" 3852 "/protectFile"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 218.158.40.23.in-addr.arpa udp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
N/A 192.168.50.22:10134 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp
N/A 192.168.50.22:10134 tcp

Files

memory/2748-0-0x00007FF9D5CD5000-0x00007FF9D5CD6000-memory.dmp

memory/2748-1-0x00007FF9D5A20000-0x00007FF9D63C1000-memory.dmp

memory/2748-2-0x000000001BB00000-0x000000001BB5C000-memory.dmp

memory/2748-5-0x000000001BD00000-0x000000001BD0E000-memory.dmp

memory/2748-6-0x000000001C1E0000-0x000000001C6AE000-memory.dmp

memory/2748-7-0x000000001C750000-0x000000001C7EC000-memory.dmp

memory/2748-8-0x00007FF9D5A20000-0x00007FF9D63C1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\kx593qlt.cmdline

MD5 ba5062aafaf722ae8b81c09a0be92c25
SHA1 9164ec04e3360f36a18b5d396badd05385af3e98
SHA256 804bad1f3cd75d813ceb9d36aa17a3ef6d87a01768c9113e76f437c06726ddff
SHA512 14bd25138de1b3f388baaf3263dd0078d7cece99170c0a87b08ab9f7cbf33c4ab2125fc70d32b392f6fb23dcf766fbff1bb0667cc622db246d8b6feb7f839e11

\??\c:\Users\Admin\AppData\Local\Temp\kx593qlt.0.cs

MD5 666a535aea3c55f005c1ce79fb98aee6
SHA1 308d1a8cadbb564ae0d74899a36a94895efa764f
SHA256 819d5854949905bb0d924d1d9fc2120f4e81bc435a868a3419d662f1a315d1d3
SHA512 b22af6aba6c01f3b3fb9b59e7c28621db56f8d687026ed5ba6f737f7b2c101031ef5f94159ff0fd84491bdd0bb623eb087094a2ee23bad58200312b78bfd1e7e

memory/4500-16-0x00007FF9D5A20000-0x00007FF9D63C1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSCCC1A.tmp

MD5 c0687b87b0d6b16cff18fab043abbe38
SHA1 908fc14bbe05d52ce18b7ad54226cf011eb98912
SHA256 d370ca9753eaabd6cfee42590649aa997350e684fe8117df48e9103bc078ac30
SHA512 62ace48640dea6175ae12c964bb1aab6550af25a98d54a48eaaab95a361197fa0f911906293565f272f5a1709a9a1755f2eddbeede6ee1297bc24fa6d38ba6b2

C:\Users\Admin\AppData\Local\Temp\RESCC1B.tmp

MD5 798c2b45f6fe7d414f47a07eb83f7c17
SHA1 110ec82d4a1099339555e2b6ae3fbc3b51160628
SHA256 97322808d840e58de933d49a7186112f59c60f1a190cc140bb318a126c54368b
SHA512 cfd74a5e7288ac112bc2858e38a0b6a5a8d02f589698a9be9b2e26f7f7a04ec4207383c6058a1ecb45fe382e0d47a1f09aece2edc61c89078831744d932f959f

memory/4500-21-0x00007FF9D5A20000-0x00007FF9D63C1000-memory.dmp

memory/2748-23-0x000000001C820000-0x000000001C836000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kx593qlt.dll

MD5 4ae562459ec2e6110dc83197c7a675bb
SHA1 6073a9a654d1b15ae407ea3424b6bf8d62d5fe40
SHA256 f7b8b9f0225abb198aa27189e46906c5c79c322aa20b8d020938d35a9053952a
SHA512 e88f1b330991eeef7656a238a4252346a0985c5ebae472a357971d9b07e7da3b5ee603fa8e420795248a491bafed376652dec4f867eb6343acedda826b2fddba

memory/2748-25-0x0000000001590000-0x00000000015A2000-memory.dmp

memory/2748-26-0x000000001CE50000-0x000000001CE70000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe

MD5 e6fcf516d8ed8d0d4427f86e08d0d435
SHA1 c7691731583ab7890086635cb7f3e4c22ca5e409
SHA256 8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512 c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/4120-40-0x00007FF9D2C13000-0x00007FF9D2C15000-memory.dmp

memory/4120-41-0x00000000008A0000-0x00000000008AC000-memory.dmp

memory/4120-42-0x0000000002930000-0x0000000002942000-memory.dmp

memory/4120-43-0x0000000002990000-0x00000000029CC000-memory.dmp

memory/756-48-0x0000000019F00000-0x000000001A00A000-memory.dmp

C:\Users\Admin\AppData\Roaming\fake2\fake2.exe

MD5 b08bc930dc90e54bc888a9b8195ecc12
SHA1 3019337f580bdc0c54c01a79e5144143fe10f17d
SHA256 f15288549b3206cac5192ee6449f4b1f2ed796e3a7e72dad63b239e4660447f8
SHA512 c3b8f048730ce8a0ac767bcdf970189af6034a2a7e6e7360b111f83008b32665c4f6cc9e23e4cbe8228931f1a0a56bfe1c89a776aafbbe49b898814fe38c3f20

memory/2748-64-0x00007FF9D5A20000-0x00007FF9D63C1000-memory.dmp

memory/3852-65-0x0000000000AF0000-0x0000000000BDC000-memory.dmp

memory/3852-66-0x0000000002D70000-0x0000000002D82000-memory.dmp

memory/3852-67-0x000000001C610000-0x000000001C65E000-memory.dmp

memory/3852-69-0x000000001C7A0000-0x000000001C7B8000-memory.dmp

memory/3852-70-0x000000001CB60000-0x000000001CB70000-memory.dmp

C:\Users\Admin\AppData\Roaming\fake2.exe

MD5 913967b216326e36a08010fb70f9dba3
SHA1 7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA256 8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512 c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

memory/4876-84-0x0000000000760000-0x0000000000768000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fake2.exe.log

MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1