Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 06:22
Static task
static1
Behavioral task
behavioral1
Sample
7bffbc57de9b5e7c630d9d149f3fceec_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7bffbc57de9b5e7c630d9d149f3fceec_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7bffbc57de9b5e7c630d9d149f3fceec_JaffaCakes118.html
-
Size
33KB
-
MD5
7bffbc57de9b5e7c630d9d149f3fceec
-
SHA1
b0cb55a6a4abb11cfe62b9d31ebb8bfa18bf56e3
-
SHA256
a7f82a31be369bbf0f7ed04cd6cf02623732903d0b65c5d8dde0d4a5f85d9bbb
-
SHA512
3c490352bb79a59a9fe4738405eb55dee841c27b2a7d54ed021a2c19a9795b66aa6657b89d6de257ac672cbb72c4207c76cecee2340053fb8be4ea25e3dcfc41
-
SSDEEP
384:kwQIjS+5B1bCxAcnwyJk5Zx6DNs4Wjuu8e0dODUZbZQD1wC1WXYdqeT1dmwLngK0:kwJB183p70ngHiqRIOGvOwCGAwubL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423039223" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACFA8A11-1CBA-11EF-9680-DA96D1126947} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a4841d069abcb143a0c6a803fb5ad75400000000020000000000106600000001000020000000da8a8b18d159e6c1d6ac65118d6ab45212c89bcad8e139996bc9a324962bc2f6000000000e8000000002000020000000ce0f37fcc5c7c34a4d56a24838eb239dddd2d1d0c5d5da488cec35b6013b8e6890000000ac23c564e5ecff0ec2d4a162432e7aa1ff8d832b44325df94c28f1320e80f4735f07b7cd9695e9ec4299eee0257e83d9c41ae2cb3807c61279ff9ef55f2c0ebeec5f4d7975e87f471dd7f06bd2fb4d2462920f636e0fb1b55c5f3f25444a13e5dfc7a4b199c8b20c325d1345256faa4fc8826df1f321a43c887e77aabd10615c6ae2bb395f9c40693b9e9b90b1de9f9a400000007049957219d4f7f496d6cc7c92fab07f24bbed233aeb84d5023196b2a6f4aeae5434ad96af46a1212e3016b0f8978c0da395acd36cf590f7113849c31eb66205 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a4841d069abcb143a0c6a803fb5ad754000000000200000000001066000000010000200000006522d39329e2a1068dfbaaaf3bc8cced43dc91bfa0761ba69467819809bc0303000000000e8000000002000020000000a69f24a6598bd869d86e254a666313262117bb33a3de4870f9d3a5bf0659b3382000000002868f7b71748794321f2581c1807ba34a2cff6dd8248f8e64a2c7fea59ef7434000000096c6c95fd731445714a260135d89a1e3350d044c85b0223ea96d2e5da2f170f5143c035247adea2aaf516ce34c6d20833a0e4ab9fc255dfb75b0ff98c961058c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c013c891c7b0da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2540 2604 iexplore.exe 28 PID 2604 wrote to memory of 2540 2604 iexplore.exe 28 PID 2604 wrote to memory of 2540 2604 iexplore.exe 28 PID 2604 wrote to memory of 2540 2604 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bffbc57de9b5e7c630d9d149f3fceec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5202208e570d1eb0c076e5a827b2059bd
SHA1678c54481e46d7fff77dc71cd3b3ac6e6fd4550a
SHA25691bfd25b5c7046497c9c11269797f0eee4e73b345a9004285683838b9672fb09
SHA512d40fb2a5842f668c8e89a030c1c674ac602a9d089f0fdd34898e99cb92a01c2cc247eff47b078d2d1e2f8871be31600b1f7c364c85613c0f6c7865fae301b48b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50682c778d26773a94ee0ca207b6e48fa
