bdaejec | 54343dd25ffe8d5e90bb89fdb52f8b7dc586eb643f2f18299fce8be12821a533

Analysis

max time kernel
36s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Size 31KB
Sample260814-brlv3sap21
SHA256 54343dd25ffe8d5e90bb89fdb52f8b7dc586eb643f2f18299fce8be12821a533
MD5 e9ad38269e5f173b25f79fb6c894a363
SHA1 c9d0bfbe45ecf8aaea33d73d046e311413c31dde
SHA512 20082166305faf32534b7f9d0a9b9409630849ee454138f7ddf18d0df7f477b0393aecd315e45bfb68a87f3ddf61cc434124dec5423572a439c652c6fd7fc1c2
SSDEEP 768:HwNHtRbdktms0SHJTDzbAGH7TyAQGPL4vzZq2o9W7GsxBbPr:MHtjktms0SHJTDzbwLGCq2iW7z
TLSH
T187E2AE8B5BD04CA7C79431B121332653D37B9E300F757BA7E3948C790DAEA60E83599A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor defense_evasion discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/4484-9-0x0000000000EA0000-0x0000000000EA9000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001b1e8-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4484-5-0x0000000000EA0000-0x0000000000EA9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4484-9-0x0000000000EA0000-0x0000000000EA9000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001b1e8-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4484	ApKURhX.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	ApKURhX.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	ApKURhX.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpCmdRun.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	ApKURhX.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	ApKURhX.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	ApKURhX.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	ApKURhX.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3508	Process not Found
5832	Process not Found
2988	Process not Found
3808	Process not Found
4360	Process not Found
1272	Process not Found
2968	Process not Found
4664	Process not Found
5936	sc.exe
4404	sc.exe
2992	Process not Found
1128	Process not Found
368	Process not Found
2168	Process not Found
1500	Process not Found
2000	Process not Found
2096	sc.exe
5868	Process not Found
5732	Process not Found
3916	Process not Found
1764	Process not Found
2384	Process not Found
2820	Process not Found
2388	Process not Found
3472	sc.exe
5288	sc.exe
4472	sc.exe
5784	Process not Found
3240	Process not Found
1904	Process not Found
3960	Process not Found
6080	sc.exe
1612	sc.exe
2260	Process not Found
4416	Process not Found
1320	Process not Found
1704	Process not Found
2816	Process not Found
728	sc.exe
2516	Process not Found
5472	Process not Found
3612	Process not Found
1336	Process not Found
3208	Process not Found
1572	Process not Found
3420	Process not Found
1360	sc.exe
6104	Process not Found
5568	Process not Found
1000	Process not Found
2420	Process not Found
3732	Process not Found
4092	Process not Found
4284	sc.exe
5280	sc.exe
4436	Process not Found
5752	Process not Found
4564	Process not Found
3884	Process not Found
4876	Process not Found
5972	Process not Found
5472	sc.exe
5392	Process not Found
1140	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1276	cmd.exe
3084	cmd.exe
1604	cmd.exe
1348	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3360	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4484	3360	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	90
PID 3360 wrote to memory of 1276	3360	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	91
PID 3360 wrote to memory of 3084	3360	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	92
PID 3360 wrote to memory of 1604	3360	2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe	94
PID 3084 wrote to memory of 1304	3084	cmd.exe	96
PID 3084 wrote to memory of 4632	3084	cmd.exe	97
PID 3084 wrote to memory of 732	3084	cmd.exe	98
PID 3084 wrote to memory of 1472	3084	cmd.exe	99
PID 3084 wrote to memory of 1652	3084	cmd.exe	100
PID 3084 wrote to memory of 2748	3084	cmd.exe	101
PID 3084 wrote to memory of 3364	3084	cmd.exe	102
PID 3084 wrote to memory of 2448	3084	cmd.exe	103
PID 3084 wrote to memory of 5476	3084	cmd.exe	104
PID 3084 wrote to memory of 4532	3084	cmd.exe	105
PID 3084 wrote to memory of 2712	3084	cmd.exe	106
PID 3084 wrote to memory of 5028	3084	cmd.exe	107
PID 3084 wrote to memory of 1148	3084	cmd.exe	108
PID 3084 wrote to memory of 3472	3084	cmd.exe	109
PID 3084 wrote to memory of 4640	3084	cmd.exe	110
PID 3084 wrote to memory of 3912	3084	cmd.exe	111
PID 3084 wrote to memory of 1572	3084	cmd.exe	112
PID 3084 wrote to memory of 4812	3084	cmd.exe	113
PID 3084 wrote to memory of 2592	3084	cmd.exe	114
PID 3084 wrote to memory of 4660	3084	cmd.exe	115
PID 3084 wrote to memory of 4084	3084	cmd.exe	116
PID 3084 wrote to memory of 5640	3084	cmd.exe	117
PID 3084 wrote to memory of 1128	3084	cmd.exe	118
PID 3084 wrote to memory of 6040	3084	cmd.exe	119
PID 3084 wrote to memory of 5988	3084	cmd.exe	370
PID 3084 wrote to memory of 6028	3084	cmd.exe	371
PID 3084 wrote to memory of 108	3084	cmd.exe	122
PID 3084 wrote to memory of 260	3084	cmd.exe	123
PID 3084 wrote to memory of 3884	3084	cmd.exe	124
PID 3084 wrote to memory of 2192	3084	cmd.exe	500
PID 3084 wrote to memory of 728	3084	cmd.exe	752
PID 3084 wrote to memory of 5568	3084	cmd.exe	629
PID 3084 wrote to memory of 2692	3084	cmd.exe	754
PID 3084 wrote to memory of 1116	3084	cmd.exe	631
PID 3084 wrote to memory of 708	3084	cmd.exe	632
PID 3084 wrote to memory of 3200	3084	cmd.exe	257
PID 3084 wrote to memory of 4796	3084	cmd.exe	758
PID 3084 wrote to memory of 2912	3084	cmd.exe	759
PID 3084 wrote to memory of 2512	3084	cmd.exe	134
PID 3084 wrote to memory of 5624	3084	cmd.exe	135
PID 3084 wrote to memory of 5908	3084	cmd.exe	637
PID 3084 wrote to memory of 1500	3084	cmd.exe	638
PID 3084 wrote to memory of 5080	3084	cmd.exe	764
PID 3084 wrote to memory of 632	3084	cmd.exe	767
PID 3084 wrote to memory of 2532	3084	cmd.exe	140
PID 3084 wrote to memory of 5648	3084	cmd.exe	141
PID 3084 wrote to memory of 4696	3084	cmd.exe	267
PID 3084 wrote to memory of 4772	3084	cmd.exe	268
PID 3084 wrote to memory of 5960	3084	cmd.exe	269
PID 3084 wrote to memory of 4728	3084	cmd.exe	519
PID 3084 wrote to memory of 3292	3084	cmd.exe	271
PID 3084 wrote to memory of 5936	3084	cmd.exe	521
PID 3084 wrote to memory of 1416	3084	cmd.exe	397
PID 3084 wrote to memory of 4404	3084	cmd.exe	149
PID 3084 wrote to memory of 2928	3084	cmd.exe	902
PID 3084 wrote to memory of 4208	3084	cmd.exe	775
PID 3084 wrote to memory of 3808	3084	cmd.exe	904
PID 3084 wrote to memory of 1732	3084	cmd.exe	527
PID 3084 wrote to memory of 6088	3084	cmd.exe	528
PID 3084 wrote to memory of 716	3084	cmd.exe	529

