5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
Size

69KB
MD5

540125e84c96beae4f4508555d81a940
SHA1

206da5a201a1c1523178391d6f433e48e99dc747
SHA256

5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f
SHA512

1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082
SSDEEP

1536:vyqrQrFUH+HtWXiaAkc//////4KCwo0icTpXbPLqA89hAILaqN:xqOHjyAc//////jCwo0icTt/q7iqN

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4940	capisp.exe
1132	capisp.exe
32	capisp.exe
1852	capisp.exe
4264	capisp.exe
4644	capisp.exe
3816	capisp.exe
1188	capisp.exe
1440	capisp.exe
1576	capisp.exe
1960	capisp.exe
2272	capisp.exe
4952	capisp.exe
4664	capisp.exe
2288	capisp.exe
1860	capisp.exe
3092	capisp.exe
1296	capisp.exe
4232	capisp.exe
1468	capisp.exe
1628	capisp.exe
2396	capisp.exe
4616	capisp.exe
1680	capisp.exe
4880	capisp.exe
3208	capisp.exe
2716	capisp.exe
308	capisp.exe
3612	capisp.exe
3636	capisp.exe
3404	capisp.exe
1300	capisp.exe
2360	capisp.exe
2772	capisp.exe
1744	capisp.exe
2968	capisp.exe
1468	capisp.exe
1788	capisp.exe
4436	capisp.exe
3748	capisp.exe
3776	capisp.exe
2168	capisp.exe
2932	capisp.exe
3236	capisp.exe
4368	capisp.exe
4684	capisp.exe
4244	capisp.exe
3044	capisp.exe
3552	capisp.exe
1968	capisp.exe
1356	capisp.exe
2392	capisp.exe
4860	capisp.exe
3816	capisp.exe
1188	capisp.exe
2136	capisp.exe
1788	capisp.exe
4436	capisp.exe
3748	capisp.exe
3776	capisp.exe
2060	capisp.exe
4968	capisp.exe
3436	capisp.exe
4472	capisp.exe

