Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
acb5d018e2766108f5c4cad77f494519_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
acb5d018e2766108f5c4cad77f494519_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
acb5d018e2766108f5c4cad77f494519_JaffaCakes118.html
-
Size
2.2MB
-
MD5
acb5d018e2766108f5c4cad77f494519
-
SHA1
abc51c26db14818e90ae8b0662d6438598d6513d
-
SHA256
f109f30e92d888a1c7517db1d68f60f1beb7823452a65d66ab685f45baca1ae6
-
SHA512
dc6447a2d9c97b5fc8996c8a5cb0da7ec09332e4dd1a36b83ea92de8b66e204465a36bda8bd89d510db3bf7ab3778bfc936dddfc125cd1ad2bde7fc2546cb523
-
SSDEEP
12288:r5d+X3poCPuzmrugwG2q45d+X3poCPuzmrugwG2q/5d+X3poCPuzmrugwG2qG5dz:D+aDHs8+aDHsN+aDHsC+aDHsJ+aDHs1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009590a2678d3edc47adc5d4a1e751c15500000000020000000000106600000001000020000000c9229ac8ee1e9dd43e304259e18dca36484fd09032c6413d765cd9b0395d1182000000000e8000000002000020000000763508fa35cb27b4bb633e31d857ac9a159d9f67de9c0fe167d8e7c649cae2f4200000003d464ef33797cb21217024d0fdfdc0b6c4aaef85a7077afef5c448f2bef2d85740000000662cb15b8468af343b2580cd035a5af0317e1ae0fda5a6a1495f54479bc935e3fcceef231b152f934dcffaa031dc8329fde2c839f2df589efcef0524c86ff7e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e61e63d2beda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009590a2678d3edc47adc5d4a1e751c15500000000020000000000106600000001000020000000b78a28b682d2e5439b36983348c1699ffd7e7b62f67172b9895984cc23b11678000000000e8000000002000020000000768ef8343dee28b3d427679e535ccce40c64b32d3e1c09a68a308970a9a4750c9000000067650dda34fac53d00e4a4c1c0ba8e66eb18ba4c578917d3506e335df5ebe345725f4ceda53ef8e83dc84a6c0bdd386ccffeaf34bee47ae09c0b34104fbe0a3c15391579ef3ee996c69c86cd7a4239a712e04e9fcca4b1d3a787aed1cb15ca94dcfb259ab345a48e0619cad4f813d0f99248d236f7e7f93db8ce524191d83ba72d9bdffdba33ecb1d5f444167c0c86c7400000009fc74b3b311d7cb0db636c7717cabce182970ce63fa019ff7942fe96247b7af7814de79ad57a27a82f80326231609f4cbaf20a2f913ec582f6fa7fed8160eddc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F866B61-2AC5-11EF-A1AD-46837A41B3D6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424583107" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2316 2308 iexplore.exe 28 PID 2308 wrote to memory of 2316 2308 iexplore.exe 28 PID 2308 wrote to memory of 2316 2308 iexplore.exe 28 PID 2308 wrote to memory of 2316 2308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acb5d018e2766108f5c4cad77f494519_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aabac8d7f6f2b7d4e8e9ba32c4e9a7c7
SHA122bf41d0fb54c5b770e332807a794f412457d1a0
SHA2565812ddfefdab63f5c5d66ca0954f2c7eb94c46282bc707c58736c45f669b8951
SHA5128b0ac729087e002a113bfb1bbe89be370c27ccbcbaafaab263650fe105fefc1a587ed76710df893bff327b23ada26e3e8c9f0c4e5333fb3be679ca6874624d9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d85dd74f46645f8ed27b4d70f2d932a
SHA12574529be5ce3ade107786d28567114d66e81b87
SHA25620a3ae1c4d12850e7003b17b3002bf07af39ee7088ec538f163b9283a3170e3b
SHA512f36df87cd530d684356aaec019f8a7b31c66baa5bef81ed62bd2b32e3a81cdf52dfd292b9d8eecc28028510f828460b951c76aa713ed7307152a695e1c348637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab9bf4340a8b05041fc2f95e06e5cfde
SHA1bf0d475c74edf71a031cae3f28fec9a4321d35b2
SHA2563d06191c361d7de1a4d64a9a26986c935ab04de2b10b6bf0596aa75f04e9f1d4
SHA5121a4a763ba0a37383c377fdc12ac672f68da83f7de3a2c04a1e9a48b622a8a2e52d53bf669b9d0268558c7a8d25ed2948c698f91aa92a11024a80ff2f8cd91ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f86de15405bce10fe3981da7e00c26df
SHA1e18226913b1ee8fbaad2795dbcdeb6f042d89a23
SHA256d510406ab3cec4dd47704956fb5d4f60585853d926919bb2ede06f1410d54252
SHA512a7f5a5db36ffbc7d385f938c8489f74aa91bbd98ca584161a38d58d5305ecb5d98c3f17a31208369c30c92a8853ac95901aa1db5673bd707688a737464950d26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd13743daf314085bd899d0dc682ac05
SHA1be731d73c81959fa13a16a72d46c92574c355820
SHA25608c6997c3bb25c75f8b12a6a32cd9f2113cf5ba3611a99b1c0d0b4d4d9b1791f
SHA512ea650dc2f385bd68ce6480ee92d4aab41bd87090d65a40eddcd00023aa0dbc3c8428564629cd54d08f14d64e2e629ce792d76afd422a3290a05ea854b6ecfe09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544b39c9a2a786906d340747c0a7f433f
SHA1f6138b5e3c818bee5fa79fcb042dab3c66c3c943
SHA256eb8b5176daa65b7b518e4c4fdbe10b7352cf0c37666bde93031e28f540158406
SHA512e143d5c2f514a36f6a6ee030def3b9f4be1585a556547fe0481e948ffc7c06c0f223e4f3ca973480826b7ec123d82081e7dea0931a0adb4867d9281c2ac7a659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f69e3138a5405c96d16e526f87e1d0e8
SHA191609bec1eec46a252d8e628cf90e456de82c1c2
SHA256d19bb6365d586ebbeda82a648beaf5595ec8cb9f4babc3a9d5d9fb41a5d69094
SHA512b17764bce7175ab68b053d685b112ccb8585174942e8b80ede67a91ed3971fcc7b0e6d6d81252a0126ccd3d6a7eeab933fe90b876bf02821f3ba14631886dba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f970fe9bbc326480902dbeef6655292
SHA139318514631db86660d094b08fdb10104e79d14f
SHA2560002b4edd895a6545e9bd89cb791c56e8d0a498957aba089446466df1adf9d8a
SHA512e937b224cae8165eef94e0ec920c30f2915d909953e5726c14e10b7f42ffb47f0df14e85195ea8b7735df9a724306137421ca6b373dff41938236f3b4e9a7c46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5206d3ef3f1133a2c428734bd4abaff85
SHA12ba1f9707b58a88b92ef948a1f150781fd1c2015
SHA256e6bf9ec8c8a1f0dc17f4a023a4dc468b2d982db82dc94c5b5383d23f6cc7c2c7
SHA5122003ddcbb03e87076d0a4795de506b320a5b692306d5d8d96ca9794c6e1e5e71e1ec8044f2b57a3ca887ecc911274bcd92ecb07d2f7c2de9fe46fce1be12f97c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe97592689855525a9d21be09ee358de
SHA175bd5c92fadb6576f581c59e390f14e22d7610ea
SHA256504da10410025a5b550d1a830b5bf0f128f6c175cd87114ad61820da180140cc
