Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
71cde33ac1304ef3fb2f897a3ad577b0_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
71cde33ac1304ef3fb2f897a3ad577b0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
71cde33ac1304ef3fb2f897a3ad577b0_JaffaCakes118.html
-
Size
8KB
-
MD5
71cde33ac1304ef3fb2f897a3ad577b0
-
SHA1
2261f4ecf75ea8ce994ae603982b7ae8f503d5cc
-
SHA256
ee77cf8bafb518891233d4e36b60822284a44566aa2516db33698c7a33612801
-
SHA512
3e4ba9f389e163cb336c232947daf4cc6ccd35fc18e35bc7e12c4aa65e1890b8059c3786b38cd4b63678cd0cd8ab39bca19ba41b439a9e75afda1f51015606c8
-
SSDEEP
96:/KzWym27vFWyC27v0W5IbAT7dGMNd8mqBdehDHddduzX8Oddddd0dzsjdddddddu:/4l7vFZ7vTCbAXI8Xs3rpK8ef2l4J
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B0BB5C1-1A8A-11EF-906B-FA9381F5F0AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cda7ef96aeda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422798460" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000a80fc3b03106c6318ad24380a60a34009d4988230c320a6fc1d2f641322224f4000000000e8000000002000020000000404d6aff72685f1f92633091abd94f065975e65c114e282f0d9c5bdc9c570fe8200000005e549c4ed51543a5773cc9b93e3991273a75cb272cf78f0ce880b79db52441654000000001811e2454709ff23e20996497bb806c0045cb0cda75cfb7df8a121b9c822635fee4696e11dc14fa8e022be4a06e868388f5af1644f01cc75a45096bd1afa8f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f591a8d939d6be1a06de5b67d65411862c7db09d069f3cffa238868045b4d59c000000000e80000000020000200000006318ae7c09ee5e4c74dd59f92450fdaca0a3daa2a1d9d11ffe3d94cd2f99db5a900000007bd9fcba803d2e844ec58e32f09a72a2bd57b2dca8cd108e36e423d75dc86a0915463cba43b8d46fba12edf2e9686e91ebd5923171125b6d3cf51c728bb1675e739f6297ee051cd57fab491673db2b81ca5be0a3d815bed3bdff69390b8026baf918cf8c66a5076d4be0a49da76cd79e628d686dd2cc4751698f6b5d2ba7af85089d4546c7b7c04ed6893cf3a63f47af4000000065d4ae1bc3fff8b164c967c6b97f9472ae8b996c47de678cd085f7d63cbdd22ff1463369f85b6fff1ed572bc0fdf8335b5ca683f76585f3c6b9ab356f5b3e86f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2480 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2480 iexplore.exe 2480 iexplore.exe 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2456 2480 iexplore.exe 28 PID 2480 wrote to memory of 2456 2480 iexplore.exe 28 PID 2480 wrote to memory of 2456 2480 iexplore.exe 28 PID 2480 wrote to memory of 2456 2480 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71cde33ac1304ef3fb2f897a3ad577b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542e870e79f9409fcf16db7c9ddb5c18e
SHA1547fa4d252df6374a0c251a15b8b517eec0bbef8
SHA2562bab589fc4c7ee462e38f339ec2ff3f7b54257b1bb5b45edf34b7c97407bdadb
SHA5129d5c17a341fadd33c1ac84542d117f2ad13600f3d9d7dc6a188e1fa23f04bbce409476f4e4e15c1c24cede8b6a12ba34b5a9aa809aa8089cad6109f8d91d6e98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530be0c981cd19222ddc11f1b8746598b
SHA14e176cda0bcb4727bab4f90b27d8e703607b3a1d
SHA2568ed7d21c8d905b7c136fc59bd53b189dbec33cb894df87632565a99110eff485
SHA512f99efe35c8f8538355e86d1a2c846f4b2d334c24f1a102290717063164affb1ebade1675845b34d867b3e69350ca69dfb173ac86c3899b56ed06e88e39507b1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584d8121fdfb52e5c3a84f428b1611849
SHA14898ee252d4de792fe0792936453e909eb7213a7
SHA256825721d8b8d7c8518fef29e8a36299dc20c6b269a9d24a632f1215d72eb1037b
SHA512da6fb146a572a2d3020f60ed87f4c2de7c95785938a144c88dd39e6d52dec8cea207196b32561c5ed4ca6ab6edee12770279ca5c9ff5c8cecf47bc2c1bdce6ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50031c88046b39fc861fe104bea462321
SHA1690176d94cc747baf7f2f160ba196920fd82215d
SHA256e3dad217d10d331dd0c44130312e00034ef6f6e04bc957a7aa6772bcd127b524
SHA512f8fc88bfe301dfb4a7dfbbafeb9af4e4c6e79085f8526700dd0db6f5c288a3b8b71ca1b9ca5b07ed67e7dbb7321984aa5e025cbd203ca8d1407c60aefd2dbfc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d3fb4e9de232616a20f90f6f57b2dca
SHA1717d39c596082e3794fa6cb80f29de1e97a2acd0
SHA25639e23066d2caec491b1814564163771e0541fba1e2188de1698dfbd85f08d518
SHA512fc1f18713a637d53a30c3c836b85a5cd07d610741b936154963a23508006cdfba0cd70287c9f212abac01f7b24e4eb77dbd02c256090b624e78205183299f386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e03696af1c2bd6c8f4a1b0c4abbc770f
SHA1e1f0ac16b579a3b20c917e10c86d0cec5e5db295
SHA25648234aa3bad462d768dae172ae79bd1801754bcb05d3164cc7999b48813f0a1d
SHA512f0f8abfc933fb509c2ac4d2f9422fd9d4850f833b1cedf89a8e090e67482418b7e82d932de8a795ff0778fed32b9dfc457aeb96a231afdf130f16118b78b89c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534054a43310cffb3854a01a8a01074bc
SHA1aea7dd8c3e05574d3cf427ed651dd529897bf9ed
SHA2562b9386b9d17d5ae3f596468dec5ceb88f2e7afccaaf9e293c9e36a440a07f9d7
SHA5122d5979432ab3138ae7a12e63692bdd6689c51265cace7df98ba2dd34fe006ddbe28d45c97c06e0366c41f1ad5cedcc71bb3c10bb6a08bb18e66a99ff1d0c38b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53584edfa75cd6718779de03f69afe246
SHA1b97ac59cb4605f255ff76a09b3e863d04f76f104
SHA2560c1a5a9b6c50c22f97d75f23300b1a484dcab18a1922ad21cdaed4cf31da6d52
SHA5121ba6f1b7d5a364275ade4904ce62141e024509ab2391d46309f45c8f7f2d5602790ece29a06dd9775afcc6dd89c20dd2614303abc0795af0a3fa6466a4c48f69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d3829f68905c45497d817d2fd14a635
SHA1a8508876b8a38d3e5145089fdf5ccc8d320097ba
SHA256cfc1d403f88798c06d759c99b28c3e0901432437254b547095c261580cbac725
SHA512257ab758a8acb01691dabb1ac50822e635fe023a3794923ed0426802d5453aef293987071b9813bd0c20032a5a9c23c2be7a2cd0448ef89e65692d36a7b94c08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51537160b5cdf116f95b73d75d7e83313
SHA15d217469a4cb4ee29ccbd894f83ff6a1ac18c36c
SHA256dde524bc238c933d228170497c55748b590854bb33ee90d763bfa39814dfc26c
SHA512c04cc43917161728cd88ad2983fd6caa499c90e93f0ce0e51058b470707230ff2382540fb730c650eafdb1f0897e30521cb7e09b038c6a61657832bc13f7bddc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce44521318b54b0482e4191c1b7110aa
SHA10688865a98ce666be4423a4d1bb6e72faa75da87
