Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
d5cfe88ff732719995f8d26c76a514b8_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d5cfe88ff732719995f8d26c76a514b8_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d5cfe88ff732719995f8d26c76a514b8_JaffaCakes118.html
-
Size
45KB
-
MD5
d5cfe88ff732719995f8d26c76a514b8
-
SHA1
6f8d494c5e1c270d6cd4a80130cd3208429c61f0
-
SHA256
a303f954472b43a031e638198edf8ba2fe15c17cf3b0733e134be1e8a2ede88d
-
SHA512
964d4a739bede523db0e23286d8a1d5c750214987f5eb575b7f33f5697acfbb1b35ad2ebd75eade61b00c0e86c65537f46b0f2826d30d5a25180a25e02b4e45c
-
SSDEEP
768:5X8Jrpje0DnLmCQHNeTCINDovgbsy1XiJ2C7QJNFEzpxi/oRD75xM:5ipje0tIqDoIbs7b71zpxi/oW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3092 msedge.exe 3092 msedge.exe 3820 msedge.exe 3820 msedge.exe 5044 identity_helper.exe 5044 identity_helper.exe 6080 msedge.exe 6080 msedge.exe 6080 msedge.exe 6080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe 3820 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 3700 3820 msedge.exe 83 PID 3820 wrote to memory of 3700 3820 msedge.exe 83 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 2540 3820 msedge.exe 84 PID 3820 wrote to memory of 3092 3820 msedge.exe 85 PID 3820 wrote to memory of 3092 3820 msedge.exe 85 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86 PID 3820 wrote to memory of 3280 3820 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d5cfe88ff732719995f8d26c76a514b8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa591d46f8,0x7ffa591d4708,0x7ffa591d47182⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:12⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:82⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:12⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,7920818440407607946,14834166672281139097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6080
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5788331a6748db2f339c170800f1cf77d
SHA1a3879bed626c3f1332c8cc0926532d4b2eb6cf00
SHA25679397b6a75cea5d22da776a7afbc8ccc292cbf87305eb4678764e76fdc129056
SHA512b9ff0be0ca4e1ae971e71a65feaed375bb8f8c6d5dadcb063ba14628bdb064af7919e6e9268119cb33c26d66bb093ca6362850c79f5d8975bf37ca7880b0f218
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
24KB
MD5d1c8fc93e329cfdb4cef6b1363e40db2
SHA12d034d8d0056a8c1596714c7129fc31c74a2565c
SHA256facc5d448f6e3267100a4c236f09aa98bea1cc3b19e2b2a0985501ca499c4ca2
SHA51207434e4af30064d5f67158d10b704afccaa31f974ccaca5e76dc9f1b05d76106b44f124c3a94af93eb1b44a5aeaa70ebc33e0f9f904d1cd4c8386b281735d008
-
Filesize
45KB
MD5aa6a698d1c7fc6d35265b10af5570e9c
SHA100da372ad4964a5d5b8afff7fe1b207ff284f232
SHA25602f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a
SHA512f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize264B
MD5a70ad0a71831e1eddcc7644a72cc01ac
SHA16e9d7b0ccb720a4642ed18e4b43da4dd2d8e65c5
SHA256219ddd174dcc139ccec2d8fef369ba440a0f9171f367a0bdfc85f22dff372bd0
SHA51250c76435025254350fc80299c68d27876567771e3b31757768bdcf901d4a79d8a49f0c1376caee90ab8dad8c9450098b620034d507dbf5635f8ac6187aa65640
-
Filesize
1KB
MD563a1cce2b2b86fa8ef5d77216440135c
SHA1d0c1ec2955990ccbc4933ccc53055308a431eecb
SHA256ade88f181d1d0c28b3067f340e24aa894e51dfebddc40fc644744d1054413a1e
SHA512656530eb2ae11d0b8876bbe56d4045f43bc3b36f5ce9fccfcf5caaf427e2d007e835dfda93c110729aa1f5cd57ff55d39e72302170a8e1e285b0e329cdddb1f3
-
Filesize
5KB
MD5548ce17e2da9ec8cef77c0a56972853d
SHA14bad4be0834e8b7201b609e9ea90e935f1e99bdf
SHA256ce9bbef41ed7da7e236933acfde2c79c9e6f85c2540385537261d061dfaa0aab
SHA512c4ebdba48fceef2d9a54b1c77661b543929e074b06c78a4f969536b24553a658bdd98afbdd83157fca29dc99f349399b540ebf86b97c018eb3bfa99b86e5aadf
-
Filesize
7KB
MD5c6898f30453fda563657b6a86f39881d
SHA1b34c9b2e6c0fd2eb40dd044135c6d1df4cb4f54f
SHA2565de11fb2edce611058452e58ba99fe6b77dcb6d60b69f310dd39436d2046720c
SHA5129edd806225635f2721836a5e02817dff4f975c6f83c88efa879b3b5435e909fd60882fecd4f98e7efc97ae43440160ed0e9af33fb5b85657c1165ba6a1e27c8c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389