Modifies Installed Components in the registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\capisp.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}	reg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\capisp.exe	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\c_l4962.nls	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_deleteme.bat	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe
File created	C:\Windows\SysWOW64\_Setup.bat	capisp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
4940	capisp.exe
4940	capisp.exe
1132	capisp.exe
1132	capisp.exe
32	capisp.exe
32	capisp.exe
1852	capisp.exe
1852	capisp.exe
4264	capisp.exe
4264	capisp.exe
4644	capisp.exe
4644	capisp.exe
3816	capisp.exe
3816	capisp.exe
1188	capisp.exe
1188	capisp.exe
1440	capisp.exe
1440	capisp.exe
1576	capisp.exe
1576	capisp.exe
1960	capisp.exe
1960	capisp.exe
2272	capisp.exe
2272	capisp.exe
4952	capisp.exe
4952	capisp.exe
4664	capisp.exe
4664	capisp.exe
2288	capisp.exe
2288	capisp.exe
1860	capisp.exe
1860	capisp.exe
3092	capisp.exe
3092	capisp.exe
1296	capisp.exe
1296	capisp.exe
4232	capisp.exe
4232	capisp.exe
1468	capisp.exe
1468	capisp.exe
1628	capisp.exe
1628	capisp.exe
2396	capisp.exe
2396	capisp.exe
4616	capisp.exe
4616	capisp.exe
1680	capisp.exe
1680	capisp.exe
4880	capisp.exe
4880	capisp.exe
3208	capisp.exe
3208	capisp.exe
2716	capisp.exe
2716	capisp.exe
308	capisp.exe
308	capisp.exe
3612	capisp.exe
3612	capisp.exe
3636	capisp.exe
3636	capisp.exe
3404	capisp.exe
3404	capisp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1236	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	79
PID 4584 wrote to memory of 1236	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	79
PID 4584 wrote to memory of 1236	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	79
PID 1236 wrote to memory of 2148	1236	cmd.exe	81
PID 1236 wrote to memory of 2148	1236	cmd.exe	81
PID 1236 wrote to memory of 2148	1236	cmd.exe	81
PID 1236 wrote to memory of 1596	1236	cmd.exe	82
PID 1236 wrote to memory of 1596	1236	cmd.exe	82
PID 1236 wrote to memory of 1596	1236	cmd.exe	82
PID 4584 wrote to memory of 4968	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	83
PID 4584 wrote to memory of 4968	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	83
PID 4584 wrote to memory of 4968	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	83
PID 4584 wrote to memory of 4940	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	85
PID 4584 wrote to memory of 4940	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	85
PID 4584 wrote to memory of 4940	4584	5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe	85
PID 4940 wrote to memory of 4848	4940	capisp.exe	86
PID 4940 wrote to memory of 4848	4940	capisp.exe	86
PID 4940 wrote to memory of 4848	4940	capisp.exe	86
PID 4848 wrote to memory of 4520	4848	cmd.exe	88
PID 4848 wrote to memory of 4520	4848	cmd.exe	88
PID 4848 wrote to memory of 4520	4848	cmd.exe	88
PID 4848 wrote to memory of 2764	4848	cmd.exe	89
PID 4848 wrote to memory of 2764	4848	cmd.exe	89
PID 4848 wrote to memory of 2764	4848	cmd.exe	89
PID 4940 wrote to memory of 1132	4940	capisp.exe	90
PID 4940 wrote to memory of 1132	4940	capisp.exe	90
PID 4940 wrote to memory of 1132	4940	capisp.exe	90
PID 1132 wrote to memory of 5052	1132	capisp.exe	91
PID 1132 wrote to memory of 5052	1132	capisp.exe	91
PID 1132 wrote to memory of 5052	1132	capisp.exe	91
PID 5052 wrote to memory of 4188	5052	cmd.exe	93
PID 5052 wrote to memory of 4188	5052	cmd.exe	93
PID 5052 wrote to memory of 4188	5052	cmd.exe	93
PID 5052 wrote to memory of 4812	5052	cmd.exe	94
PID 5052 wrote to memory of 4812	5052	cmd.exe	94
PID 5052 wrote to memory of 4812	5052	cmd.exe	94
PID 1132 wrote to memory of 32	1132	capisp.exe	97
PID 1132 wrote to memory of 32	1132	capisp.exe	97
PID 1132 wrote to memory of 32	1132	capisp.exe	97
PID 32 wrote to memory of 4384	32	capisp.exe	98
PID 32 wrote to memory of 4384	32	capisp.exe	98
PID 32 wrote to memory of 4384	32	capisp.exe	98
PID 4384 wrote to memory of 3984	4384	cmd.exe	100
PID 4384 wrote to memory of 3984	4384	cmd.exe	100
PID 4384 wrote to memory of 3984	4384	cmd.exe	100
PID 4384 wrote to memory of 4056	4384	cmd.exe	101
PID 4384 wrote to memory of 4056	4384	cmd.exe	101
PID 4384 wrote to memory of 4056	4384	cmd.exe	101
PID 32 wrote to memory of 1852	32	capisp.exe	103
PID 32 wrote to memory of 1852	32	capisp.exe	103
PID 32 wrote to memory of 1852	32	capisp.exe	103
PID 1852 wrote to memory of 3484	1852	capisp.exe	104
PID 1852 wrote to memory of 3484	1852	capisp.exe	104
PID 1852 wrote to memory of 3484	1852	capisp.exe	104
PID 3484 wrote to memory of 1784	3484	cmd.exe	107
PID 3484 wrote to memory of 1784	3484	cmd.exe	107
PID 3484 wrote to memory of 1784	3484	cmd.exe	107
PID 3484 wrote to memory of 1848	3484	cmd.exe	108
PID 3484 wrote to memory of 1848	3484	cmd.exe	108
PID 3484 wrote to memory of 1848	3484	cmd.exe	108
PID 1852 wrote to memory of 4264	1852	capisp.exe	109
PID 1852 wrote to memory of 4264	1852	capisp.exe	109
PID 1852 wrote to memory of 4264	1852	capisp.exe	109
PID 4264 wrote to memory of 1748	4264	capisp.exe	110