SHA17f74fdca9af020658941aedada4da4242f982653
SHA2568a40cf21b01b60a63a1ac36c91fd9e252847736c8f7aea272cd7fc9803df5aa8
SHA5127107199ac451dc52376381930dd5984756dbac01567d4e7d939693fdc09d2bc02c34e475cfbeec26e2b362e979e94b66c7dbedb907964a30cebb034c6eae2c3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8feb405394ac6639d7c9f82d5459391
SHA1cad2e9af1f0093abeb4d687869c18494471e3da7
SHA2561b4bd838fdf015a8ded94c686b958f765f7026b4d7c86630dabb1293e4ef8575
SHA5128aac307f1db29511d24cc54e30b63716a4f99538c9691b47b281eac6c5158b2d13f8825f73ae2b6d769dc13de6ca7b93d44cd471018293e9b8ca66eebd2bb5e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe92b323f82ed3100dbd23b4559f009
SHA16a08a1a71654a29885df3e6199174e90c5533ee3
SHA25682950b556f1ff0de1b015738e27295387d9e32b53ef57b42f8dbb40db29acc99
SHA512281a08edea5292763fd44936f521c5cca31ef6bce60739ee7d80a1867606b781ddbbc0c138cb2c3d7d46c83f5410150acd3d08b2b128405479d42a91c845c1b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545027081bdf907595516dcf5c79a4306
SHA19329e8123aca780c4535366690256de568af702e
SHA2562ef3f30ef7e474ce25653f2d735c43e0360ce5c334976b44e96be537f6a670b0
SHA5123da45a2764b5e21bcd3f6b02e8e9b26164b040d395e059c87190183852eed0c2b580662c87c95099d4446bf9b3341515b7b161ef609865d05d74824107bab654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d12db139f082dcfd8f9955b3576c818b
SHA1d78ac5b13826a38838b670aa785c240b0ad61e24
SHA256e5ba9959a6d5095eb65dd9ce31739a94bacee42e183f0611fc84cf91cd9b2e13
SHA51250e60e55c90c6b2a3483d6cd94866df4c5992aac103811a455e2615d562524b0874f8babb3b94f2e2e4186f51a9c52d08f419018539d03f8315557de0e1d2ce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c53ec54e968185cb316d275e129e2c73
SHA109567cc3007ed74fb068626d1973df901fb93103
SHA2567f2725244b9b79b7ad62e064d391ab81b42ea84fb763dfed3c9b2039cd1ceaff
SHA51219a6e904d0d90cc484e6b878c8d08c2e156f1b802b34c96a3ecca5a80b6cf44433602bb259c97a06da90f78792c154d6a5d85b67a4ff9261a0aa3a139d97143c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53705eefc57469bb5cce1e215565c5bd0
SHA1935d2c0a9ec1e7b1e62f613baa2600ac4b9f8322
SHA256ee73b3b83e627c98287c7315c6c590a683c71e30ede6deb11c354a69fe46835b
SHA51264ae86a03c87b24667df60cb15212fd9f010985dda32116de3f2cf884fd5b3834df3fac17fbc962e1a01261b9b807143a40fdf4111c64979353ed9f9dc09065e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a58d0962b65bc2feb3c40fe7dfa30a46
SHA19410a122747e952e92e227f23c6731d90248613e
SHA2568b65883b9b5bc3daee4331b5fc3297f1d0142bec73cc7c7f24a453d17e8c752c
SHA51220bb1644aa6ba310e1c094f130f0ab0906271b8a81faf4ff72ab72c5aada85e3c3110e119ac530cad006cd3c020d787c5c55e5d46a2b07aaeaa80c00129891cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6d89ff4b63d280e64c63451136b88fa
SHA10f749d5778e518c748c39148a1a6d81a8d21b92b
SHA256d04281e5c4fe716e1e44c519639231d010f0e5a95b0feaa4fdabf9b9eeb8babc
SHA512e950a4a4f0239658e306f62008a9cd1d30db5e0345cf39fd8baf1414421bec6a111b84e9e6a8bce0398edae26e79b82e3192aa4574cdd671bf7626d83c20c350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517ebdb835e1532b8bd9d9905917fca09
SHA16cd0701c9d2ce8177824db19b4f8ae109b87772b
SHA256d571b8eb171b2368a13e8fcaa753a8ff3b2d595e1a4ab82807e0fbfdb8de6cc2
SHA512e058f89c6548b6a1c27c862b8276bb2d69edd559019da6e10c23ee7b080e495b1134d19c7abb5f10032c2de0b64cbd48e0c8e6bdc1e50260a9b864fe11930ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bc8266f0963c11e50cf63067b93fc26
SHA18d2bf1d988b85605717529b8f6cbfa61dbbb70d6
SHA256025ab92c3290994bade09829e1f061427f904feb75901fc24522e234068855e9
SHA5121a99ee01634f1a62c8a68c447049b3d9fbcd4fd07ef982eaf59bab04b137b66795cd1c1a7de59c441f32cba0fa7ec5e1d82a13eed15a8f7972eecb7afbc29830
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef43031d1e441a36dd194bb07a1a1b2e
SHA1899b5722586811147cb67a97a8883bed93dc647e
SHA2567b290505887d07c883e3543d88fb55c071dc3add784a3fd63ffa3853ab358943
SHA512b75b539623453b14f56e4f04f64f346b27ec16c6af61072934130188f16f7bd32bfd30f1678ba3bd8f28a7aa556db30ece86d1bc12e0d69ba588e6da36ad5ae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555a487187bbf92314f4015dcdcfe8cd9
SHA1709ef67d7d99cfb4e01891d0b1b133c90148ca02
SHA256edc1ff660d7ca2671c87ffdea12a4c5a037834f63706f77c3d332df2a722047f
SHA512330554c0cd9d2a9dcdb3737a5db29eb465d70c9bd6cd4fa71dbed46cbadcefdd759cf8926c00f6db2b9cc3abd101966587a1f05c3fcee0fd4b343f1e54fb10fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5288ac4421c2fc6491e5b0424457af337
SHA1419da678607e6dee548ac3307a24c5dc49f8f9ae
SHA256db2b8378aa790eb0c3f16584c9e8037627273333b38a598ac179d9b97bed325e
SHA5127faed9309af7775263a2b23a8064e16322cb1429fe8c0f2947315c110e25cd5e5b33a4dbea205dcae9d354a849cdb09734263df0a6df05fa2fb5fb1a26bceb1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a4ddd1b6d4d24b42f0d25e14220aad0
SHA13c61569a7581e6ceb0f020f9b69c7847a2907ecf
SHA25607fd43c4fe1a911790e15afa68226cc092243d3b111971e25877808789fecd27
SHA512a24d835f6cbbc5d2c818b1387123503ee723acdce38772d77317f3f58fba32235aabdb2cb6a3e1fde81d6b74e400332738c772491f3e60e5b397e02375fa6d14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4f20c7233b0e525480c57853360c3e6
SHA15f7dbf5076f3a9fa66836a02f1906867511d13ca
SHA256cecc6607c70795a19a61871413a7cc1b663ac7feed0314b9726646b505d47f45
SHA5122f592e36bf51eb2da2395e56b3120c145f27bd6ab21152d4e6c62dc653c49beecfd64a613bb127c49dd33a100d5852ff349b8b62faa627b0236619233cac0793
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502d3ca0eab5f8dbcf73affbae725c8b2
SHA18c2eaeea7fbd8e09ec2b0bd9554d5a85e460a112
SHA25623d8f1d557d42342fc7d7e7ae28f3322d81982bbdf87aefad8f9437fcd800308
SHA5121fc4bf897546bb025198ac3fd5859c9e031655a145e6fedd25ef7785deb1145e67dd32ef19ba64f79655ae145764a3e392c783e96af3ffddcaea69ed937db6f3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a