bdaejec | 54343dd25ffe8d5e90bb89fdb52f8b7dc586eb643f2f18299fce8be12821a533

Analysis

max time kernel
37s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Size 31KB
Sample260814-brlv3sap21
SHA256 54343dd25ffe8d5e90bb89fdb52f8b7dc586eb643f2f18299fce8be12821a533
MD5 e9ad38269e5f173b25f79fb6c894a363
SHA1 c9d0bfbe45ecf8aaea33d73d046e311413c31dde
SHA512 20082166305faf32534b7f9d0a9b9409630849ee454138f7ddf18d0df7f477b0393aecd315e45bfb68a87f3ddf61cc434124dec5423572a439c652c6fd7fc1c2
SSDEEP 768:HwNHtRbdktms0SHJTDzbAGH7TyAQGPL4vzZq2o9W7GsxBbPr:MHtjktms0SHJTDzbwLGCq2iW7z
TLSH
T187E2AE8B5BD04CA7C79431B121332653D37B9E300F757BA7E3948C790DAEA60E83599A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor defense_evasion discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral1/memory/572-29-0x0000000000F80000-0x0000000000F89000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral1/files/0x000d000000024420-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/572-5-0x0000000000F80000-0x0000000000F89000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/572-29-0x0000000000F80000-0x0000000000F89000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000d000000024420-4.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Executes dropped EXE 1 IoCs

