Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
0a25ab71a69807a35d3d7cf289efdcce_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0a25ab71a69807a35d3d7cf289efdcce_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0a25ab71a69807a35d3d7cf289efdcce_JaffaCakes118.html
-
Size
53KB
-
MD5
0a25ab71a69807a35d3d7cf289efdcce
-
SHA1
6aa7464f1c0ebf9d488ad1214a641f34b36fdd85
-
SHA256
cd207e98d5e23ff464e8ba91d47dcafacfac049bda809320c7c1ab1a806a48d8
-
SHA512
9adfdb41290f0d57a35ce87039d13933aee9e72aa02086f4347715fae8327ddd1deda563962a8cd356ace99f569e1f3ea72f688c2dd07ee87ff7ee38453fc3c0
-
SSDEEP
1536:CkgUiIakTqGivi+PyUIrunlYs63Nj+q5VyvR0w2AzTICbbYol/t9M/dNwIUTDmDO:CkgUiIakTqGivi+PyUIrunlYs63Nj+q2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5365951-3257-11EF-A3C1-4A2B752F9250} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000a0d64c5a3a1f75639189a936863cca1dba0a7997acc199939ed88a1d4c5ee726000000000e8000000002000020000000a0ca32990d528cf070ec31b092ccaee863ab360805a3f92efb0a9ebebad14aae2000000008f7fb0c2f97cbb7bb00a4d74866f8771cf4adf571228b3901b8bdc5340dcdb6400000008787a9464da4dae01935f0ded8df1553ee408ba4ab4b741515d435e10cc732d54ab3494d5933c1fd999328701ae647836ebdf48f309bda61fc5751fea3841b30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000733ab651c70cd5763ee236131e3f900006c863cd2a603c1a7bc2e1b59c1bacb6000000000e8000000002000020000000fd1f14bfde5db5a70f40fa91c33c168f12b3cbf81eba9aee8e3dd0178eed3cb8900000009e5e6d6a0cb7912855220ab7104656396723f7a2f9bcd74569a234404642e20616bc72861b04d86b6b368061ec4d7aa8d5ee68d83fb6630f422059eff589896235ff5e15e56548a342824bd61562a13c1755c427a74303dddfa2c23011f3fd9a46f23c28ef2179485dc2626ee38fc02d810e1eef8e0af22be8e07c2342dd44b64ea8aa18593ee2406f834dd88ad15812400000000c02c0a4b88fec66a033434731c2a13b934e2c3ba95c73813674bffeac7ec6f65343a7c88e034aa3502a06e3ba59f919613b47b110436884baa9368a7c08b076 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00aa28cb64c6da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425415752" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1152 iexplore.exe 1152 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2680 1152 iexplore.exe 28 PID 1152 wrote to memory of 2680 1152 iexplore.exe 28 PID 1152 wrote to memory of 2680 1152 iexplore.exe 28 PID 1152 wrote to memory of 2680 1152 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a25ab71a69807a35d3d7cf289efdcce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5032f701097e95f2fa6527599a9ffe72e
SHA1367708fee66d642be4befd30650a069184f58cfd
SHA256b1345e7f8c337a853f2f4f5884a39c81b0dcc7a4a079ed0eaf8032cf23e2636d
SHA512ece1b1326f5d70d47a971d043c6340b672885f288c9a38091e67864eb02ce70903459aeaa2a28dec1a8b025a72bb4d9bbabf2e84470ef53de033640ada080c51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5033c39d5b393d40d939ae7f3a14c2d18
SHA1c67479b52a836feee78270d0189c39892e89913d
SHA256a3862a7065c707c0612c779bf870f3a9736956775cc6226c2e673f9e885e0b9c
SHA512b88ddd2f9b4e6e2e5aee484277c85b02fc57dbb72d2b1ddc5d2f0bd46817b8fb8738b78c3f23d76608caab82dc2b53d3ea3a6488283a010d23b07fb53e2dbba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a9eeeb93b66d72eda62df1bcc2a6dda
SHA121718bac916499195d20f2aadd514f61fd392b69
SHA256fac3099fae9be67222185c15509ad16381abcaae3ff1a6eb5501e7533a124e59
SHA512d243a741bdd2f3f350fa8d37d3916b9e2c1aa2dbaec3882e0c369f8be1168f82464820c239e8b1915938ab8ac92c2bf99291e6cfb633120f94273cbfbcab6fe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe2f9fabb774bcabe1374b7d520da30f
SHA102da8d9d37f95ccda2ac6d282d9c7c99519881b1
SHA2564f07e7543244b10e84b287ddfcb3ae96534d487a9581fd28359b5bb1e751f13a
SHA512bcc376e8adf44adf08910aaf591ed62195a03ee9abd63e54f5af35aef72463ae92f78b7d8660e024f1cc95119c6701e8dadddb9caa33855d134d1c9b83c30346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533fa4c9536927c23ca0e71fe3c2a1ba9
SHA15183222189491c092f45a69cdc78c07af013aef4
SHA256e063f832dc730014e48998f33e8982326d15128e004e32ead24336ad798fd27d
SHA512e6f18b54b3665b60bd2f5b0365013088e1e5db50ad32818584c8aacc2f9424046ba642bb34cb3a29a3ad8446c555443d2034e0e6e0a302882dce100e1fbc6d56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7bbc7f5fcd047a118b89d8d7ad71310
SHA1d18c28879cbfb458d9b620c64ca6a56cfc7a0e52
SHA256920d25ee08869057acd99c99091712e0d4667ac529139e9e46a6305d953b3cf0
SHA512d262171affcc0141ac1bbd9c6dbdb1d15f52966f3214cdb2f84ede38de41cbfc2fa2227787bcb8d43d3df2c65770fde43da461d0af3e1eb2b44bd1e5db8bd7f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bebe6c3fba0500a2606f786bfc28b07
SHA101de83425babb6d64f4739cfeeeb04d826a2324c
SHA256634cfd8c00943cee6f1bea7a65632322b0ee48b39820898c719c584a574e5320
SHA512ca1d3dab4aba38c19994bf7bb692da3817914295ae25cbbb562e8eaa5aaa4e451422113a3e702732c3eed5e01d44f4562f6250d9e8cb087d093d6f9f1a9ca069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bfde25481a1429575762346c3b6f50f
SHA13f87064f6798fd8416b47bd3a56fe367d745e23a
SHA256e4f8ebd1cb5a328e63805aa0009590d4f74fb61d46f83ef53f8437d3ecf5c43f
SHA512f79f356ab14cff908705c6866c9fc305f50e75c28bb4642fedd0c717044ded0525f787519838a504f4a9455d1553e922fa0afde67f69571769b9d686b2de2c56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1fe0a1341e1ac7bc065f962d39844cc
SHA1de263074adb1a2fea8c5a3b1eeaa0406f4e6e82a
SHA2566e0fa908100e1bc88197428812e4eadf0d5b714acbc15ee941f11fbef336b5db
SHA5125969e7b2cf38f7758ce5e0b1eb0bdd5fae376ef88a6e6dbf1ae043adc3f336c465d262a9791c4c016fbece2309364852df484a234d0213206ce634a23f5c7d95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5124bf19af219192b6cb3b855f2e97622
SHA1a559f2d870346c5b925699f2187a6747782ce8f1
SHA256d11fb93dd338169ff1b17adc3c73ad294c8d1ad0fa1453a8d56610c44aca1d51
SHA512a0b425cb37b7170f7501c5f66189215d586d2a8ca4920a1ead3d6de5233f24f309c3eee022ac06460ce5164c9622460c716435db1147318e40e589da090addf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b235db8d88020a6f68373726ffc2eaa3
SHA11dcb5afa2f2bdbb97019c1791877e68711b55d4c
SHA256c52344448f0150e17df37d39024e08faa03c3e469a0957d628d16492318bbff8
SHA512bc8c41cfc75f155c6e5abb069a81729ca3d47abf61b2013d6345f400f4d07faffa838e5a0650a0c61ce26e2bc1d581f886275a1e571ccb782053dffe5f9baa8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bdfea981da7cd513ad38a001dc004fc
SHA17467230379b577da017e4fb3f3cda58abcda537c
SHA2566082426cd255278140e1699e61b81b9cec95c9611d8b7b42068b7bf9f9527cc7
SHA512f4d538329bfd1b828ea6b7db98673b38da9a3bec12e9b0dfe6449f17cc958b8ef6b46a3e723f691889a6287faf609bb68b01d6dabda0273132f55a33e4919335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7fdd5e1c3015c5e12553214fdde09ad
SHA1dd0217904c29916cd8d18aa5b48312c0c15db7e1
SHA256778afd5ad34d8574dd3594daba798ddcd648276d7f648aafeb999c15c41bb00d
SHA512c12df0043e1ee3f7d5110c2488e33cc7fc5b3e4e0978d139375b0349031902efbb816858d9fc310e223ac8a8b955fe341eb3f70de3027b3a6cb76a7f8b75ab10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535dffa2bf013573655fe8c2dfc142cba
SHA11cfb97496b81ee837285ac178d42eddb50f5b1f4
SHA2560ee7e49b852cb4c1c0b6fac49c088a1aaf48a029e4380d35bd358100746bcee5
SHA512ee76367d122348aadd7411bc15af3e9e73fc793bf275916889a7ee23be124decafc7730ca0af849ef02c0c64da3e9984ed2b200d78ea23b3a877854827156a06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541b113e370fdefe49b10a9a00349a8fd
SHA1d6b6e9a0a2b2231c706da82110185e2d54975bae
SHA2564476b0d30e6df6612c2e1641405a3598fc10a07ee23c3f3fd7d8af35bd8d479e
SHA51201102582a98d0606fdec6136931b85c57457c606677983d18c34b6fc20f5357aebbefb34dfca5ebe4843f74dd5d070b98f6514d80d952d34c103b629e4c663c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51604460fc5d9eae3ee9c2b67b900187a
SHA1b8b2fac80476843571bb789821554fe4e2237d0b
SHA256a3907efc3b0286b302835367eb4085d96be2345e5be770cdafb497ea6ab5c5fd
SHA512aabb90bbbcd90e4db0ca5181118b42f269600b21855cd8178c6a0a40a1a1aa767e927040174809aa5c72f9476c2775d8a4301a0515f8f9981c34528f567b6b61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e1c270265ec688fd9eb797fb2d8ccfd
SHA1cc0fcf067c1a9f9baea6257f36e10b0c68705542
SHA2565cb060b0febfa4830e7c1a2d7d4ccff9319a19856c36fb3369a483cb2b8e09ac
SHA512287bc6367fcbcf3e44d7814c0e2857ce720d522e412f88aa0587815b8cdceaf320fb2a1cd8ac6fc56e1ea02afcd4e6a5bfef3f330efb00a92f8bcf36147eb025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1bd8183126e662f047ff6e16c0133f4
SHA1d7e0234ced7abb869d305764b10a046fe23c7c52
SHA2569be60bb3637ed73c7524e1c0c8f23334495886bffa6f14fd1535a57e33687be4
SHA5125baf80d62c57b320bb4260a0ee1ba3a1f8c57d7758ba13636e521372ab1d1c24e1656a9e5990b291bba1d1bdb3c6e80a6e27dfb74665663a469f683d6cc94846
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b