Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
0cbfd948e04866957f9f791f8736ea52_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0cbfd948e04866957f9f791f8736ea52_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0cbfd948e04866957f9f791f8736ea52_JaffaCakes118.html
-
Size
4KB
-
MD5
0cbfd948e04866957f9f791f8736ea52
-
SHA1
ca221fc832d5587eea8cca715aecdb68dd11af92
-
SHA256
e4b01f398760e0858916262a1a7a1d2422ee4892d86dd6a631aa91c3d265fabb
-
SHA512
9faa0b7bb13865d29c6f8493aae25eeed78ed169757d1fd639db0f804ced352b978a1227741aa91b0a830faf9b9213bbd1a386141878e7df0e283b9d24d42c22
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oheTLSB9:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDs
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420756478" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10df6e93049cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000000560d95e9fb1c0aac2fa0b8b77775f6f7564417142f41f523e4d1355a5507c8a000000000e80000000020000200000000db1435fcbad9e18a091230127ffdb62509d15d857d452732637a3b9443d715020000000e674530cdd565360dfd9f1f7d0c000bbcaf3545be69b99620a706e1ec5da03c840000000d9f616125bef11596c2779e71b0e8eac79632ef0c4072efff1cf80a5c8c6c5170491aeff491290a58e76537b099eed0d1e85c0030df21bbe92ca16c785a65655 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cb2c527a444c85c920bfd0c73bde8af748a91a7254f43149bbbcfa0d96f2d4fe000000000e8000000002000020000000ed88d2b3a1d53bf6e8b2b612382c1c597aaaa564ec8d08ff82790cefa6b19b60900000004200dc144ca3351b8b676f4214ce5e84b85cfae24bf24bbb79cee7c509f4b1f1012e7e0c03d99fcaa9bbd54c4e92a22d8237e9595dd9c99bea44d9602294fcf9e5641239491d0311a6a10ee495b191987d5c69959f236ce76791725c09053cbf4f6008fcb70770af71465fa5c1e84826dc0bf9de57588e7aff8a6418d6eecedc465f32f91154573aad8e287b6ce5dd3a4000000098d00e2c3823a2fc11cf03b879feae6c8154c56b936e1841f5fb25c059192c9ea931f5344b3c70125aa2e0ef09a25b31cd0bc9cd63cdddf1cbf01adf9e6a499a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEE2A641-07F7-11EF-8547-E6D98B7EB028} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE 2156 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28 PID 2172 wrote to memory of 2156 2172 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0cbfd948e04866957f9f791f8736ea52_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574dc3d554ff447a0302da32755d6c378
SHA1395cd7c91fa4f07056cb1003a136e1d093d658bb
SHA25675015a1261a0d97144f589218fb66c8502ec2e258a353ce95969d0f95459b7ee
SHA51246695a652c8629241ea415de5720f36e57ee9ae8d99dd62873b5ac244fac322dfbd727a6070931316f3de08b86ed6e0bc193bdf6dc81809243573cfc94608f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cb0c6bf76f0e58592cebe3bfd06d5f5
SHA17b51a21618c31afb8ecaf85f3efbf5ee0128a345
SHA2565c4c2c85534aa1c16b7de3a47f7abeec2582bd8b30eb485962c864676b4f0fbd
SHA5125877df33818682d6a2d7489c8de7542c0ac8bcb01e852784ab4dd76675f66cc6e2476611674e942623c6c19b43de1c074aaae167e08f98a413c35de515a5928f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5527941bbe129cb7d4e5106e0db1adcc8
SHA1d55a20ca9f22f90475a03590d6f50c52b68eee2a
SHA2561f19ea30e5e348f7426319261165def4acabc5c2cdbc6e42560aa5e65a54f7ff
SHA5129e817f01164887b865c235743606ace0e5ae61242e4d54f7f276345918f9be1dfc33b95eea9ec942f35ad3cdd485439dcc02de0edc76fd3d41f1848883c3da87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ff4160a18d4ef6c89eb86f57a75fe39
SHA1be2289d6c967748a85d3c0e909948c8f82acbd8e
SHA256a872a9a481b422f2fec48dc63586866f1f0b08a52c504fb993218df581f3e3f0
SHA51288f27415eb3221df07eb397e2b3016e9dbc76a236b737dd3b27aa4afd119da12fa7f484eba53986788a2c63387f380c1caee5038388ffc2903c5776dcb9a8b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c87083e3b322c897cd29885b2b2cc1ff
SHA14f859d1b50db20422b872f1787e8432c11ec7a2d
SHA256772c757abcd682f373baf21e00ef6de3c0f4d9d6b7c0e47fe43c3042e5e4cca4
SHA512874950ae3a1b113c98714c818b2623416c7a3e4caf0742f8c77d88a0ff5358db221cd4e594fd534c822f76b3053a42fbf95f07c9da487d082d48618370c6336c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5795cee805e22db407c45818b38f7e0b5
SHA14e390fe6541fd3f6ad7afd43e42db57cdb31a62a
SHA256562310fb14b5ed464354ed72eda3192ef43b26c58dc8b723c194e506e0a1295f
SHA512b44ee0ef543499ce895f832169ca0dfed5c92d9d207029e03d98eed8d8dcbf71ad20091a8a7d9cd70796e0a061f113a3bad1bdd3532d42b1de4e7f2266014745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c2738a2c3fcdbc5bc7ee3d6e97446aa
