Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
3c75c75b1fd30f193ce533501ef02bd9_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3c75c75b1fd30f193ce533501ef02bd9_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3c75c75b1fd30f193ce533501ef02bd9_JaffaCakes118.html
-
Size
17KB
-
MD5
3c75c75b1fd30f193ce533501ef02bd9
-
SHA1
56d363eaaca38f076aef3083669c2e62c547226f
-
SHA256
5b64435d46b32535f1c74711232c1fa2bb2105e0e4b8b14670d228afe5cc3dff
-
SHA512
8de4883e00111fd9f6038643296d9af780120740c7454d9acdddc8a279e8daccd217ea446547444a672db9541ebe06d6f9b31b3daa198a8de29033311327c7af
-
SSDEEP
384:GBKlf7HCVk5Jpqmb0xfv4CAivuaG8LcWOxD1AEkPbW:GkBfvvOIdoXvLVmJAY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B38A3691-1167-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a460d1796758886b802946cc591376324b19aa8296a02d26c1513ca3e8a24c81000000000e8000000002000020000000299c66fa2a0bc390ce69cbcd44a60ea490a4c6cfdee93d68797a05397bd545d490000000d610bd24b31a9203ccf70a3f3b5ff6a2b1a2b5411c0ab8d5484224093ab6db4f9afca8a42fc7f9081afb0f41a5503cf5a1869ceeb7b467672fb25e5e08a1b25acf360961a73e5f79c4f7c5a8cf01cf17ca6c325521ed0970c7b4648d73fb684a1318d79a682d5c9ad9be83f49a2be8f1a48fbdb74ee223ccf69c7e741376fa12c3834fc6f0d93f8148b28fea428672e340000000ce663a29fce9095be17ff674ad80cae3578236cda7654a5697f32cd6e27cb6483169fd0df92b1c36ad45d5a5c83b13e89f824223c1ae82302e721e227476f620 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f9ff8774a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000605d535a8966dd05727f8a3a673e5215ba9cb9eaaf8edfbc5619d03e97a05de1000000000e80000000020000200000006c107ead510f9c608f920a47eed023afa175a756fd075067a00fce9e0686d0a320000000c3d64d9e2ddd83c27c680155b33a69f31979215d452d549232ff3ebeb35c33c740000000732dcb80e3add53674da59943012a4536ed029f6e1f8bfb07a635b0969393dcbed2e486b26008ddae3f4982d392c5532d52bad269b8ac4293cc0a37c623ea0fc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421794123" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1860 iexplore.exe 1860 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28 PID 1860 wrote to memory of 2140 1860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c75c75b1fd30f193ce533501ef02bd9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5684bb0bea29d3bda5e01fe32b7fab5df
SHA19bea7723d7547c19e6087192281c38643ef73ce2
SHA2568e8c034da3522eb72dc6e2a200249cbcdee7ba0151bc0a16b850e2eded3a7fa3
SHA5122b3ebb9e90e144fef7fce7aabff89c73863e03e63884a42a20d11cce6e943f4842b7e52365ac79bec1f2c763b7c81ba7960a99cf23946a328cac3c025255bf61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac533a8900ecde5467bc3214ec8ad3e3
SHA1e9f5126c7bcc28da5c5dee9eb69dc0e3ff26d6a8
SHA2563affd5c58bce3f7791bdaee004377663d66344f746e5d87b1491e6fba84744c9
SHA512e23d6a655fb0b8759a8853d06294025be5f48ad3857d1ed12569f55b43865ac8eec12334e9a48132d575f59d8503642394f9733b577b29412d3353999bd3cad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5297f7e7d76eb88578d66b46e7ef84041
SHA12ea9d180efe128ecf7d2dad453c23d4784a30415
SHA2564859ca010bb859fb5c7db8e39b4bd7e949d7cffb9792540007d92b131597ba48
SHA512a92771c52f58639f7ef4036863bfb6fe0474a657ba247757f06aca0b3782cb4fa7607343bc8c152db34eec7a36def2abac2dc0213652a7d7c7e8bcdceed1c5e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51349d03cfce05933abb196f86869e942
SHA168c0cd8345081bcec8ceffcb035c3ea6260b1d94
SHA25690a74dbeea7b3b44e521da1c8cd595ce888dcca7d420b5cd986661f6066026fb
SHA5122706247ad49e8ba71785ae322499c1d5fff7070cc13f8897e9d971a2a6200bd458736c34e8f8b3d79f2afd2a7b21d6da1fba5d0080c0153f3ae67a745a6667eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c734cb0d7063d40aae6f7429b2e03476
SHA128ab32b94630ef949efd4dce7ae3076b5e3c0aa1
SHA256a82eafdc7a713ad66afac62918632a71afe3d62a4e96db8d7105af14830c2e41
SHA5124133b7aa263044a48e8c1b020df0d831be87433bc683f79d374adf090a7046cd588baed742310ec76d26cfa44b457614dc2fe3725425c8e0a53499127abdf561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57191f64b925fbcfa986403892c5dff8e
SHA15cf6c1dafef318eb1d3cb081e17333b4df095853
SHA2564e325629e83d7f3b64baf9a32f78d7f9a1a15bd50ee1600ae87de3b005599505
SHA512fbe5331dc7f7b6bc65eab3b2c8976e9891a96a7a97e80ce50d6b9eee1dadb7cf5a8a7bb0b92f52037e24bc690ab6a7724c166046b8157d943b2535441314d290
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f07bd824ec641ede94fb0954342d23df
SHA1dcea8a0cdb51f80509083a5f6cfbde75dff72da4
SHA2564b8712de5025987c3c4fb0b4a81195de78c9dae313896cbde35a11bdad178dc0
SHA5123d799e10f371e2ad9a203e1d590e5491498c13a78edcf926a6c05b1d526c2a3f0cb557247c490203f2b8617b603d3a29e5f0912fd75780a5686ec64c914993af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521c96b7be1b1a79444c9814b03be9d54
SHA1cdd0ec6c89d8a5180133bb94760e870f433d5ffa
SHA256dbebfd5d0d7638d59545afe634ecf73cbc05e975263c0bf197af79a473adbcec
SHA5120152235441d15443625d6d3923e989b1461a4a4d4c392f24213b0531f5cfaefa89820901df4746d1629ce46cd71ead9bc83d9f2b336148ff0fc86daa5c17ab9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554facf3df10888f714939b81daf90aa6
SHA1b5c44d908210d2e48adc93d5f83132cdd8cbce7e
SHA256b4e9b06c61b1c7e03401374b465741d3a2eef80bd6cead51e364c95a95585196
SHA5123a2f17d7e3e6b1ff6dd8c2908bf038d42dfcfa12e356ef88a6eb97774bd7c19f66e7737e640c25b31f0ff0ffda66dae4efb381f5f0d4a1c3b7247820b949292b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f55942d3dd98e151e0928602b34cf48a
SHA164c1bda09123e310cd7b15475b4458f0dd1ee7d4
SHA256711361f06e8917e78e1403ac8aafbf30062e19e9357f51d553436100c60f35ed
SHA512e7ef7952cc212daac19b2c9e76a995b5d497a8123417a336e7982f46c75c7a608d6d89e4766164e8e5f62adfcdedd45d9f96b20eb3f0271490b7a875dc19c1e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5701e15d347117a11617ab0a49f2b05c8
SHA1ce0bf63ab3af27ba2bcf921039907cc0e0da1af9
SHA2564f39544646ab729ce54479d73ffa740d2a11dcf37d6ecbaa762ec07045297017
SHA5125eaa0b1e7cfd7097d5ab7dd56479f2d9dab96b99cf3f6a192da85cde1b8d9b057e723942d18ec2dee13b1647bdd508bb390806d8f4cc3be883915d08404482bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5631875bbfdfd846fad8d9afd5b7b4127
SHA1c3e0c67b7459ca7481c37e2aaa257f52758babf9
SHA25668b392a3bb1a1da81923619e6198436c0a00d452e30cafa717a3122f4f3e951e
SHA512df71fa02fa538756b34edd2f2dff066a0e31f135c1d707c963ca21b533ac59f7ced72cc5b9ae78d7be1bc3260b6163e893c88c3bff2fb600d7a8f8f12273114e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ea63a84f9e6be56d7b70b599b23ac04
SHA16bd7b996e9a4eeef7997c733300701a73a1fcbab
SHA2563bed8d9a7a93e088ace75a8557e5b24230702d13d67837b69cb6ac8743c5c514
SHA5123635f6a5825c6c56b28685293b7625ee38efe563e73c37c1ba7e145c43c80707b4084a36796be0aa81c1933511c5f072affa53e3daff3b1518678c643f1db3e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5182fcb32e9c77fb5c66a7674d0c89ec3
SHA1718299c73abd26305411fa257c8248ff3b66aa9c
SHA256d70c77efea1c9904befb7c33757e0a6702e6f75c49c780f1fbdcc7c37c41561d
SHA51213641e6245afb845c5fb827580671e7d59c0f0ca0f969dd330c54089bba24ec0b2486e1898891b7c7453c842d2215f637b1d3606cdee4ad624eee1ed2344099d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5540c44faf11b9f6385d7d96b26c939c5
SHA1333ee3b259543f53d8444c3ce10c3bee2bdb0f58
SHA2561ddc7a8ea5d79b4b0650f124cb2c314771b4fb8bcd083abd782474fab2176486
SHA512e0b3b30ee113b69662f31358b0a7a8a11e6093e9155f7a3f0523434a5f7342af2cf33f79551e98653f2de430cd085aacd3f80d2737efa76a76d37c32b62db46e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53520d3091346a2d138034b370a0cb8f0
SHA199161b330d026d6fa99b48dc2570b3d32e0e3791
SHA256be318c5e684f9aa960186466628f59d8737bb3a7495c3043b50a3bf0dcf069b4
SHA512d7e346923aa6756f4c3ba155a7f0d58808eafd795fbe72b7877403ca6617e26132e217e1272c280e950fec35f9ffe92312ffecf4a7ef994d4cadbfa706a659dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eef1452b01e476cd9823144ef4927514
SHA100b40c7395ed085be566eacbe1b5812d4c945918
SHA256bb3d181e550f49d26e811a73e60f978a39e11b6fd9d2b67d96c13772e1b95a75
SHA5120cc01562614e5a745eebb99f392035a5f1011c274693dd53b2087db0aaf55712caf70dbd316821a48eec34c2dfa33f210feff99984be021c3a2295a33a94ea67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c1f81ba7fbe904de7d4ae4faffec936
SHA13566179bc7da4105e7a532e5cadd77537b04c459
SHA2566b7d7aa9626b53f191e5cf9bb4a646c481ea71848060a170a3f0812498fe0de8
SHA51248538b04a640d7b91a496f43cd5278049ca0a6030052d80ddb8c848f033391919c328592439d80830e6cade59d977941b8005c1128a77f52e361eb80c6921f48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592eb246e6a7a1f661fc77de200424304
SHA13d8357692de1e42da7bd850c47c9f30bbf7b52c2
SHA256d3900b68bd5064e0d08168ee51c10e50b7ce3311418ed726fea3cbd7bb08b4cd
SHA5125096f722d725dd4de95aad88bf14cf23ad9b4e66fb8fc5d2449db0cb4bbe3bc3bfc64b5c9c0565bb9d77d9f29ef1ebcf180eb95418d4ec1aa2d461f72d3144ff
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a