C:\Users\Admin\AppData\Local\Temp\5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe
"C:\Users\Admin\AppData\Local\Temp\5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
    3⤵
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\_deleteme.bat
  2⤵
  PID:4968
- C:\Windows\SysWOW64\capisp.exe
  C:\Windows\system32\capisp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
      4⤵
      PID:4520
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
      4⤵
      PID:2764
- - C:\Windows\SysWOW64\capisp.exe
    C:\Windows\system32\capisp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5052
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        5⤵
        Modifies Installed Components in the registry
        
        PID:4188
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        5⤵
        
        PID:4812
  - - C:\Windows\SysWOW64\capisp.exe
      C:\Windows\system32\capisp.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:32
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        6⤵
        Modifies Installed Components in the registry
        
        PID:3984
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        6⤵
        
        PID:4056
    - - C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        7⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        7⤵
        
        PID:1848
      - C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        8⤵
        Modifies Installed Components in the registry
        
        PID:4844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        8⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        8⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        9⤵
        Modifies Installed Components in the registry
        
        PID:1356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        9⤵
        
        PID:392
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        9⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        10⤵
        Modifies Installed Components in the registry
        
        PID:1632
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        10⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        10⤵
        
        PID:980
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        11⤵
        
        PID:640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        11⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        11⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        12⤵
        Modifies Installed Components in the registry
        
        PID:2396
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        12⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        12⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        13⤵
        Modifies Installed Components in the registry
        
        PID:4084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        13⤵
        
        PID:956
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        13⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        14⤵
        Modifies Installed Components in the registry
        
        PID:3776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        14⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        14⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        15⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        15⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        15⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        16⤵
        Modifies Installed Components in the registry
        
        PID:4904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        16⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        16⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        17⤵
        Modifies Installed Components in the registry
        
        PID:4120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        17⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        17⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        18⤵
        
        PID:760
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        18⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        18⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        19⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        19⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        19⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        20⤵
        Modifies Installed Components in the registry
        
        PID:3256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        20⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        20⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        21⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        21⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        21⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        22⤵
        Modifies Installed Components in the registry
        
        PID:1304
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        22⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        22⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        23⤵
        Modifies Installed Components in the registry
        
        PID:2028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        23⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        23⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        24⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        24⤵
        
        PID:424
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        24⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        25⤵
        Modifies Installed Components in the registry
        
        PID:3100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        25⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        25⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        26⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        26⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        25⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        26⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        27⤵
        Modifies Installed Components in the registry
        
        PID:3516
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        27⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        27⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        28⤵
        Modifies Installed Components in the registry
        
        PID:4984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        28⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        28⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        29⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        29⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        29⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        30⤵
        Modifies Installed Components in the registry
        
        PID:3236
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        30⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        30⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        31⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        31⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        31⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        32⤵
        Modifies Installed Components in the registry
        
        PID:632
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        32⤵
        
        PID:808
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        32⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        33⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        33⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        33⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        34⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        34⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        34⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        35⤵
        Modifies Installed Components in the registry
        
        PID:4036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        35⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        35⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        36⤵
        Modifies Installed Components in the registry
        
        PID:1764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        36⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        36⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        37⤵
        Modifies Installed Components in the registry
        
        PID:4212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        37⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        37⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        38⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        38⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        37⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        38⤵
        
        PID:864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        39⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        39⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        38⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        39⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        40⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        40⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        40⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        41⤵
        Modifies Installed Components in the registry
        
        PID:4100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        41⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        41⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        42⤵
        Modifies Installed Components in the registry
        
        PID:4088
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        42⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        41⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        42⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        43⤵
        Modifies Installed Components in the registry
        
        PID:3176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        43⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        43⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        44⤵
        Modifies Installed Components in the registry
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        44⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        43⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        44⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        45⤵
        Modifies Installed Components in the registry
        
        PID:1196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        45⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        45⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        46⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        46⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        46⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        47⤵
        Modifies Installed Components in the registry
        
        PID:3164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        47⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        47⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        48⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        48⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        48⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        49⤵
        Modifies Installed Components in the registry
        
        PID:3848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        49⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        49⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        50⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        50⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        49⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        50⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        51⤵
        Modifies Installed Components in the registry
        
        PID:3080
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        51⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        50⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        51⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        52⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        52⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        52⤵
        
        PID:744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        53⤵
        
        PID:716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        53⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        52⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        53⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        54⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        54⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        53⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        54⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        55⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        55⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        54⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        55⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        56⤵
        Modifies Installed Components in the registry
        
        PID:1304
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        56⤵
        
        PID:640
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        55⤵
        Executes dropped EXE
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        56⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        57⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        57⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        57⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        58⤵
        Modifies Installed Components in the registry
        
        PID:4480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        58⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        57⤵
        Executes dropped EXE
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        58⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        59⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        59⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        58⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        59⤵
        
        PID:956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        60⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        60⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        59⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        60⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        61⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        61⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        61⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        62⤵
        Modifies Installed Components in the registry
        
        PID:1576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        62⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        62⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        63⤵
        Modifies Installed Components in the registry
        
        PID:4332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        63⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        62⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        63⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        64⤵
        Modifies Installed Components in the registry
        
        PID:2148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        64⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        63⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        64⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        65⤵
        Modifies Installed Components in the registry
        
        PID:100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        65⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        65⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        66⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        66⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        66⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        67⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        67⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        66⤵
        Drops file in System32 directory
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        67⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        68⤵
        Modifies Installed Components in the registry
        
        PID:3592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        68⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        67⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        68⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        69⤵
        Modifies Installed Components in the registry
        
        PID:1936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        69⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        68⤵
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        69⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        70⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        70⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        69⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        70⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        71⤵
        Modifies Installed Components in the registry
        
        PID:716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        71⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        70⤵
        Drops file in System32 directory
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        71⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        72⤵
        Modifies Installed Components in the registry
        
        PID:1984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        72⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        71⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        72⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        73⤵
        Modifies Installed Components in the registry
        
        PID:2092
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        73⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        72⤵
        Drops file in System32 directory
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        73⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        74⤵
        Modifies Installed Components in the registry
        
        PID:4292
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        74⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        73⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        74⤵
        
        PID:320
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        75⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        75⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        74⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        75⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        76⤵
        Modifies Installed Components in the registry
        
        PID:3816
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        76⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        75⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        76⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        77⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        77⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        76⤵
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        77⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        78⤵
        Modifies Installed Components in the registry
        
        PID:3828
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        78⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        77⤵
        Drops file in System32 directory
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        78⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        79⤵
        Modifies Installed Components in the registry
        
        PID:4588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        79⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        78⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        79⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        80⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        80⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        79⤵
        Drops file in System32 directory
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        80⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        81⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        81⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        80⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        81⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        82⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        82⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        81⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        82⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        83⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        83⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        82⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        83⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        84⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        84⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        83⤵
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        84⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        85⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        85⤵
        
        PID:968
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        84⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        85⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        86⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        86⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        85⤵
        Drops file in System32 directory
        
        PID:4692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        86⤵
        
        PID:480
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        87⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        87⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        86⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        87⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        88⤵
        Modifies Installed Components in the registry
        
        PID:316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        88⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        87⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        88⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        89⤵
        Modifies Installed Components in the registry
        
        PID:4036
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        89⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        88⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        89⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        90⤵
        Modifies Installed Components in the registry
        
        PID:1764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        90⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        89⤵
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        90⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        91⤵
        Modifies Installed Components in the registry
        
        PID:4040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        91⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        90⤵
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        91⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        92⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        92⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        91⤵
        Drops file in System32 directory
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        92⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        93⤵
        Modifies Installed Components in the registry
        
        PID:1652
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        93⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        92⤵
        Drops file in System32 directory
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        93⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        94⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        94⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        93⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        94⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        95⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        95⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        94⤵
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        95⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        96⤵
        Modifies Installed Components in the registry
        
        PID:1444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        96⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        95⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        96⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        97⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        97⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        96⤵
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        97⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        98⤵
        Modifies Installed Components in the registry
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        98⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        97⤵
        Drops file in System32 directory
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        98⤵
        
        PID:492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        99⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        99⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        98⤵
        Drops file in System32 directory
        
        PID:556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        99⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        100⤵
        Modifies Installed Components in the registry
        
        PID:3460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        100⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        99⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        100⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        101⤵
        Modifies Installed Components in the registry
        
        PID:4708
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        101⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        100⤵
        Drops file in System32 directory
        
        PID:4984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        101⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        102⤵
        Modifies Installed Components in the registry
        
        PID:4972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        102⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        101⤵
        Drops file in System32 directory
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        102⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        103⤵
        Modifies Installed Components in the registry
        
        PID:4496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        103⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        102⤵
        Drops file in System32 directory
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        103⤵
        
        PID:212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        104⤵
        Modifies Installed Components in the registry
        
        PID:4600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        104⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        103⤵
        Drops file in System32 directory
        
        PID:3756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        104⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        105⤵
        
        PID:228
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        105⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        104⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        105⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        106⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        106⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        105⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        106⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        107⤵
        
        PID:632
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        107⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        106⤵
        Drops file in System32 directory
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        107⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        108⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        108⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        107⤵
        Drops file in System32 directory
        
        PID:3676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        108⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        109⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        109⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        108⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        109⤵
        
        PID:520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        110⤵
        Modifies Installed Components in the registry
        
        PID:448
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        110⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        109⤵
        Drops file in System32 directory
        
        PID:3640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        110⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        111⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        111⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\capisp.exe
        
        C:\Windows\system32\capisp.exe
        110⤵
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\_Setup.bat
        111⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\capisp.exe /i" /f
        112⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{VSIZ223X-50H6-3RXJ-CP6E-TS2OC16AEP60}" /f
        112⤵
        
        PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
352B

MD5
f8d7e2c786fd1c34b7d389148bef3219

SHA1
d0c8fdd64bbe70a371bfe572c34bf080626f8aae

SHA256
50cf8e8c9f5153916c560bb41237d7c150d438a19eebebeb0f7a9072a0720851

SHA512
f3b25d231e8df1922cc12ea62ea3b28e5c86e0ad179815bfbc3924c4a3b14e9cb1e882156783ca9e5b2ccf441086b5737bfd42541b78e17b47412c6996ead0d3

Download Submit
C:\Windows\SysWOW64\_deleteme.bat

Filesize
248B

MD5
8ffbfd8f8ea38902d2d9314890593a98

SHA1
f0f7147c762b5a67f30dbe649df3b01eaefa435a

SHA256
8c1f5c353df8538bcee24b5701debe453b07db27974d13db875f94d6f16f42c9

SHA512
ac2a980bb9ea52b29277ec976a4ac8f03f08c557a6827d14929356ad721607148cdeacbbac098ce0d7d72c92211dcdae5fe18eaa2641db90bae60a443b567ad1

Download Submit
C:\Windows\SysWOW64\c_l4962.nls

Filesize
930B

MD5
568a2ade7830dc460649c69287b34257

SHA1
3edcfdf1ad3f1e2bb7ca0f8855b930401ba2addf

SHA256
c9661e7406932034f1540f9f40e349582e10a56f9fd2f43f76e4ebf324a406d7

SHA512
09c4297986551ea4fa9de8a44e61974372aacf25123a6f47ba720d14b19bf75099c93eb3558cf79cd9a054920db7d37451ceb705b77b5a96d12f00dfe04093e9

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit
C:\Windows\SysWOW64\capisp.exe

Filesize
69KB

MD5
540125e84c96beae4f4508555d81a940

SHA1
206da5a201a1c1523178391d6f433e48e99dc747

SHA256
5f33146174766292f9bcadb29a4d62ec82e161101bdc26287b97ce8237c9be1f

SHA512
1163816ae2c39128d2c08ae20fb7758b8b7b501e4c9dfcc7822ea58c417a0701d25f9c4592120223ed3283d17f616606634795120c592203f1a2fb354ef71082

Download Submit