SHA1f20674452d03fb3cfba2bb34c2f9643967a71553
SHA256ead50c1e4133d7337978e66b3c38e7dd9bd4df90e4617a0f53db934200454dba
SHA512d8189a2f87f47593f437e0ac189356c81a5be7abff864c9ddda7e090a2b03411f77232e35488e44ee7a020965abc933e8cdaab880fb0b1498af6e061d616593f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513d0aadb9965dbd2379b7a2e2efd4940
SHA108185893c249fd1b44112c55d87b5d9881331c3c
SHA256a42096739e70480977f2bb139ee48fa34475528576f745206d0fefbb1e5094d4
SHA512d1572f1fc0aff32940d95a149c0c5e10c4a9727157513ef2f3f203f4a1a60db80c6896dd28010ed001605dea98bd1bf7b8dc38ee23050daff0ce2e73a1419338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5599bdcd4e25f681eb843c11655a0fe1a
SHA1c991870b8029794faf2c97c6414bf17c3acdefc9
SHA256bbdb59068f399d5e873895a2e2bcb181e07fe274a24c9db738995f843a54db2f
SHA512f0b94550a158f224e6a6af1277c5a62681b7819b9cc15d479fde0982eafbf0dc2bf1c386f43a1c863845ad473cbd6453e8b96d1d8a736d88a542e2eaecc2748c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1a34696d20c1c275a927c140c552a51
SHA1d6ed18ae1b22c47297e419fa309f4a087e9bc524
SHA2564892df1762e61bcac147fabe28b55697bb1b982f72bb9ccc6461aeca1cd9d544
SHA512208d4bbb81853c53ef9339948c5ad74b9059d63eee3158b1896beb8de55a719cefa7d33dc44e6f6906e36e1fd8dd9f8448f608f216c8f8e2d7e32e2248a446fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5997e4a812e1b2d6dbb8919a142496be4
SHA13e30bf79b0abca07b360820bb710dae13613d106
SHA25607264d2b611b81d2c74a3b9d05f19f8bd54c2ae032b5edeade24345964fd99d3
SHA51270f1cbc01fa06679dfb93939418eaa1a47c186c37b830bad589762c442641d6ad74ca84f2264446e525b21ea59a9c9620c4bff47163112aca3d7200f3d31edff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8eafe050ef99c940fd4164e8d4c4a70
SHA10b46eb6ec5dad4a93881459f2fa8cb1774f3de7d
SHA25658c955f8120dd66a475a4fb6303d19afa782ee52b5aea95998c7627e915a195e
SHA512402c60f965ea5164771a83c180a151f31bde7c33291dbb61cd8fe511d292a035205110ac3aa017f4a002fa63cc0b6a6bc75ad232f10dd8a7f541b957dd59c887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5202bd62a98c56aaec97334864ba907e9
SHA193e88dbeedf92e5137bbe44ac82b744d51d16907
SHA256bde42cbfb0b17c40f9c6e4421c0a8d1c7f38357f89443e79437b4fbb65ddc24b
SHA512f53683b978fb2029036368f2e0587526859f355995a09deffe9746414ae12fbcbecf0a585fa2c664e3468ac82f51d8c5065635ee78c79a49be5652f673e6ec38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afc40e16198586bf90c7d85ce59375e7
SHA188e0f8e68f7b3172e27fb03742fbbc4ed8562f8d
SHA25653cc5746af3c1dedeef8b30efc64506a578956b1a9b36d4d6c030553c717b02c
SHA512c089895eb5b79a668fa24f52707c064c42d6fff17fbc2c89b5113bb0da07f7a24e05507b450401cf4502de9de9eda0ace0ccd1df099ee490d9607b3fb00e67e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582db7bc2c585a86f13a5bf02ce9efe61
SHA19bb96f8153b678da09907c10ab330b8c2b85e8c5
SHA25697d039bbbaa3a24cc085a6ee726a82abf4314b7da115648236ab4983992cdb33
SHA512edb3fda251dc299067cc666407a83fb88bf5c7a6d5b7df818c90dcdd987d6c20251e2653d15160d6fcb9c4b9314e5c6694384cc4ac0ee50618025f90f8e8f218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d79267166aa154da2b1a54f4c18847a9
SHA13675914860ccbc45438c9c1304bc162cb0fd4bf6
SHA2560fbd8ae6d96017ec662ff64ae915456fcb56d20767ffcfc31e104b5a8626a5dc
SHA512ab89f9741825f6c0846ba45621cba0291e4e9b2bd337e004ff3fed73a4290d80708a345d30b9b18028e2c26d4983a536fc589482ac61c2d5239a644140e2c91c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5703e52df173d08499d6fc0b0a3bd2557
SHA13bb3ea820b2365e01787f7836512a60a2d7c1f14
SHA25609890a9b9a09085f7ace800f70cc2020c235375f057c8bc71ba80f45041b40af
SHA51229259062ce5a4e00a5f4f0e7f5ea948c8b3db17a6cc3e6988ed751ebe4d0d7af4b32b0a35dbae187ac2f52e5aa18b78834284f0f9d60ce37090788cfb6dc57b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e417468600e9ba4870813f441ef8333
SHA1a7c35ea18a2f5dd4152f650aad32e00fb19748da
SHA2569b1114cc80330049637fc9ca2d1d87e12c8f38570ebf8248dbcd368ff5f4d5f4
SHA5125d0b90048af86002293af994fff4414bc6aa2231e3566fc5bed32b36625b3a9ab465bdd8656edf854ff173ffbc8b9ab5dbc3481fda0744df87e484ad6a1067b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51835dc6e38fb73fe10f71b09f54527b7
SHA178026cfb5c5e87519bd69bb0fa9cc98410f911f3
SHA2567ebbab99620996b699c7f5878a0a8b43b91fbee6a269f6216839c3dfafe6afd5
SHA51261052eeb53f26aa7fbda6a15becefe4bb59be2ee86f6eccd7b3188b3fb77289a248d919030d3753a218b6103afb441c9015762d502a94e449b5bfaabe4650cb9
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a