SHA2569e905298d509c5a17154b6afc5c3d3873999364e0ddd9e8d8607592fc437886d
SHA5128fbf828e3790edc43a348f528d72fac0fda7dd09ce44e77b17c68abac63ed53e762a6f479b6f72476d270a9daf3ea847aafd220ed59804e3f4ed4dbf7060373e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ca1715f5c77522088d09016c195069d
SHA1952c94141590fb9968b8b24512558cb7fbe4e937
SHA256563ca4828fd25bca210204afe443749e9c862bdbb6fa33baae16b0d008234a0f
SHA5125e452c1919b558b5903d7c090b5993b5768c13c1221d6e931b7a743744f8caa4d7a8c6fc86dfa6359ab90240aea3011d8b5e32c76a8012541258db3541d5143b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c546953c58072f05c3854206e32f2e8d
SHA15c12daf5b3916397ee52b59d31fca601ec74303a
SHA2566025f1e72bbdd3d96ac46cac51b4509396064fe9b2496529ecf1793132e15d29
SHA5121ea19e03f3df3912bc6fa1d234ff4fd0cca1e9193b2194ea60f94c3d066279712463bac3767c0865467bd7f51081fb837342978ef43f3b0bf85f25092c50a2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d23f9119f1e5fd5c6a56ef4e8fad8523
SHA1e3a82387be184782820094a9296b4672e8aaf0f1
SHA256cbb3f9c727936b4fbe8b18411731aaafe1170cb1454dd01ad72f7e86ddd602b5
SHA512e33903de306b65ff35995f42a0084a198732fa79800574638f3e5e6e8d3f0e6a8eabab9982052f4abc037fc6adff86f9d0b6dd83455cff2451240444cb3085bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b02c7e8972e82f988473d4af36d24ec6
SHA12412b2aebc0d88aeedbfc6a2cefa7edfd97f3930
SHA25609debc3fcefb6082aa0c718e1af50c645682926355460c7ef23648a5364e7441
SHA5128ad05cf5a0414da5222ee569d277834a40a85c26cb9ce7ba6c43b92f4ec63870b22c827cd1bcf39d5e467480fba9a0b71b3a4ee51848c23f80b0a8b403135260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5687142001ac3ab24abae6c9da53f8427
SHA1ce52106d8a0b120feee857b1f03c94938a9addd3
SHA2563c1fe0bc848ae7da012922550b9661ca879c64b0031b92dc3df0ec8cc87eceea
SHA512b2cd5fb645c7d7fcb1949096bf28430206170cb7a67a4a425771d7e6c2232dd1ea9692d6107a04036128885f87924e3469c87c4f298ee2798ed9fdef3c5e4ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfc6a38f68c719e5aa7c4cd517a6a7e5
SHA16e71d6cc236a8cf26ea0f7f19ba5cd7c521f0d53
SHA25669dab1a8ea29d2f988a21fb5b1311a8a23a93ac6ba733607d72051ba9f4f2e5e
SHA512293e91db6ed0c0984ca689a933eac06b53a6038af932112964b58e84e107ca15d359eeac6165fc64aa6765f08b2b40cec708e5a67ba8f01bf6afd3bff7066e80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cee432c2ffe3f3203a98585c25b48472
SHA1c5dee649802b75ab4267d186f266c0fb057c3607
SHA256aa0bb542a4e95e726eadb64b31e261e6f519f285610431989091dffdd390798a
SHA5129c0753fac18222cf99b617b1ddb0b0a95893de691f2adb1f1cbd83d9a76b9cd8d27da0f15c969b54fa287a5e80168c379a06ec59e82f1e302b617cec8412d0fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a07ecda6e3602a8d3e27d96639f4228
SHA12f2a44d8185452a53397a8967c2c63d2df0d3e80
SHA2563b7607018b3ea6b9c370704d84045add165635313502e66d903786f279655306
SHA51297b91eb0991533fdc1be9bb697aba099c490ab8399c2e18eb82f11bcb8869280062078be57e0fed19bd875ba8049b102b39c28a766730b4a1764f5c0a41cf231
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a