SHA5125d0ebcaacdb70e942f835c858cd34883c774330f8e230328168b96c2337c2868acb7d7ce6eb4ee4f24bf4f8337067e98a6c4fd06ba66beff2c0f9af0257c9d8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f21af73f3c9dfe2a1c87bef8b0f6a235
SHA139ebb48c1447ff3ade5bb4a0455e1afa871523a5
SHA25640b20fcaa0ca00dd2a82fadb13b4e456a0ca493bfbf010b55bf19385ad8f5d29
SHA512125b237769a9ac31d08d378b665e148bd010d37689050d42b242e6e55b6aca0d63022aa006a233951e11d7d95ff011408cb0a04a56c6ebad3116866fa2d170be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dff99d34999aa57251f4df451c7e1fa
SHA15283d63fd0e5e943b2f14071d0d07d46c589228f
SHA2566359b3580becf3422f9ad0c754e1d8103633728d861ea1daaba51654f04f5890
SHA512ead17033ff5f44431bcd74caae3413aaf37f873dfd7af6b53adfccd536fd7f8d71c16e438cd40f66362d2cdebf9cfe02facac0d1e465a6fc0eb1a44efd679bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572410e5df4a0dd254e502f480e672963
SHA1f5e56da22aedf1f3db3d70c4027ff4fb71f1e6c3
SHA25602ece063152a77f30d0c425d0b30db43a12f5f8255d64be79229659b23caed8c
SHA512b6181f70d708c602cc7a0ebe758a920ac8f8fab8a453b9dc20aaa2d5d58444172cbe3016ee5215e07e8b197eab2f51b7d4b4cd7a2880bfa9a78a179c384a8e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d88515cd26f84472b7608ede376e5b20
SHA1ae194987831227d35512706e73e460da88d82160
SHA2568bddaf2497d452971031b174926b3af05fc1f4a26ef6a6b7b6033bdd4e91b202
SHA512bc289d5cbc715302c386f4ce6a73d396557a7074ddfc9f9965aa33a9777fe285fe4cf4fd716e0952e03e89ced19854456a95710057af419472d38aed965f5287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542618bb2aa04fe5f13f353d79da0aa3f
SHA1a053abb3e2e327ba9c87fa001e63cbe623ae7bd4
SHA256eb85308e864adfb93057e99094216111a7905d0ee49b244bc05c0583a903b327
SHA512ccfdf72bc125c88c1fd96fbd41297daf06adc61c520be025af6a229e6f84f59a807f8604e26cd3648396c5a8bbe826e1c7d1ce9a10dab7ee10790893ecc5968c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6e4a4bc16112b74658526acce89e4f6
SHA1bb0d116d568200e8aa8c2e2d46b87ae08908c61a
SHA2560ce18e28760eaad25cc1e265f579e0d8a0d7c024cf792a2f0cd745b4b3e5f5a6
SHA51217a489c3aa26da3fc6e2263448a9d05b4f5590d9dd46db2ad47c4fa28363ef39dd5a3de8665d7589703b971cfa2a4b55c92809e6226839daf83f400eee8eaa40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53420c6cf99cecd04a7cd136a086288dc
SHA1c610bde24bf850ffe527b4cdfbeb4843c6cc833e
SHA2568d6a96e5336386fa5c24025243dc7eee41346a0f43ed940585042b7be85fb57d
SHA51201832c851ad7fe37a3665c25afe54b666660c7affec4dc1f3f138d6962583d81ea57b425742c9190f444d822461a1d51a306092d61eed66cc439c67112385734
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5400a7cc01bd7351bd9d5b74cb8ed72f1
SHA1fe21cfcf83d3afea6d114b0e38aba871420cca9a
SHA2567096c93782b693cf75a70790d40f98642e1168a6a596bd111ed237e571bd6f42
SHA51269270d395cff861bba4b7b17a6d6ea59a0cca609b1f9c1db0a35f9e72e6c9346b630dd9a5ba2847826027809922d9d3aa238e90260c08857f3ba330a28ac613a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b