Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
62f431993f051f28ce416fa0a6da1116_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62f431993f051f28ce416fa0a6da1116_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
62f431993f051f28ce416fa0a6da1116_JaffaCakes118.html
-
Size
41KB
-
MD5
62f431993f051f28ce416fa0a6da1116
-
SHA1
eaff0e8ea0e01b825dc20d4b66605858a4866fb0
-
SHA256
978e8e5aba0e31195ce8d4ff34d44793e01f24456fc999e3ef789e328f6b5d69
-
SHA512
b996d1bd371fd289e4bfaba932504f0813825de90f77c98ced19ff460f07cd91ae8beb180ce67790b735c86477e76dcfa6edd7ae2858cf3616cc22e06dce93fe
-
SSDEEP
768:MpTQWVloMMWsH9P03GvwI1zn1uoZQZRG2SgWr:3WVlxMWsW3Gx1TZQZRSr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000056b974dd8c34e100083d597938a172ae2d22d97e5b4841a7420830f77fef2ce6000000000e8000000002000020000000679120b24136d4e8f5f909fa2ad909720f0a8d754d6b1f9501c6794d034fccf820000000e18d4a4716784cbeb79eba47844a88fa23ee16ba829288c42b432173faa3d3de40000000309bbdf2239f94462fd9cb1ea6622fd3418cfbf83f9aae2038ccc004aa0671aa603308fa4745f047572a3c778ddeb403bfc0d35e8fda9a16041f5a13673f4c93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000cd53775dafd1473766b4b09b14e5b7a921196dd5d1b3bef071d665b0d53c7dcd000000000e8000000002000020000000ef4900e4bb1edbd11eb5a9c370522ae97952690a83d9c2626e73ed76e5740d179000000062d1129ecd1b729dc23c8bd53a1fa211c87002271b6efce16707531d7c980e3d81ae07d8a79e1f8748c30a9acd28564867b60128aa85770dde455d2697a2e5940613808a0760324219b65458f7ee3fbd18704ea66184e7771338b4a4c0b3f9e0338b73ee139abb98463eb864ccc2d817b97a5422b9d2cb7a70e8b9d9049617848248af6f95bc5416b4e3bafd6becd552400000005af934bdcacff0cfcd220571d33677bb258520120677c79dad03269ae0c82a0b7a0805d5653a6f66880a53db8766c1c7233e826b21156db7bff4da4fa0772bdf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d84e5c26dcda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427807817" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B6247C1-4819-11EF-B65B-6A2ECC9B5790} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2444 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2444 iexplore.exe 2444 iexplore.exe 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2868 2444 iexplore.exe 30 PID 2444 wrote to memory of 2868 2444 iexplore.exe 30 PID 2444 wrote to memory of 2868 2444 iexplore.exe 30 PID 2444 wrote to memory of 2868 2444 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62f431993f051f28ce416fa0a6da1116_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc40e5835b966c9570f1197ad05c9f98
SHA16c957466637621e238f8c817984ee708536d21cb
SHA256105e21d0ecbe7c881b6a2265bd6b2921979171c9eca14bd3868ae355e3a9c224
SHA5126022d284400fae9655b813cdb5619b1fd62829e367c796aac9ba6c4264a74879773d404025787cd43987644868a458721db516ce973a0662580cf03cd4795eea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e955132b8976013a3573965286aa61c2
SHA10f602e754d1eef717fc3efb3f049240800513a35
SHA256b704e881e649c458acd343bc0f35482e54f38c5e03cef5a6f195d70b3e1a7ae4
SHA5125562abc89d1a1ab36ca0cd6091382f3a5277222dab5aaedb5758c8b7abf7f8ddfd82c0636634f04e46f597a659240a86a1c9aa8fd985c9af9d61ade2c0c9c6f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f186a5f55c33c8bf44eca77cab5ee96
SHA12a3657f477b0a9371d41860bf0bc7437da9e29db
SHA2568521a92cbcaf3e6d6f0d082c49d03dfdfeb7482678b6092cefb1726ad64f8991
SHA5122d1c52ab5d2f445570511aadacc87243204fb1c63ec49d1adeba0352e9ca496d030b11af7a4a95d45cbda66d64d89133e273623b69167e8a0f2e8f3aaefad776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c43f76f127390c9678910e89eaf4a807
SHA1143165fe3553bcc5e13932b495304dd458b677f5
SHA256d67732a67e71031f99558ed099005d7f40327b8dc756fad782c68c908d10408f
SHA512ce6e356995e615b403761c10688787ab4e2fe2d7f5fda511927f67df3778dace2397609003a63733d9ef5e28cac9c7829953897b5d221ac962ca336ebeaa8e8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db8f031aab1d74935a5a00800daf7724
SHA10ad62552091668b9be8707423083ec56ae35bcbb
SHA2567f4e6d46a85116bbf5f970e0ad3d16e51f8e0e42a0c9a4db82607f69ff837765
SHA5121ff18275306461b5a3ab1205d45588842cf2e9dbdd0e6fcba51d6b05727bbd73163e17bd5c25195d191655cec3aa54aaa670aaaae8974255d95edb731fb463f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5341d2d41f31380fc3ec182cf899d646c
SHA1a6d88b8b0197e81abeeedb614852adf0f80bd501
SHA2566e4452d8bdd536034706d05bfd6a66fd8c31085dbae08a1d45fefefe5f15c7f9
SHA5127302e09693df59dacc8d8a2f517e9858adcad9ba37f15f9e8b9bf76818c61d69d942169edd6fc65db9291721b699b5f9fb1d300b3693366bf9f9b0a0ccc96076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ecb264c56122ba51958cfbe9957f59b1
SHA1beb5e3de8e3e9f0c86d44cc45309d09845e32f6e
SHA2565ae5d36e2c8d9bc4f3a4f25331771ef4e5320ec6f156e509d51ae6afb52303e5
SHA512f2668d34c76335b7da30ff24c48fb0c73a3ae496bd1a053436b518440a1a2599c183818da9a37ee5af1b7e9532e0cc0e41e6e48073d00567c01df64f7a44f427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541bcdc8e1f694e1a60e418d6dee6bb61
SHA1fc4d2814607230c26511ede7080dc46438d854c4
SHA256e4fc8cf541ad79e9ad98e941e2aa6ba85bbb21e017abb33f7571e8c11ac3dfb5
SHA512c3ec36b3e560070dd3a34a012b4cf5c504303e8f9550b64fb294ed027c3a1e88b6552a86099ee9b97077fe9f565d1e9db820515df0adf213f7d9e8a096f91da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e01addb2765b0845e00d211f0d6c4dc
SHA1fe4b33f101c85fd62ad7aa203e73ad43f0ecb936
SHA2564edfe34531c1fa1078ee4d57f101b07af58da89d211fc13c205f7d73b4d82768
SHA5120cb7a68cac8ec055b3bcef964162af042b9d7504397f7dad51dc93b4aa6d83c70257fcd5c561f6907ae952b2a90770bd0b45185d1767420c90d59a69ed0a227b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587ba088048b753ddd09116cb4ae8b82a
SHA1ae286d6d0fed6d949f4eae8a115142e6ec39357d
SHA25650d1a5035fcb3f0ed95d326b7fe35b08bbe33e0b7a22d65f14739d7c042a0ea1
SHA5120c20b812aa246d9e17d08a51c4c5f9d5f059e89788696223330e9506ca5217e71d7566e4b31f9edf85eca5719f9117f73540070a63d17c8e7f5dc5ce514a7371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b86458f0d1565da815c4ac17ad4cedde
SHA16a8167002198af3f720286ebabc106ae056241e8
SHA2560ae175da973d08f7e1b593fd6be673766e9eed750e39fcf2b7d47a5362ca2999
SHA51223fab68a41a3108b05c4df726adf110df67d64fa95ed01ad2a15bc77cb9c43be94aafc34c35b68b6c0ffc57492b2151166a08afb80259d6f6dbd777bf08818b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568133deede65018c9687081b6a74a35e
SHA1b173595cda5994f9e6b021d7eddfcc24046de033
SHA256874c8430499db0c44bd5af3c4f90ac8b238e0cfedac9c33f81f35545a25796ee
SHA512c9d90ad6e04bc32bc613bc5e36378562fc510e1351d37f01036acd6e4bf077af37ed0b5e3b9fca6f52bc8757ba40c55a240bda461f3b7a3783fb291f8f69d327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e83671e7e9e9b5b3cf255c7adf2dcfe
SHA1cb27edbc9c9e787256faf5adac59a91a90a839b7
SHA25692880400f390fad172ba9e5801cb126e96444ab3374953045e273199803648c8
SHA512e152384271544279d36c2159c2fe0e4a4ed383cfa8561a698cfb8410c9db97d21c19aab047790ae5e6b52372d5ec32d38288448f732a71ba25f4b2d50d29787f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d90e868d867627c16edb5fa4a89255e
SHA1abb24ae2ceb233815457735be250f120e7ac097d
SHA256046724e5afd65b7ea40daa0f64c7cf8dc2314fd0cf8239670b62166d1960cc97
SHA512ee39751e8096ec55647c52e6f093552c49d21fef46206d341445ce0f5b3bcb2e9156ff6f1a2759f301263afa2a5a8116c883e2070f10fc53c9042b360c1de6f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582a3cfa0bee062aca1a637205cacbe32
SHA1f97a0b96a932a67c58c95a4765c1e7bf1c2f4967
SHA256b363b185355a10c3844a99ab48d116bc65521b7ba9084ca1f494ee1dfbac526c
SHA51270e15fa561d0e7cedabf63f73bcdcf5faffa5948ef59c7ee3d3f340d5bc654a75bea6bb9503d3339f02f482aa7ccc0ab2d51b404544137b450cde968caec0ca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523b2915105e8845246ffd5873ee74e62
SHA1e585d2e09d075490945075fc323989374dd8aa0d
SHA256dfb0d1e51b97da7603f8be719c48d61eaa80bd2da4e0fd3cbbc074a7d490e972
SHA512921fb9dff7f0ff6987dfc4200ed30be1066a9dfdfce04ce89745557eb6ee63a1844d12d0a664fac609f69d4d15e8329f957ec61e2012500910b0138e3ea4076d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530ea96ea7907904170a304ffd193ab4f
SHA1163aa557eef390c65ca57c214373a70d4cace4fd
SHA2568aa6bc143d98ecd31e5871b655751b86d3d19067860d131a4c5e7fc758ce8eb7
SHA512940e88ce61d62db4f29f861d259799a3a485dfe4d3ff550baf5f214b1bff4bd2e38a529a0efeca18fb1e961b988ca8e3097c03f23af57415c389ad29be646f88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a4ed3dcce5e0cd1417e7b1fcb453a64
SHA183b206a627dfb07d1ab30c3410b241cbd3752c79
SHA256cf078864f5d8df46b129de085639c9e969a767def91edfe2e39078dbaf3f5fa4
SHA51295bf7ac24f8e3f0d305863cc914b26fd19ebd779f093c9c3668651be75b99700b5f920d76c92dbef9397e6449ff4bae7d0083620e7f20a04c1dea4abdfcb35d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b130593e6b5f1b7a64e660838f992ed8
SHA18ce4e3ad0b3df7994c491956773e797cf429b5cc
SHA2564cb84d70e95b566c196782ee10296d424690b5770f9fb70bb55f8097d6b72e20
SHA512afe2399a003c0b4631f2cb19bf378beb2455e8d640fe0ff25fa59ed5d0516ebf0c98fcccce6ec9b20b9d60695b8ff29ac6053bbf6e0cd12278c74860d15b093f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b