pid	Process
572	ApKURhX.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	ApKURhX.exe
File opened for modification	C:\Program Files\CompressSplit.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	ApKURhX.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	ApKURhX.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2992	Process not Found
4828	Process not Found
3972	Process not Found
4012	Process not Found
1460	Process not Found
3372	Process not Found
4896	Process not Found
3752	Process not Found
1484	Process not Found
932	Process not Found
3164	Process not Found
980	Process not Found
1236	Process not Found
3184	Process not Found
732	Process not Found
3308	Process not Found
4564	Process not Found
3420	Process not Found
3892	Process not Found
4052	Process not Found
2308	sc.exe
1756	Process not Found
1872	Process not Found
3792	Process not Found
748	sc.exe
1120	Process not Found
3520	Process not Found
4704	sc.exe
4692	sc.exe
4336	Process not Found
5064	Process not Found
1756	Process not Found
2328	Process not Found
232	Process not Found
4092	Process not Found
4376	Process not Found
4144	Process not Found
3540	Process not Found
976	Process not Found
4824	Process not Found
1500	Process not Found
3372	Process not Found
3824	sc.exe
2416	Process not Found
3852	Process not Found
672	Process not Found
232	Process not Found
4316	Process not Found
4412	Process not Found
2064	sc.exe
4536	Process not Found
1880	Process not Found
3092	Process not Found
3720	Process not Found
1528	Process not Found
4896	sc.exe
3388	Process not Found
4280	Process not Found
4164	Process not Found
400	Process not Found
2452	Process not Found
1280	Process not Found
2260	Process not Found
1208	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3392	cmd.exe
2656	cmd.exe
1812	cmd.exe
4932	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
436	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 572	436	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	86
PID 436 wrote to memory of 3392	436	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	87
PID 436 wrote to memory of 2656	436	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	88
PID 436 wrote to memory of 1812	436	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	90
PID 2656 wrote to memory of 4828	2656	cmd.exe	92
PID 2656 wrote to memory of 2308	2656	cmd.exe	93
PID 2656 wrote to memory of 940	2656	cmd.exe	185
PID 2656 wrote to memory of 4796	2656	cmd.exe	186
PID 2656 wrote to memory of 2932	2656	cmd.exe	187
PID 2656 wrote to memory of 4996	2656	cmd.exe	188
PID 2656 wrote to memory of 4028	2656	cmd.exe	98
PID 2656 wrote to memory of 3824	2656	cmd.exe	99
PID 2656 wrote to memory of 3440	2656	cmd.exe	100
PID 2656 wrote to memory of 4696	2656	cmd.exe	191
PID 2656 wrote to memory of 3740	2656	cmd.exe	102
PID 2656 wrote to memory of 716	2656	cmd.exe	103
PID 2656 wrote to memory of 4200	2656	cmd.exe	104
PID 2656 wrote to memory of 2528	2656	cmd.exe	105
PID 2656 wrote to memory of 3988	2656	cmd.exe	196
PID 2656 wrote to memory of 4868	2656	cmd.exe	197
PID 2656 wrote to memory of 364	2656	cmd.exe	198
PID 2656 wrote to memory of 4392	2656	cmd.exe	199
PID 2656 wrote to memory of 1776	2656	cmd.exe	200
PID 2656 wrote to memory of 4560	2656	cmd.exe	201
PID 2656 wrote to memory of 4336	2656	cmd.exe	112
PID 2656 wrote to memory of 204	2656	cmd.exe	113
PID 2656 wrote to memory of 228	2656	cmd.exe	114
PID 2656 wrote to memory of 4632	2656	cmd.exe	115
PID 2656 wrote to memory of 4856	2656	cmd.exe	304
PID 2656 wrote to memory of 1732	2656	cmd.exe	305
PID 2656 wrote to memory of 1736	2656	cmd.exe	306
PID 2656 wrote to memory of 3508	2656	cmd.exe	119
PID 2656 wrote to memory of 3920	2656	cmd.exe	409
PID 2656 wrote to memory of 3796	2656	cmd.exe	121
PID 2656 wrote to memory of 3536	2656	cmd.exe	516
PID 2656 wrote to memory of 1872	2656	cmd.exe	517
PID 2656 wrote to memory of 756	2656	cmd.exe	518
PID 2656 wrote to memory of 2320	2656	cmd.exe	720
PID 2656 wrote to memory of 8	2656	cmd.exe	619
PID 2656 wrote to memory of 3276	2656	cmd.exe	621
PID 2656 wrote to memory of 1120	2656	cmd.exe	416
PID 2656 wrote to memory of 3636	2656	cmd.exe	417
PID 2656 wrote to memory of 3848	2656	cmd.exe	130
PID 2656 wrote to memory of 3768	2656	cmd.exe	726
PID 2656 wrote to memory of 2340	2656	cmd.exe	725
PID 2656 wrote to memory of 3480	2656	cmd.exe	727
PID 2656 wrote to memory of 4444	2656	cmd.exe	134
PID 2656 wrote to memory of 2716	2656	cmd.exe	827
PID 2656 wrote to memory of 5060	2656	cmd.exe	730
PID 2656 wrote to memory of 2328	2656	cmd.exe	532
PID 2656 wrote to memory of 4012	2656	cmd.exe	930
PID 2656 wrote to memory of 1464	2656	cmd.exe	832
PID 2656 wrote to memory of 4680	2656	cmd.exe	931
PID 2656 wrote to memory of 3240	2656	cmd.exe	638
PID 2656 wrote to memory of 1748	2656	cmd.exe	836
PID 2656 wrote to memory of 3812	2656	cmd.exe	935
PID 2656 wrote to memory of 3164	2656	cmd.exe	838
PID 2656 wrote to memory of 3540	2656	cmd.exe	743
PID 2656 wrote to memory of 4380	2656	cmd.exe	645
PID 2656 wrote to memory of 4672	2656	cmd.exe	646
PID 2656 wrote to memory of 4568	2656	cmd.exe	647
PID 2656 wrote to memory of 2504	2656	cmd.exe	746
PID 2656 wrote to memory of 3644	2656	cmd.exe	845
PID 2656 wrote to memory of 1720	2656	cmd.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\ApKURhX.exe
  C:\Users\Admin\AppData\Local\Temp\ApKURhX.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k "@echo off & for /l %x in (0, 0, 1) do (sc stop FairplayKD0 & sc stop FairplayKD & sc stop FairplayKD1 & sc stop FairplayKD2 & sc stop FairplayKD3 & sc stop FairplayKD4 & sc stop FairplayKD5 & sc stop FairplayKD6 & sc stop FairplayKD7 & sc stop FairplayKD8 & sc stop FairplayKD9 & sc stop FairplayKD10)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4028
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:8
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4836
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - Launches sc.exe
    PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:64
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:60
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - Launches sc.exe
    PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:64
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:820
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:8
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    - Launches sc.exe
    PID:4692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    - Launches sc.exe
    PID:3824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:980
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:60
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3588
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - Launches sc.exe
    PID:748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:648
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - Launches sc.exe
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:64
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:464
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:60
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    - Launches sc.exe
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k "@echo off & for /l %x in (0, 0, 1) do (del /q "C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys" & del /q "C:\ProgramData\MTA San Andreas All\Common\temp2\FairplayKD.sys" & del /q "C:\ProgramData\MTA San Andreas All\1.6\temp\FairplayKD.sys")"
  2⤵
  - Executes a command shell one-liner
  PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FVK2FCOF\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

23DA16D7.exe

Path C:\Users\Admin\AppData\Local\Temp\23DA16D7.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

5b103a38.bat

Path C:\Users\Admin\AppData\Local\Temp\5b103a38.bat
Size 189B
SHA256 af8e25932bea1980b5cb665c3ede6b15e8aafa3c5354bb288bb444a9be7ba0ec
MD5 58b1c3f483aef39f57cd68a1ec0ba643
SHA1 98a30db5a1b4516fe6bdbe008e46124aa4973843
SHA512 88547351a81a6201a7ec1d93bd002cd067518e2d8b88b41f095ea38ac2211bee65a4980bc1aa84140fdc3f1cfeb8229904764b9c43fb48a4da11a90615383b71
TLSH
T107C01221C2DACA9A1CD8502B16F5A2CEC0654C983F6A2F115B31845C719740EB9C7701
MD5 SHA1 SHA512 TLSH

Submit Download

ApKURhX.exe

Path C:\Users\Admin\AppData\Local\Temp\ApKURhX.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-0-0x0000000000720000-0x000000000072D000-memory.dmp

Download

memory/436-28-0x0000000000720000-0x000000000072D000-memory.dmp

Download

memory/572-5-0x0000000000F80000-0x0000000000F89000-memory.dmp

Download

memory/572-29-0x0000000000F80000-0x0000000000F89000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads