Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
3a7964cbee88fe76dc7031c5fb675178_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3a7964cbee88fe76dc7031c5fb675178_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3a7964cbee88fe76dc7031c5fb675178_JaffaCakes118.html
-
Size
461KB
-
MD5
3a7964cbee88fe76dc7031c5fb675178
-
SHA1
4d7a09b75d181dbc62aef894cab5dedc83fb0548
-
SHA256
0da2ca395f4e078ec726b50cbadfdd1fba241d1f2bc2805622d2b5292f9656a2
-
SHA512
9f73faa946f160c4ab2f7ca03d525df78177dd3262ab451fbb1ae39e29f1368c8b3b2957f53f93801e370a921de350ff9439897c8352d15600f59c9c352c0d66
-
SSDEEP
6144:SCsMYod+X3oI+YQsMYod+X3oI+YdsMYod+X3oI+YLsMYod+X3oI+YQ:R5d+X3E5d+X335d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f2afa3d0360cb0520df81570179f56237442ccd8bdab91cf9244da190412f712000000000e8000000002000020000000146b11131e015dae9a6ea00beba23784626911dcce251d8fab57a85426bbfef020000000cdaa095f7bd47ea5992cb01e43aa5cd50e6f2ae71136eb0f0d66565faa147f9340000000544e76d0a34412edbc94af6026e6494ed96c7621466414a47ce5eae0b7d9e98246054523bb381bd2d620d29a16dd4155d5e53e9c30ba35733a9b935e95d1e805 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000ee21b3481475c29ffddd8b7f3b1f5de33cac434c123693b8cf389f2a3d7feeb5000000000e8000000002000020000000c174586994e8baeed50dbb73f05cc99c1e3c04f69e587af7b43ce770782e101b900000005928be97444eeed4fd128fa4fe58e34efe376b41b2852ba6785e1b5bdbdca8ddb31ee9356e58695c29967462b883a0cdd60850daee76fcf568f357890e9e82ac0fb707f21b022457fc2bedad3fe0a33073284e966993b361bafe93341ffb9b04315d8c507f92d65862ccdae89431b9793f8e6a92b07329f8aa974b235f4ec2caa041b4386bbc3a14811223086b6387524000000053e46590a1c650b875ed0c8d8c798808994ac9002114b5b26e836aab456594c6db48f362d9eb9fd5f1a84f5e4f9be199c457911ac86779291120242221a91aed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6042a1df74a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{071543A1-1068-11EF-9BF1-5630532AF2EE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421684312" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1820 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1820 iexplore.exe 1820 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2588 1820 iexplore.exe 29 PID 1820 wrote to memory of 2588 1820 iexplore.exe 29 PID 1820 wrote to memory of 2588 1820 iexplore.exe 29 PID 1820 wrote to memory of 2588 1820 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a7964cbee88fe76dc7031c5fb675178_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e664c35b45285ccf99e40e5ac2abaefb
SHA160b3c199805853dba50af30bdb6256621f30dad8
SHA2567a77d5f123bf34ac518c2c8c6892a33b11d54d632abc3c2b5051c92a3086a7a4
SHA512352e3497281a6368fe972ca4aa248577f199c02f48af467c5938573f1dc11f7b4e5a543ae81fb2a9ad1566a6a908c814a24035c2ed2ed3bccbde8ef1950204dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a61e01b91403a25195c814e3cd7bb43b
SHA17ba9e02bd0f0470092ee709be139b2a0e7f04759
SHA256431d8b539c5f1bce2a1f999916ce6825c01fa1318c854a5faa5b09eba457e267
SHA512bf722e542eba330006e2ab80cca8cb8ce2f038dc88ae3c24840f0e89d67c993331b1cf8c40705f28f1103760fb066ecd170eb50f11929f4d271f8c9d8fc34263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5561466973523a5606112f3133abac20e
SHA1f58fb36c3e3381340f74d6af491d4c0ad1000672
SHA256bf9046f67eb5f384cfea721b4f30064fb6b9a7017d5c6d64cb4aff7d96100466
SHA5127a60b626c8a356dc20030b1a6a6e45dba5481e7db84e3b6c5fa3785f1b3ade8824f33e5c66c162ae9f19e35aa7cc72d0af1b0251c48ae1353e4d92efe52ee7d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58097c6f5d1c85a7c9c0ff737e52fcfd0
SHA1de0e94a5d825d79bd5691e28c8f1b9a9b3dcd21f
SHA2565402e37f9fa74c34495f29e0d565f661989f6c23cb3262cab88d8f4b0bddb0fb
SHA512694e7be750096b10df8d0fceecb479bfbc2d52d8be50e964fd150eb3b5a4f9cf948b2cb5b8c160c4e8a58d116033803ea5a0434195155e8aea489b46055f6bd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd189554929df0c2542c5f059ce39a4d
SHA1b1a82a38def278f0494f4f2d40672ccfc5a4f1b7
SHA256b3c12c5633a27fc22a154656ba7bf719c7b8048f7b04c28541648c6748494b4a
SHA5128a7d60bf050899d2c0d58d4a5ca501d99fe7d5e2e8fe5342897b6f397d563034f0eb04d9e0f22ea00e28eb7eb91d19bbde84e3d4e6c233dee377bd91c580b489
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5472ee869b99c30b41c988edb50703ebc
SHA199f9047f96e0e29d6ae1dd046fb2a1d02633712e
SHA2560068324a3313b816cef0aef69e71f6e9cba75b7ccccc83ea8423292c7459eb41
SHA512e22e8b956c71b9fc09a89f40a8c063a7e4d6af4b4607f89fa30e963bb6d8601556b2cc49cfec744d69e8d1ccfcd00dc478b8868a1411a0db68e6bed8e277fe47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c2a462d062bf5d80b8111805b5fb470
SHA1af01805a35c1c2c89c47f9abc7b6cda9799c27d1
SHA256dd33a2eb34ab543d2c3a6714f460e2db13f1fb4f5b3a9718b46bb82492382220
SHA5129771146160d1ce3478c283828e568907b594eb46c00ae2dc8bcb17bab8502129e6a627a97c821719e656cd0a8a193bd46f4d48f8afd933f8f9cba38547b37f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb6fd0abe9244b586476fabd68e37466
SHA14bf35f9d0b7531c41fe1cffad1dad84c9d00109f
SHA256a0f673eb6bfcee4d304eb2e40e39ec79529e49e2fa9642148c3b7abf2d277d3d
SHA512bfda82785e0699dd441be1b2635bfa6e03581ad056152b080937abb54a693d7d84a47fec16d90708c20457581d8a329f0fdb7d5174bde07000b02bb12a0c171e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de52d04d6ced54b135b3474022b1e213
SHA1872035a8fccf5ccfae144ab85e98974f811be846
SHA256de9b161f2d442961ea1f78cae1423e403461fa9182dd432b65c59b9e5abfff31
SHA51273af2258d0f0ff95bb82a2cea0f812b15f0fcab40c31e1ac804f9bf2a9528de118d5b50219054d604b7f86bd8a26cff6a43090210572bbae136d41ccd938364f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5accd656f827c27d6041da20c934019aa
SHA13b29b20875bd305b44f8cda9b0f67d2ce2cd1f34
SHA2564c8bbec3dc56305a54e084af0abe6f6d608c009e5df0ce8d5807fca6203b94e4
SHA512be75819c233a012fa35b1afce5c4abc317a4e15f45fca471bf96c75e6190258e94b4144964d1a067c64300f89da4d5b776a18b74bb838ef5c902e88e359164c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d839fa39ffd6d888353e7cbe0e34d57b
SHA16903b804b81bba25c0a5f3785b6991b280c69e6a
SHA2568155b7b4a18513893775a74cd6a8a5be9a913679305a30954a3da9c9ceb73866
SHA512d95e8490623cf5010e644531e32e1050e68be21b4a751776a658510c596c23a8ae6ed8104850019bd1a84019db9c2e86682284e1de970be21601fafeb54410ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cfbe3d0c43a7ae7627876754a30fe85
SHA1d3ec940da39484c5b1885ce78a999c5129ca7bb0
SHA256c1172aeaf7292e49f8068ef1f7d6960dbdae98ef3056460133ea8b9b22e0aa35
SHA512d818d214e44fe41e4862ddc441d4c54dc6fb888b0190f688cc7f68204a3146bf4ac5b76868784c7bba7e714c9b8e09db15e7f5768e6e57d3de31184a2a6c3a92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594626a38ecfd2b480f927fd0bc4cc9b7
SHA1d66d3adcb693a7cc3bc580e5287eefc2374e53b4
SHA25651fc855ac99b392d04c5565d47e4c6965c0210183974c9a027d736e39bed1f9e
SHA5122111e9cffdb74fc4158771965f3d87dde19c848b1a6e6494a39bfcb97f7a3c0e54231818c2e56bc0a8e414f22dbcfe5a6e92eea916e1c4e6e53fc75e16b09675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541e6c7bb48a5b1fa11c01e1aad7aceb9
SHA10e91ee9c8c46e8b2443e2f580673217f409127a1
SHA256b329b9bb064f5f6398630c3ca66c18b152537b9fd74b30354037d6e392663d2c
SHA512ab830f8812a0d86eb232cde5f14d4d72d1b83a39d76351229d9272baac6b882a292857c6fd1e64e1319ab17a76c8a025ac985b7bd9f81728b5d69d6ef4bab179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565986a3848ed805044434b34ef2f0215
SHA13a94d727ccfbc84fb6fa72b80ddd2ca72d623a37
SHA256bd30c1ecb6a167e09a4eb3388659ad6fb01ab1daf33f0bc14f4a16668c88c5ea
SHA5128ee178418facefa55c3accb316df49c35454caf0297a8e64b4a416c1798f37477e528fc5e6835f2a08f695061064fbfcc4022f464ee79f196230208ac6de1100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ae73582e45bce5e2e05e997a1d31656
SHA1080f3f60073e816082d5bbbe0109022f25512dbd
SHA256d07283f66e46b1467827d857aea5cd072272b61db1d12b7dbbbd36714e720797
SHA512294f727dbb7b02583372230d0f0b5cf47656a3a4c7940fbed6efdd81d5ce96de31a5e90f458a3c45fbfdce2a47b1e0d7657664d0ef72744fd004b406567d2f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffa7aee778029917db38806ae2d2d4c4
SHA148c9e5d77947fc839a701ed19d2c0a5afb5a8636
SHA2564bc1a7437d17a25c9d028875d9af8d1b356949f423f6b4b4297bf1ff3353723f
SHA5128eabb04faa8ba25fcbbe97cec8af329f1f6659d04810faa5fff7392ce80777bdc489dfb2bcd3b6d0bfb734925095776f3c11a96ceb2e2712746e3f96d95fffa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513347c701466b6c3e4a62ce5040a3a98
SHA148c3b4a1d41a1bf3ddbcc34e0394686a4149ae8a
SHA2562d967d359f0ff7417a384eae0e72cecf8c7ac1bec3bc119b5302ddd368cc9238
SHA51283d80e22bee6179c5bfdf3acaa606c718d8168f6a3b855bbdb4b8d6471440d983e56d298b8dd705f3efafcd00590175d87d59a3938d50318c1c48a3e14de34fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dc02f33eed020a1a5ba6a47943480fe
SHA180c43f8f8c0e3eb361dd064c66f011604b739585
SHA256b237ef39b2216f60aade9f1ce2f13fe339ab76d3a25434185a6d90831387757e
SHA5129c3c89a6ad53dbe34cdc6f1c04994278946a396b1144ba30444ac14bb95e4480c737fc8d287dbd85634404e4fe2638f181a6df988dee3262a50eb31600cf0777
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a