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e9ad38269e5f173b25f79fb6c894a363_elex_smoke-loader_wapomi.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\ApKURhX.exe
  C:\Users\Admin\AppData\Local\Temp\ApKURhX.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k "@echo off & for /l %x in (0, 0, 1) do (sc stop FairplayKD0 & sc stop FairplayKD & sc stop FairplayKD1 & sc stop FairplayKD2 & sc stop FairplayKD3 & sc stop FairplayKD4 & sc stop FairplayKD5 & sc stop FairplayKD6 & sc stop FairplayKD7 & sc stop FairplayKD8 & sc stop FairplayKD9 & sc stop FairplayKD10)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5476
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6028
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - Launches sc.exe
    PID:5936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - Launches sc.exe
    PID:4404
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    - Launches sc.exe
    PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:916
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:600
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:236
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:620
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:6016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5380
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:768
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1172
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:548
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - Launches sc.exe
    PID:2096
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:6108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:52
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - Launches sc.exe
    PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - Launches sc.exe
    PID:5288
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3772
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5476
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:6052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    - Launches sc.exe
    PID:6080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:600
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1200
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:52
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - Launches sc.exe
    PID:728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:620
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:684
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5780
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    - System Location Discovery: System Language Discovery
    PID:260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:620
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3252
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1172
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:3120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    - Launches sc.exe
    PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5532
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5528
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:732
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5060
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:368
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:204
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    - System Location Discovery: System Language Discovery
    PID:264
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:6052
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5512
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5224
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:564
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:4452
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:3120
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    - Launches sc.exe
    PID:5472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3176
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    - Launches sc.exe
    PID:1612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:5756
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:4716
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    - Launches sc.exe
    PID:4472
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD9
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD10
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD0
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD1
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD2
    3⤵
    PID:548
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD3
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD4
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD5
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD6
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD7
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\sc.exe
    sc stop FairplayKD8
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k "@echo off & for /l %x in (0, 0, 1) do (del /q "C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys" & del /q "C:\ProgramData\MTA San Andreas All\Common\temp2\FairplayKD.sys" & del /q "C:\ProgramData\MTA San Andreas All\1.6\temp\FairplayKD.sys")"
  2⤵
  - Executes a command shell one-liner
  PID:1604

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv HxubsUyJO0y69S71FRNdxQ.0.2
1⤵
PID:5280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

295e42f2.bat

Path C:\Users\Admin\AppData\Local\Temp\295e42f2.bat
Size 189B
SHA256 d6fa40f333ed9cf730d0746d149742a378c191d60e8d89338b04f0797667748a
MD5 e110f9ef310b340cc0d086940c49da2c
SHA1 a93417a08f11dea2546885edfff40d6ea7ec8d40
SHA512 8c96733829bea771fb6c0d4e837691dcfaafa473aa5f7b69cb631c6ef23599bc0f1832d8dbeb3a21f68879bb8212b2aa4b14a29d43ffc5354fe13ecab31decd7
TLSH
T14FC01221C19ACA991CD8501B0AE1A2CDC0654CA83FAA3B216B31D45C719741EBAC7741
MD5 SHA1 SHA512 TLSH

Submit Download

ApKURhX.exe

Path C:\Users\Admin\AppData\Local\Temp\ApKURhX.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-0-0x0000000000F60000-0x0000000000F6D000-memory.dmp

Download

memory/3360-8-0x0000000000F60000-0x0000000000F6D000-memory.dmp

Download

memory/4484-5-0x0000000000EA0000-0x0000000000EA9000-memory.dmp

Download

memory/4484-9-0x0000000000EA0000-0x0000000000EA9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads