Input
[{"agent": {"version": "23.9.202.0", "id": "caf47cf7-d8bd-41a1-b245-7a9099339767", "ephemeral_id": "A6307A8D-13E2-4F02-96CE-E3AF3031D02A"}, "@timestamp": "2024-01-12T14:01:39+00:00", "client": {"ip": "10.0.30.101", "Name": "L-GYW29K3"}, "ecs": {"version": "8.3.0"}, "event": {"id": "921A1C8C-CE1C-488E-B77A-6619AC1F162B", "code": "120", "kind": "event", "category": ["process"], "action": "process-start-cancelled-by-user", "outcome": "success", "type": ["denied", "start"], "provider": "BeyondTrust Privilege Management", "ingested": "2024-01-12T14:02:08.5381905+00:00", "reason": "Process execution was canceled by the user"}, "file": {"name": "onedrivestandaloneupdater.exe", "attributes": ["archive"], "directory": "c:\\users\\flanders\\appdata\\local\\microsoft\\onedrive", "drive_letter": "C", "path": "c:\\users\\flanders\\appdata\\local\\microsoft\\onedrive\\onedrivestandaloneupdater.exe", "extension": "exe", "uid": "S-1-5-21-1983129399-241925652-3895696602-1112", "owner": "flanders", "created": "2023-11-28T17:20:41+00:00", "DriveType": "Fixed Disk", "ProductVersion": "23.246.1127.0002", "hash": {"md5": "F92469567CB73C2131CD37607C7DA592", "sha1": "D5EE80FFEB110C8AFFD2003D6B7E5E0088ADD0BC", "sha256": "5CE8B71FAD1EF9896FAFBA8C809D482570D3554F5836AE2E9CF50649B4CEF8E2"}, "pe": {"file_version": "23.246.1127.0002", "description": "Standalone Updater", "product": "Microsoft OneDrive"}, "Owner": {"Identifier": "S-1-5-21-1983129399-241925652-3895696602-1112", "Name": "flanders", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainName": "HRTSFLD", "DomainNetBIOSName": "HRTSFLD"}, "code_signature": {"exists": true, "subject_name": "Microsoft Corporation", "valid": true}}, "host": {"hostname": "HRTSFLD-W11-01", "name": "HRTSFLD-W11-01", "id": "S-1-5-21-1983129399-241925652-3895696602-1120", "ip": ["10.0.99.9"], "uptime": 768595, "architecture": "x64", "domain": "hrtsfld.zone", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "NetBIOSName": "HRTSFLD-W11-01", "DomainNetBIOSName": "HRTSFLD", "ChassisType": "Other", "os": {"type": "windows", "platform": "windows", "name": "Windows 11", "full": "Windows 11 22H2", "family": "windows", "version": "22H2", "ProductType": "Workstation"}}, "process": {"pid": 5084, "entity_id": "891de618-d5f7-4afa-bbe1-8ffecb7c3365", "command_line": "\"C:\\Users\\flanders\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe\"", "executable": "c:\\users\\flanders\\appdata\\local\\microsoft\\onedrive\\onedrivestandaloneupdater.exe", "start": "2024-01-11T18:49:45+00:00", "working_directory": "C:\\Windows\\system32", "ElevationRequired": false, "user": {"id": "S-1-5-21-1983129399-241925652-3895696602-1112", "name": "flanders", "domain": "HRTSFLD", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD"}, "parent": {"pid": 1424, "command_line": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", "executable": "c:\\windows\\system32\\svchost.exe"}}, "related": {"ip": ["10.0.99.9", "10.0.30.101"], "user": ["flanders"], "hash": ["F92469567CB73C2131CD37607C7DA592", "D5EE80FFEB110C8AFFD2003D6B7E5E0088ADD0BC", "5CE8B71FAD1EF9896FAFBA8C809D482570D3554F5836AE2E9CF50649B4CEF8E2"], "hosts": ["HRTSFLD-W11-01", "L-GYW29K3"]}, "user": {"id": "S-1-5-21-1983129399-241925652-3895696602-1112", "name": "flanders", "domain": "HRTSFLD", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD"}, "EPMWinMac": {"SchemaVersion": "4.5.0", "GroupId": "c0ede2b3-ca2a-4bf7-bb0c-6fd5f0f70ef8", "TenantId": "7f1e6a93-46b9-efc0-bdc6-59ea2f1c068f", "Configuration": {"Identifier": "76f52bf9-3294-4667-aac7-8185f7e72b1a", "RevisionNumber": "141", "Name": "NH-QSfW", "Application": {"Type": "exe", "Description": "Any Executable", "Identifier": "cc4758c6-09b7-4e62-9ffd-e0870cb9e313"}, "ApplicationGroup": {"Name": "(Default) Any Application", "Description": "This will match for every application type Privilege Management supports", "Identifier": "0b9efdf9-a490-4efc-80f1-482c5361ba5e"}, "Message": {"Type": "Prompt", "Name": "Allow Message (Support Desk)", "Description": "Assistance Required by delegated users or code generation by the support desk", "Identifier": "3c763fa8-56a4-4611-a21a-d4b0f98a0ee7", "Authorization": {"ChallengeCode": "79442392X", "ResponseStatus": "Prompted"}}, "Rule": {"Identifier": "6fcf64c0-fe18-433e-bd3b-7a7801492f80", "OnDemand": false, "Action": "Allow"}, "RuleScript": {"Outcome": {"RuleAffected": false}}, "Token": {"Name": "Passive (No Change)", "Identifier": "f8d4ce02-e95d-4700-b69a-957dc5c1de6f"}, "Workstyle": {"Name": "Low Flexibility", "Description": "Workstyle that applies to users who need minimal flexibility", "Identifier": "0ef3f7bd-a9ac-4550-8368-d43999e23d98"}}, "Event": {"Type": "Process", "Action": "Cancelled"}}}, {"agent": {"version": "23.9.202.0", "id": "caf47cf7-d8bd-41a1-b245-7a9099339767", "ephemeral_id": "A6307A8D-13E2-4F02-96CE-E3AF3031D02A"}, "@timestamp": "2024-01-12T19:44:45+00:00", "client": {"ip": "10.0.30.101", "Name": "L-GYW29K3"}, "ecs": {"version": "8.3.0"}, "event": {"id": "1AFFB4A8-A83A-463A-9371-34875FBA463D", "code": "120", "kind": "event", "category": ["process"], "action": "process-start-cancelled-by-user", "outcome": "success", "type": ["denied", "start"], "provider": "BeyondTrust Privilege Management", "ingested": "2024-01-12T19:45:36.5776178+00:00", "reason": "Process execution was canceled by the user"}, "file": {"name": "onedrivestandaloneupdater.exe", "attributes": ["archive"], "directory": "c:\\users\\flanders\\appdata\\local\\microsoft\\onedrive", "drive_letter": "C", "path": "c:\\users\\flanders\\appdata\\local\\microsoft\\onedrive\\onedrivestandaloneupdater.exe", "extension": "exe", "uid": "S-1-5-21-1983129399-241925652-3895696602-1112", "owner": "flanders", "created": "2023-11-28T17:20:41+00:00", "DriveType": "Fixed Disk", "ProductVersion": "23.246.1127.0002", "hash": {"md5": "F92469567CB73C2131CD37607C7DA592", "sha1": "D5EE80FFEB110C8AFFD2003D6B7E5E0088ADD0BC", "sha256": "5CE8B71FAD1EF9896FAFBA8C809D482570D3554F5836AE2E9CF50649B4CEF8E2"}, "pe": {"file_version": "23.246.1127.0002", "description": "Standalone Updater", "product": "Microsoft OneDrive"}, "Owner": {"Identifier": "S-1-5-21-1983129399-241925652-3895696602-1112", "Name": "flanders", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainName": "HRTSFLD", "DomainNetBIOSName": "HRTSFLD"}, "code_signature": {"exists": true, "subject_name": "Microsoft Corporation", "valid": true}}, "host": {"hostname": "HRTSFLD-W11-01", "name": "HRTSFLD-W11-01", "id": "S-1-5-21-1983129399-241925652-3895696602-1120", "ip": ["10.0.99.9"], "uptime": 789181, "architecture": "x64", "domain": "hrtsfld.zone", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "NetBIOSName": "HRTSFLD-W11-01", "DomainNetBIOSName": "HRTSFLD", "ChassisType": "Other", "os": {"type": "windows", "platform": "windows", "name": "Windows 11", "full": "Windows 11 22H2", "family": "windows", "version": "22H2", "ProductType": "Workstation"}}, "process": {"pid": 9756, "entity_id": "38d9bedd-6c48-4b67-8d8d-6093c481603a", "command_line": "\"C:\\Users\\flanders\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe\" /reporting", "executable": "c:\\users\\flanders\\appdata\\local\\microsoft\\onedrive\\onedrivestandaloneupdater.exe", "start": "2024-01-12T19:40:24+00:00", "working_directory": "C:\\Windows\\system32", "ElevationRequired": false, "user": {"id": "S-1-5-21-1983129399-241925652-3895696602-1112", "name": "flanders", "domain": "HRTSFLD", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD"}, "parent": {"pid": 1424, "command_line": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule", "executable": "c:\\windows\\system32\\svchost.exe"}}, "related": {"ip": ["10.0.99.9", "10.0.30.101"], "user": ["flanders"], "hash": ["F92469567CB73C2131CD37607C7DA592", "D5EE80FFEB110C8AFFD2003D6B7E5E0088ADD0BC", "5CE8B71FAD1EF9896FAFBA8C809D482570D3554F5836AE2E9CF50649B4CEF8E2"], "hosts": ["HRTSFLD-W11-01", "L-GYW29K3"]}, "user": {"id": "S-1-5-21-1983129399-241925652-3895696602-1112", "name": "flanders", "domain": "HRTSFLD", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD"}, "EPMWinMac": {"SchemaVersion": "4.5.0", "GroupId": "c0ede2b3-ca2a-4bf7-bb0c-6fd5f0f70ef8", "TenantId": "7f1e6a93-46b9-efc0-bdc6-59ea2f1c068f", "Configuration": {"Identifier": "76f52bf9-3294-4667-aac7-8185f7e72b1a", "RevisionNumber": "141", "Name": "NH-QSfW", "Application": {"Type": "exe", "Description": "Any Executable", "Identifier": "cc4758c6-09b7-4e62-9ffd-e0870cb9e313"}, "ApplicationGroup": {"Name": "(Default) Any Application", "Description": "This will match for every application type Privilege Management supports", "Identifier": "0b9efdf9-a490-4efc-80f1-482c5361ba5e"}, "Message": {"Type": "Prompt", "Name": "Allow Message (Support Desk)", "Description": "Assistance Required by delegated users or code generation by the support desk", "Identifier": "3c763fa8-56a4-4611-a21a-d4b0f98a0ee7", "Authorization": {"ChallengeCode": "79442392X", "ResponseStatus": "Prompted"}}, "Rule": {"Identifier": "6fcf64c0-fe18-433e-bd3b-7a7801492f80", "OnDemand": false, "Action": "Allow"}, "RuleScript": {"Outcome": {"RuleAffected": false}}, "Token": {"Name": "Passive (No Change)", "Identifier": "f8d4ce02-e95d-4700-b69a-957dc5c1de6f"}, "Workstyle": {"Name": "Low Flexibility", "Description": "Workstyle that applies to users who need minimal flexibility", "Identifier": "0ef3f7bd-a9ac-4550-8368-d43999e23d98"}}, "Event": {"Type": "Process", "Action": "Cancelled"}}}
Output in S3 bucket after decoding.
{"agent": {"version": "23.9.202.0", "id": "caf47cf7-d8bd-41a1-b245-7a9099339767", "ephemeral_id": "A6307A8D-13E2-4F02-96CE-E3AF3031D02A"}, "@timestamp": "2024-01-12T19:44:52+00:00", "client": {"ip": "10.0.30.101", "Name": "L-GYW29K3"}, "ecs": {"version": "8.3.0"}, "event": {"id": "28FEC1B8-A530-4DB2-A6FC-14B412C87DF4", "code": "113", "kind": "event", "category": ["process"], "action": "process-start-privileges-modified", "outcome": "success", "type": ["allowed", "start"], "provider": "BeyondTrust Privilege Management", "ingested": "2024-01-12T19:45:36.5778832+00:00", "reason": "Process started with custom token applied"}, "file": {"name": "traceconfig.exe", "attributes": ["archive"], "directory": "c:\\program files\\avecto\\privilege guard client", "drive_letter": "C", "path": "c:\\program files\\avecto\\privilege guard client\\traceconfig.exe", "extension": "exe", "uid": "S-1-5-18", "owner": "SYSTEM", "created": "2023-10-19T00:21:22+00:00", "DriveType": "Fixed Disk", "ProductVersion": "23.9.202.0", "hash": {"md5": "41DB150493F53C4D035FC90090C64E6E", "sha1": "AF9E607EF24B061AE52D8695DEB484769399D817", "sha256": "8E1838D8C3DF45697BAD36F201421B8D06EFB12C944DEA6A8F1DB74F93B3C709"}, "pe": {"file_version": "23.9.202.0", "description": "BeyondTrust Privilege Management Trace Configuration Utility", "product": "BeyondTrust Privilege Management"}, "Owner": {"Identifier": "S-1-5-18", "Name": "SYSTEM", "DomainIdentifier": "S-1-5", "DomainName": "NT AUTHORITY", "DomainNetBIOSName": "NT AUTHORITY"}, "code_signature": {"exists": true, "subject_name": "BeyondTrust Corporation", "valid": true}}, "host": {"hostname": "HRTSFLD-W11-01", "name": "HRTSFLD-W11-01", "id": "S-1-5-21-1983129399-241925652-3895696602-1120", "ip": ["10.0.99.9"], "uptime": 789182, "architecture": "x64", "domain": "hrtsfld.zone", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "NetBIOSName": "HRTSFLD-W11-01", "DomainNetBIOSName": "HRTSFLD", "ChassisType": "Other", "os": {"type": "windows", "platform": "windows", "name": "Windows 11", "full": "Windows 11 22H2", "family": "windows", "version": "22H2", "ProductType": "Workstation"}}, "process": {"pid": 2884, "entity_id": "d9a4d0e4-9b7e-455a-9faa-e68c54259e7a", "command_line": "\"C:\\Program Files\\Avecto\\Privilege Guard Client\\TraceConfig.exe\" ", "executable": "c:\\program files\\avecto\\privilege guard client\\traceconfig.exe", "start": "2024-01-12T19:44:48+00:00", "working_directory": "C:\\Program Files\\Avecto\\Privilege Guard Client", "ElevationRequired": true, "user": {"id": "S-1-5-21-1983129399-241925652-3895696602-1112", "name": "flanders", "domain": "HRTSFLD", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD"}, "parent": {"pid": 6784, "entity_id": "583f1c86-d8fd-40a4-98d1-6902447e91fd", "command_line": "C:\\Windows\\Explorer.EXE", "executable": "c:\\windows\\explorer.exe"}}, "related": {"ip": ["10.0.99.9", "10.0.30.101"], "user": ["flanders", "SYSTEM"], "hash": ["41DB150493F53C4D035FC90090C64E6E", "AF9E607EF24B061AE52D8695DEB484769399D817", "8E1838D8C3DF45697BAD36F201421B8D06EFB12C944DEA6A8F1DB74F93B3C709"], "hosts": ["HRTSFLD-W11-01", "L-GYW29K3"]}, "user": {"id": "S-1-5-21-1983129399-241925652-3895696602-1112", "name": "flanders", "domain": "HRTSFLD", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD"}, "EPMWinMac": {"SchemaVersion": "4.5.0", "GroupId": "c0ede2b3-ca2a-4bf7-bb0c-6fd5f0f70ef8", "TenantId": "7f1e6a93-46b9-efc0-bdc6-59ea2f1c068f", "AuthorizingUser": {"Identifier": "S-1-5-21-1983129399-241925652-3895696602-1103", "Name": "mundo", "DomainIdentifier": "S-1-5-21-1983129399-241925652-3895696602", "DomainNetBIOSName": "HRTSFLD", "DomainName": "HRTSFLD"}, "Configuration": {"Identifier": "76f52bf9-3294-4667-aac7-8185f7e72b1a", "RevisionNumber": "141", "Name": "NH-QSfW", "Application": {"Type": "exe", "Description": "Privilege Management TraceConfig", "Identifier": "7995df95-0031-460f-a5e3-cfd2b12758d8"}, "ApplicationGroup": {"Name": "(Default) Privilege Management Tools", "Description": "Privilege Management Support Applications", "Identifier": "81d7eec9-c850-493b-815e-68f338975cd5"}, "Message": {"Type": "Prompt", "Name": "Allow Message (Support Desk)", "Description": "Assistance Required by delegated users or code generation by the support desk", "Identifier": "3c763fa8-56a4-4611-a21a-d4b0f98a0ee7", "AuthMethods": ["Password"], "Authorization": {"ChallengeCode": "58332394X", "ResponseStatus": "Prompted"}}, "Rule": {"Identifier": "d2bc113c-dcde-455c-b05c-20a5576d0ae4", "OnDemand": false, "Action": "Allow"}, "RuleScript": {"Outcome": {"RuleAffected": false}}, "Token": {"Name": "Privilege Management Support Token", "Identifier": "ca55c2c8-3454-4a4c-83b4-8e29503f2cd3"}, "Workstyle": {"Name": "All Users", "Description": "Default set of rules that apply to all users", "Identifier": "4e0b71b9-0e4e-4dba-bd65-243f7aa574bc"}}, "Event": {"Type": "Process", "Action": "Elevated - Custom Privileges"}}}&vVB#'fW'6###2##R"&B#&cSR#c2CC#BӖ6c2#Vcc#32"&WVW&B##c$T#cBD$$D4#RӃ$SbSdddSt3d#'$FW7F####BUCS2"&V72#'fW'6##2'&WfVB#&B##s4dCD#t2CC"ӄCSST#33scR"&6FR##"&B#&WfVB"&6FVv'#'&6W72%&7F#'&6W727F'BFBF֖FVB"&WF6R#'7V66W72"'GR#&vVB"'7F'B%'&fFW"#$&WEG'W7B&fVvRvVVB"&vW7FVB####BUCSSrcCS#sB"'&V6#%&6W727F'FVBg&6VVRvFF֖&vG2FFVBFFV'&fR#&R#&6BWR"&GG&'WFW2#&&6fR%&F&V7F'#&3vFw577FV3""&G&fUWGFW"#$2"'F#&3vFw577FV3%6BWR"&WFV6#&WR"'VB#%2RӃӓScR3CS##cC33CBS3##c3##sCsCcB"&vW"#%G'W7FVD7FW""&7&VFVB####2uC#3"$G&fUGR#$fVBF6"%&GV7EfW'6####c#"&6#&CR##34CScT44#SStS3t$TCSS#4$3""'6##$4D4cdCST43DcS#csT$CcTccT#DCS$d#d#Cr"'6#Sb##T3S$C$33C#3C#CT3dTTdt3dTd#C$Cc#34S###CCc3#d#2''R#&fUfW'6####c#v'VBc"&FW67&F#%vFw26B&6W76""'&GV7B#$֖7&6gESRvFw5SRW&Fr77FV'$vW"#$FVFfW"#%2RӃӓScR3CS##cC33CBS3##c3##sCsCcB"$R#%G'W7FVD7FW""$FFVFfW"#%2RӃ"$FR#$B4U%d4R"$FWD$4R#$B4U%d4R'&6FU6vGW&R#&W7G2#G'VR'7V&V7ER#$֖7&6gBvFw2"'fƖB#G'VW&7B#&7FR#$2v2"&R#$2v2"&B#%2R##S3csR3Scsc"CsC3R""&##"c"%'WFR#&&6FV7GW&R#'cB"&F#&""$FFVFfW"#%2R##S3csR3Scsc"CsC3R"$WD$4R#$2t2"$FWD$4R#$"$6765GR#$FW""&2#'GR#'vFw2"'Ff&#'vFw2"&R#%vFw2r"&gV#%vFw2r#4""&f֖ǒ#'vFw2"'fW'6###4""%&GV7EGR#%v&7FF''&6W72#'B#s#b&VFGB#&cvfS"sc#BFCrFc2ӆScSSCS"&6EƖR#%$3vFw577FV3%6BWU""&WV7WF&R#&3vFw577FV3%6BWR"'7F'B####BUCSS"'v&uF&V7F'#$3W6W'5ƆgW6W""$VWfF&WV&VB#f6R'W6W"#&B#%2R##S3csR3Scsc"CsC3Rb"&R#&gW6W""&F#$"$FFVFfW"#%2R##S3csR3Scsc"CsC3R"$FWD$4R#$''&VB#'B#c#B&VFGB#&C3c6CRC2FS&"#fVR#&#VSSVS6S"&6EƖR#$3vFw5W&W"UR"&WV7WF&R#&3vFw5W&W"WR''&VFVB#&##"c"%'W6W"#&gW6W""%G'W7FVD7FW"%&6##34CScT44#SStS3t$TCSS#4$3""#$4D4cdCST43DcS#csT$CcTccT#DCS$d#d#Cr"#T3S$C$33C#3C#CT3dTTdt3dTd#C$Cc#34S###CCc3#d#2%&7G2#$2v2%'W6W"#&B#%2R##S3csR3Scsc"CsC3Rb"&R#&gW6W""&F#$"$FFVFfW"#%2R##S3csR3Scsc"CsC3R"$FWD$4R#$'$Uv2#%66VfW'6##BR"$w&WB#&636FSf2ӓSbCfBc6"SC&3Ss#2"%FVDB##vcSf2Cf#Vf3&F3bSV&c3cb"$WF&uW6W"#$FVFfW"#%2R##S3csR3Scsc"CsC3Rb"$R#&gW6W""$FFVFfW"#%2R##S3csR3Scsc"CsC3R"$FWD$4R#$"$FR#$'$6fwW&F#$FVFfW"#&3c&&S#bFcbCv&RӃv&R#f3F&SS&3"%&Wf6V&W"##r"$R#$62vFw52"$Ɩ6F#%GR#&WR"$FW67&F#%vFw26B&6W76""$FVFfW"#&6V663SR3CC3C2#SccV#cs36"'$Ɩ6Fw&W#$R#"&V6VFVB&W7G&7FVBgV7F2FVB"$FW67&F#$2gV7F2FB6VB&RW6VBƖ6W6ǒ6&R6G&VBvVWV7WFrFVB"$FVFfW"##SVCfrSRCSӆSSCv&R'$W76vR#%GR#%&B"$R#$rW76vRWFVF6Fb&V6"$FW67&F#$6f&F&Vf&RVWfFr&fVvW2vF&V6B&RWFVF6F"%W6W%&V6#$ג&GFR626"$FVFfW"##3V6SC&CCVӓBFVCSVf&#"$WFWFG2#%77v&B%$WF&F#%&W76U7FGW2#$BƖ6&R'%'VR#$FVFfW"##F6##c#2C62C6SBӃ#2c&SV&&C2"$FVB#G'VR$7F#$r'%'VU67&B#$WF6R#%'VTffV7FVB#f6W%FV#$R#$FBgVF֖&WV&VBf"7FW'2"$FVFfW"#&c33#B#vbFCcӓ#R3sSCCscF3'%v&7GR#$R#$vfW&ƗG"$FW67&F#%v&7GRFBƖW2FW6W'2vfRBbfW&ƗG"$FVFfW"##3#c"cvS2FC#SRvCV3C"'$WfVB#%GR#%&6W72"$7F#%6VbVWfFVB'