Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
73108fb14ae6e36dff4bb9c51464e535_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
73108fb14ae6e36dff4bb9c51464e535_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
73108fb14ae6e36dff4bb9c51464e535_JaffaCakes118.html
-
Size
68KB
-
MD5
73108fb14ae6e36dff4bb9c51464e535
-
SHA1
4b108003c4b957f63a4715b8ac7b3e53e43704bb
-
SHA256
ef8e9fa88d2d825cdf446a7acba6092ae9ded015ebd55e9abbf3087377e90f50
-
SHA512
aae0a9847dc45bfea28e875cfd1fe2dba460d542a1088c079d1a91e07338d12286682c7f977859b2d956cb4d3b7a9a33761248ce40cf82fd3aca367537381176
-
SSDEEP
768:JihgcMiR3sI2PDDnX0g60e23t3yoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:Jjb3t37TcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c7dceb31dbd4d2c43165632bb4dab5eedcd8fe3f397e48f28c073675d3cbbaf9000000000e8000000002000020000000765a9cfdb27f2460146144e6468a18ed0b8d1c3426464dee6d288ddf2f246e1b900000005dee7039995c45793d19c641d4c9495a3d98108e1953c79f60741cf3f12410b67c795616cbc9d0bf13474a0d3f6ced4defcdcdda593eb2fd0013febf9bff912c9db4a1d7708eec03e6aa59caf79a13636b3001d91fc8b0f5455e48cc588371f1d5a3eed2b2867a65703e4ddacd0ade04886012babac9e5ec45452bda516305643f89ae6acacfea36fc0fbd84329c68fe4000000064ebbc1d71a2bce331848c62aec0d5f116366a98f9ec5b76802ed1798f536e726b0be1e94eff344532886aba756eedda48b171144ed955243ad2e5d7d995f0ee iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a7a9f7dcaeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22F14E31-1AD0-11EF-AB95-422D877631E1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422828538" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000190e0c004fde449a86ad0f2bf8966c8979746df1b91203ceb30a21aac1eec99b000000000e8000000002000020000000d0530f996c52bb8f2d498d8aeb18a86735af691bdd21511964be02d3ca58551820000000a0fe6495f51682cfd450cf9a5c47dc20ad1adeaaaff3d80a96c2d5f1ba3a714b4000000059b9008bb09cbef869a3727980c15e165557b798b146113b027e358bf43a3ae5dac92020cd1fa3655df0f93d1ea3748267c7cd177e0e38f6c9bc7ecc82640566 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 3024 2188 iexplore.exe 28 PID 2188 wrote to memory of 3024 2188 iexplore.exe 28 PID 2188 wrote to memory of 3024 2188 iexplore.exe 28 PID 2188 wrote to memory of 3024 2188 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\73108fb14ae6e36dff4bb9c51464e535_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fd8260c7fe669189fb9696d5bd4ef46
SHA191b5f524cf3ddf518e85ed7de542e66c82b26c27
SHA256fbb6daa84f2b4bfcc6742e45657369f63f6a99920487a596387db2a2f3cf0a63
SHA512c07abd286b1a07ad1a4bc3049dc10e698f95c7f2038e91e635f372b5c22d37f3460bcd4f49144e8fd27b397cb918518d1b2bfa768d01c66ef579dae5f831703c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b70680ac7abd63a1ca1daa5e04e2c48
SHA1d91614fc26aa04605377cff98aab1a03a35d6695
SHA2561060954b6a906cb42b8f79b96139b80c423efa462985630639e0f1da78683e67
SHA5124d89bf9d23a19ffb54c644f8a4f192425cd3be2629ed333c9875038062477eda6dd15dc01730aab3a793b3861aa603a170ddef073584cb3f8567c2183ebdc0df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52be38a67e9bde2ba67f9ddd4404a8bc4
SHA188787613e197fd8dd874e13e91d8e9ea9948c83b
SHA256cba0f17771f969e8cfa3046e08d813bca93e738d124c8036a8dc37ca7ca682f4
SHA512bdf62d1e83c1bbfa1b4e126f08cb1a331b0aea0932008fced3b5ad92e3288a717239975e224ecbf82d546c3fc494b9f8fc58af48b517bed5678b5ef81d1b845c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b469d05c1bd9da4525f0ce4d39a17e04
SHA16b0d7aa99ba73c35945a2c806c99e6f83ba9702a
SHA2564bcd7484d89f639937c863a33c68fb4d5dd08a061a18a4edd89c153cc815bc30
SHA512c0a91747f8bf6b4bde338f542346574275147f037386cddfe0b3ebb1537e20a85fea88196aef4e89959ef4f49cbfa5e12a9237c498162917a95fa58c4ea361a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f35c189a2cdfecefc9b2a49951de4fae
SHA1aa1c6b1a0a1ca2d0446a8668c993b928b2221292
SHA2569c6998bed5caf301f1e26d60c681ded3f813bcf2c650b49b92b2d9957acbad04
SHA5122365f3b1032950d5c8fac9ee39c81f7a0e92ac0ece38fea9bda6b07cc845017c6869af950c3c566d78685e054465a4c7da649b55a59fbb5b5a713ffa8f94b62e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e9b5054fb261db5be2fdb41081706ea
SHA174e295cd7582c70f7edf8ccb7860af4da88f5013
SHA256b859d677b91fed9029569fac3d50c9bc7c60d39ccef6ca5de2213b10a0b030dd
SHA512109ff017370402c58d6b704484a14c3cc36f66f89e29ed58fd8a2f69e601a20b2ba02a80152ffc6ebc29033607fae0e237450f81c767c6709c9929b2f570357e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd7078c81a1242e09ea8fd4d1ed37f53
SHA17b7e2bbc75e26816f42245a1e4702674559ef376
SHA25600ab427fd5e5629e4950fe07d3ea05fbea4fddcfde54e48594b4e1a19d31a6a0
SHA512f73c987aa50b9151b6ee2bc8fef1d0d3256095fabf2940d369104f15ea89453be0aeacc8ad609bd12330abd15363c28df5ea0277253bf12bd3dde8d06f36d51c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a61946515824ef9d44ac5e4bb89ee2c
SHA1693dcd7b990c168ca8021ab2bd9ad3cf34c1522a
SHA256625857977c6436fc12cd5ae2326fa540c11bf7fc6180a1ae852fb8e5b6acd394
SHA51288517d70d4f4c049c9b714126c9925d878150269f897e0e2260cb1f5495800c3410cb7ca2e993e0fcdc9a5ae0d5b1439fd2d89e5d5ef355869ad5b93f00dd56c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f0414afc4fae54ea6c7a3642f15ffae
SHA1f9ec53f60c064635c9a4fe1f1f37b74b11b496d9
SHA2564b6b2362021d66f70036fd4e4d2ba2ea5e2f37019b72ae274bb72d2e206f833f
SHA5123bfb7c88a745de84065e013a4db330852785bc244799c1350f6ad62125dcaa4d0536bc20c180d842bd8183982e063d583a119c825272b2be742946af45b3ae6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dccf03888d17d1def7c1a686be85f25
SHA1a32eff86914e07ade797f0d14a539f5c8b902de1
SHA256dd63cdfcf2dd899c0f771402d8bcf03a7ef0e4f7be4787225400feac45e63d69
SHA5128a8a6e7d264465d24d3215ca4c380c482c9e3a09fbdcbe2af7c00752b1e17205b08bea7bd1102f0ae5be784dfef90f201d9c8a0ec31b942bcf79ffb51af2fd3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c31fad3c5ee64cdb03140d6d36024a91
SHA14f4eeffebf00dd116280f804fb4b801c80937310
SHA25637e95da9dc2020db190d05e061ea229b51229aaec9abac07eed6a37cac43fc66
SHA51270fcfe53c68ad5c52300092ec39efa9d6722dbad0e63abe189ae3f34d6741e2642f1ac4cad8166326a140b0dc71551ca7a32069b1d85a1c32ad0b931f4c47f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fded719a328c772acc1411a59583035
SHA117a20b45c257e154f93c9c75b6ca2b77862f5a2a
SHA256522ad4b6e6ce3319c3863c95f7e2824ac99ba0f57d3c4cfa4c4ceba9e48fd113
SHA512127a941c71ff218c56583c7f0e4fd28517fb6f99096ab5dae14bcfa7147b58dc474187a3af5ce970b8c0795942797a0337283b5df58297eb75ecdb6e57dbafae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5861ea82f2f5bace772fd5468c6714735
SHA1eef9f624a02bc4b7f46f548d89e3473b9660a675
SHA2561ac85e4b87ce1b283da0dc735af31a422381ae2b48d7939344faed2bf9e99332
SHA512793575f1c7df3a64217bba31efc7b1c86861c69766508a0ea326204419d82ec88e3cb85361d7aa98622e44819984adbae51b46621128492d179aa8d2646d5d7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529e8e572f0e7ab50b09169006cd55419
SHA1c119016a7a566c9159681a25d6ecc862e282b8a6
SHA256773e27d5c022429b2050604e518950e6012abbf42af33bf76c8d28a7850cb2f4
SHA512aef60fb97393434b91a8f0fb553eed53b6580a7591269b60d975a940f1ab9fcb193d199894bbc6de463321e00839cf229ba55b285aaf8e8ef5eced441ff1a9f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56550d1dcab61b274a5c62a9393bce516
SHA10df2237ff4e2beb6a95f6f8ccafa4c936c41000d
SHA256944d62fb5a156bf7424e6df3fd64c05a899be1302f42a008cee9018717dc6f03
SHA5125919b4e62b491eab2b812438448f40afce3d5716e5d5b9ac64064243f7f88ffab05854948037313499981b4beb779cd584230e32fca471c40154dd89a4d7a047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570b4403c4dcd46af635c56ae8bf2bd17
SHA15842b2046444d3858f473404b95a65235a04c42e
SHA2568f96a5248ba83ae9d6d203b01ef57eb272614ae65ddb98296c5e2e52ac4d013b
SHA5125a17211aea206ca3a4ab6f9b938c86a3383ac8e054d63df3ddc7d63165cd5510aef90d89b7ae32ec0b2404d46c5c7406a4fb0b61a9f9acdbd393e406563bdec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548c2b846147bfbdc6581158aa0b0cb7a
SHA1b60e05ecb9b89a49745b1d3c383938acb4836b2e
SHA256f84e95626520187911b4ea66ac76cd4050a9e549df0912ff7db184106c16e274
SHA51257b5cefb25b006d14ad4d8da5551a2e86a1e3f706fa8cecd277d6a204b74e1ea5e8b69c485c6a5df4253d0feea11912d84261cbc35bbbe85f5b46b8a44224221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acc503e113a70d21e0b091a297a36df4
SHA1ca4d54e401cd1497c7eec462096257aae31f7b62
SHA25617dd2b9c615b80ffdcc448488096fa9c227eb153d3724093e98485fc0667dbd3
SHA512e020f7114a95913c53642a25054eddded76a62e4a414d62d387e64d3922f1e714c06066f02d699bd05c9cf3c07470ea7ee747b5dcf46ca6bf989b50cb835c5be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cde271f2ee99b76508aa3b8f2d88828
SHA1e56efa2753aa1c17bc860c32849aa273c592b24b
SHA2560eb155b301a8d5620d73a8945c144858464022c533a6c8b26595e20bcf13524c
SHA512fbc7b7c5d54da9a0681cebb7a6e0934129952ec95637631fcb4aa3cc71999a7a9eca0c4f272f395127f1a817c26ab513c39cf38756755f33181289aebe154cdf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a