fccf6c69cbe378fc431fdd93f40ce868a3446ca764b1218bc824f63c01575348

Analysis

user interaction
yes
max time kernel
38s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Double Bomb.bat
Size 307B
Sample260930-r8kbksty9p
SHA256 fccf6c69cbe378fc431fdd93f40ce868a3446ca764b1218bc824f63c01575348
MD5 faed250fa6db792b78f4255b7f8221db
SHA1 d5f893e9b09e8e7176e8ff3d582ca1080ca0e0e1
SHA512 0fa404db0f11e19f17d9b084fd183662ed4f1360a57a76e2cb701699603612bf62078c62ce5f4a81829263fc9ca99d3b557e6fb94af331ab1a323209106f2e2b
TLSH
T1BEE0721A50D000029AFB2223AF0E1A84F3CEC0C3B0438A74300C43DAAF5ABCEC04BC93
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 5 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Double Bomb.bat	xcopy.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Double Bomb.bat	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Double Bomb.bat	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Double Bomb.bat	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Double Bomb.bat	xcopy.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4060	cmd.exe
8672	cmd.exe
10220	cmd.exe
13944	Process not Found
2136	cmd.exe
7124	cmd.exe
8356	cmd.exe
10192	cmd.exe
4644	cmd.exe
12560	cmd.exe
13608	cmd.exe
16772	cmd.exe
4672	cmd.exe
5176	cmd.exe
20476	Process not Found
13912	Process not Found
1744	cmd.exe
4784	cmd.exe
1488	cmd.exe
7436	cmd.exe
7036	cmd.exe
6756	cmd.exe
4032	cmd.exe
11388	cmd.exe
4952	cmd.exe
8520	cmd.exe
11516	cmd.exe
13708	cmd.exe
12376	cmd.exe
10796	cmd.exe
8168	cmd.exe
13108	cmd.exe
5780	cmd.exe
8772	cmd.exe
11300	cmd.exe
18420	cmd.exe
16856	cmd.exe
11536	Process not Found
19012	cmd.exe
9296	cmd.exe
17496	Process not Found
6688	cmd.exe
9052	cmd.exe
7608	cmd.exe
14108	cmd.exe
12428	cmd.exe
18252	cmd.exe
17000	cmd.exe
19416	cmd.exe
5772	cmd.exe
10728	cmd.exe
12348	cmd.exe
16760	cmd.exe
13704	cmd.exe
21476	Process not Found
1312	cmd.exe
13152	cmd.exe
16004	cmd.exe
18388	cmd.exe
17028	cmd.exe
20844	Process not Found
5048	Process not Found
20464	Process not Found
5364	cmd.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1204	4812	cmd.exe	81
PID 4812 wrote to memory of 2212	4812	cmd.exe	82
PID 4812 wrote to memory of 3728	4812	cmd.exe	83
PID 4812 wrote to memory of 4020	4812	cmd.exe	85
PID 4812 wrote to memory of 2044	4812	cmd.exe	86
PID 4812 wrote to memory of 3312	4812	cmd.exe	88
PID 3728 wrote to memory of 3320	3728	cmd.exe	207
PID 4812 wrote to memory of 3408	4812	cmd.exe	90
PID 4812 wrote to memory of 3556	4812	cmd.exe	92
PID 2044 wrote to memory of 2436	2044	cmd.exe	93
PID 4812 wrote to memory of 4016	4812	cmd.exe	94
PID 4812 wrote to memory of 1724	4812	cmd.exe	96
PID 3728 wrote to memory of 1120	3728	cmd.exe	97
PID 4812 wrote to memory of 4684	4812	cmd.exe	98
PID 4812 wrote to memory of 540	4812	cmd.exe	100
PID 3408 wrote to memory of 4492	3408	cmd.exe	229
PID 3728 wrote to memory of 484	3728	cmd.exe	102
PID 3728 wrote to memory of 4792	3728	cmd.exe	104
PID 4812 wrote to memory of 5112	4812	cmd.exe	105
PID 4812 wrote to memory of 3504	4812	cmd.exe	107
PID 4016 wrote to memory of 1196	4016	cmd.exe	108
PID 2044 wrote to memory of 3004	2044	cmd.exe	280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\xcopy.exe
  xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
  2⤵
  - Creates a file in the Startup directory
  PID:1204
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AA 10737418240
  2⤵
  PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    - Creates a file in the Startup directory
    PID:3320
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:484
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4172
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:3208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:3284
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:1836
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:7412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:10220
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:9084
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:11768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:13904
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:14436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:16760
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:17580
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:5160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5968
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8716
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:9896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:7324
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:12964
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:10412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:10796
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:10312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14124
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:14132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:15128
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:19156
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AE 10737418240
        5⤵
        
        PID:12528
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:5072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7008
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9240
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:13424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:9280
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:15380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:13036
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:3544
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:5172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7552
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11884
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:1708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8292
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11068
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:8300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9272
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:14088
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:16580
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:9856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11288
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:11296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7416
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AI 10737418240
      4⤵
      PID:14032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:13364
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AJ 10737418240
      4⤵
      PID:16692
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3096
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:780
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:3444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:4672
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:5404
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:6160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:6688
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:11100
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:15132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        6⤵
        Executes a command shell one-liner
        
        PID:18252
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        6⤵
        
        PID:19344
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:7888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:7920
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:11236
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:16288
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:10276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12608
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:12192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16340
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AE 10737418240
        5⤵
        
        PID:17636
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:4076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:4952
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:5976
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:8108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:9052
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:12132
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:7608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10868
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:12008
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:16072
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        6⤵
        
        PID:19132
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        6⤵
        
        PID:19140
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:9308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10768
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:8800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14712
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AE 10737418240
        5⤵
        
        PID:16264
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:2376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5456
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8500
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:8656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14728
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:14744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10344
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:19076
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:11448
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:5532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:4796
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:7116
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:9420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:11768
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:8680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:15016
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:13872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:18844
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:6172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:6756
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8492
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:8860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:11080
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:11088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12128
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:11572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12264
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:16492
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:7904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9228
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18956
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:10340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12640
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10832
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:14232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10332
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:488
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:2388
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6060
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3004
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9196
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:16500
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:3320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6584
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8368
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:7076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7560
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12628
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:5980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10064
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18992
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:10820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11096
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:14568
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:14660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12412
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:1564
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4036
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5344
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:6368
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:6208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:4644
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:11060
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:8664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:9392
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:7696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14932
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:10844
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:5384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5212
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8428
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:17516
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:6524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7060
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8552
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:19336
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:7300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8484
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10664
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:8980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:13876
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:11140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:15072
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:18656
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:9524
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:8600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8972
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8108
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:8980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8048
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10372
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:8368
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:5848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11348
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:11356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8428
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AI 10737418240
      4⤵
      PID:14632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17652
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AJ 10737418240
      4⤵
      PID:14800
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3400
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5176
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:4032
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12032
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:7272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8948
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:15592
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:5792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10752
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12388
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:10952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7184
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12224
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:10440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:15244
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:11192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:16868
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:18172
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2648
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5676
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:4460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:8672
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9428
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:7248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11304
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:13452
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:11312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14768
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:14776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14204
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:14632
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:400
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5816
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:7796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11504
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18548
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:11252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12540
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:16536
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AH 10737418240
    3⤵
    PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:2136
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5792
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:8388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:11516
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8820
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:11072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12048
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:13464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:18776
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:18784
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AI 10737418240
    3⤵
    PID:2460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:5936
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:6536
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:8408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10456
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18948
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:10464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10172
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9860
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:3220
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:8528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9192
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:7780
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AJ 10737418240
    3⤵
    PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:1632
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:12236
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:14628
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AK 10737418240
    3⤵
    PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6452
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8572
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:10896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9128
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:5636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8332
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:10916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:15848
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18612
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:8528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10512
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:14972
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AL 10737418240
    3⤵
    PID:8416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:10632
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AM 10737418240
    3⤵
    PID:8508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:10276
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AN 10737418240
    3⤵
    PID:13660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:17736
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AB 10737418240
  2⤵
  PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    - Creates a file in the Startup directory
    PID:2436
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1312
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4024
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5960
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9188
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:14224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:19416
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:4460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6036
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:7624
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:9452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10500
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:8860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:4516
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:17904
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:11500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:11500
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:16028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:18520
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:6788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5644
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:6100
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:7776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5492
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:16820
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:9592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7904
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18496
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:13564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:19012
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2564
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4544
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:3824
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:2908
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:6792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:8116
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:6900
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:11780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        6⤵
        
        PID:13456
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        7⤵
        
        PID:14544
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        6⤵
        
        PID:13464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        6⤵
        Executes a command shell one-liner
        
        PID:8168
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        6⤵
        
        PID:10832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        6⤵
        
        PID:16024
        
        C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        7⤵
        
        PID:1916
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        6⤵
        
        PID:10712
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:8124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:2468
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:14332
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:6268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:8056
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:5736
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:14760
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        6⤵
        
        PID:17320
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        6⤵
        
        PID:18044
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:6936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10588
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:8732
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:13060
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AE 10737418240
        5⤵
        
        PID:10596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12096
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AF 10737418240
        5⤵
        
        PID:12104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:13592
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AG 10737418240
        5⤵
        
        PID:13600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14848
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:15872
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AH 10737418240
        5⤵
        
        PID:14856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16560
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AI 10737418240
        5⤵
        
        PID:16568
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:5668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5824
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9384
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:17132
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:6428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6984
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8188
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:7920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9408
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10832
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:15236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:19116
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:19124
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:10444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12864
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:13188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17896
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:19408
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3376
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:2864
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5556
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:7316
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:13056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16520
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:17152
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:5760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5648
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9540
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:17492
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:6624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:7436
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10380
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:1508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16476
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:16756
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10024
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:17832
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:10172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10212
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:11000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:15656
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:15668
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2512
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4520
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5316
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:5636
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:14292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16468
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:15560
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:6556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:7036
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10320
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:8072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9624
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8392
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:8832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11828
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12400
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:10312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16604
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:16612
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:9244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12352
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:17052
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:4912
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:2388
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:6268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:1952
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12172
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:6832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8160
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:13584
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:8036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:4048
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:17444
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:9668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8512
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:9888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10444
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:10200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11796
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:10512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17284
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:17292
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:4924
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:6516
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:10304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:12428
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:8820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11596
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:17976
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:5324
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:9212
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:11236
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AH 10737418240
    3⤵
    PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6284
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8228
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:11748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14736
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:14752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:15784
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:18540
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AI 10737418240
    3⤵
    PID:7848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8652
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:14148
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AJ 10737418240
    3⤵
    PID:10184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:12544
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AK 10737418240
    3⤵
    PID:14080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:18164
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AL 10737418240
    3⤵
    PID:4832
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AC 10737418240
  2⤵
  PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    - Creates a file in the Startup directory
    PID:4492
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2920
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:1204
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5676
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10928
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:7768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7676
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12216
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:9128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12436
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:12080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:1508
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:16552
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2396
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5168
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5128
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10124
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:17960
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:6780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:4628
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:5792
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:8956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:7608
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:11024
      - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        6⤵
        
        PID:15180
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:10964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:13708
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:13716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10304
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:13188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:19212
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AE 10737418240
        5⤵
        
        PID:19220
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:7544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7988
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11196
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:13852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:19004
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:9452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10392
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18980
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:10400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11900
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:11908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:13440
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:13448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7696
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:12024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14696
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AI 10737418240
      4⤵
      PID:9312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17892
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AJ 10737418240
      4⤵
      PID:9324
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:4500
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4076
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:2864
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8188
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:7412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:15632
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:11524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:18420
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:15500
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:5704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6724
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12228
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:16788
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:5184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8468
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11544
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:9064
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:8476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:9296
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:9176
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:9308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:8772
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:10324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12160
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:10684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14408
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:11412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17820
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AI 10737418240
      4⤵
      PID:17660
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3600
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5988
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:8108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11856
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:12024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9196
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:9612
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:4492
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:6300
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:7488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:8356
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:1836
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:13700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        Executes a command shell one-liner
        
        PID:13704
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:15144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:19228
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:19236
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:8364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7984
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:16972
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:7272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10784
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:16412
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:10792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12112
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:12120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:14108
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:14116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:16004
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:16012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:18852
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AH 10737418240
      4⤵
      PID:18860
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:5620
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:9948
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:15972
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:6340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:7084
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:11040
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:13072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:13684
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:13692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:13108
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:11196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:18388
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:18396
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AH 10737418240
    3⤵
    PID:7100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:7568
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:11272
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:15124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17452
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:17476
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AI 10737418240
    3⤵
    PID:7984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8940
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:14504
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AJ 10737418240
    3⤵
    PID:7252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:10860
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:16780
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AK 10737418240
    3⤵
    PID:7896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8780
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AL 10737418240
    3⤵
    PID:6152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:9212
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AM 10737418240
    3⤵
    PID:11540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:10284
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AN 10737418240
    3⤵
    PID:9544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:13632
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:19060
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AO 10737418240
    3⤵
    PID:10092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:12188
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AP 10737418240
    3⤵
    PID:11820
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AD 10737418240
  2⤵
  PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:1196
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:4940
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:3320
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:5780
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8028
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:14084
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:6596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7200
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12776
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:7788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7368
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:14508
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:6100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11552
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:11676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12908
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:8860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:3956
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:17188
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3360
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4588
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6776
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:7804
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:12552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:15212
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:15508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14236
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:17468
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:7808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7684
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10844
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:13468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:16232
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:6208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12456
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:13864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17728
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4060
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5408
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:6536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:11388
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:9612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9504
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:17064
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:5572
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8508
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:12164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:13608
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:14608
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:18728
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:12124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17604
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:5768
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8748
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:12188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:11300
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11452
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:11328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14884
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:15228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17532
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:17540
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:6796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3320
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:7272
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:15392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10852
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:17988
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:7364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:7268
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:15940
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AH 10737418240
    3⤵
    PID:9796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:11704
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AI 10737418240
    3⤵
    PID:12568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:13860
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8528
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AJ 10737418240
    3⤵
    PID:18216
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AE 10737418240
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:4684
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:3824
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1744
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4628
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:5512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5836
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8256
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:16236
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:6020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6824
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:5408
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:11796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:14576
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:14584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:18128
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:18136
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:6972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8836
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11868
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:17156
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:8844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:10728
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:12148
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:17968
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:10736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:13096
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:16052
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:13104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:16092
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:16100
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4784
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:1644
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:6452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:7120
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:8236
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:5240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12240
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:12552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:17396
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:15176
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:8084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9460
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:17428
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:10496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:13152
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:13644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17072
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:17080
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:4456
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5912
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:8100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9028
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:10712
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:15948
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:8740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:10192
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:18228
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:10200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:11468
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:9504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12236
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:9192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14888
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AF 10737418240
      4⤵
      PID:12332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:17588
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AG 10737418240
      4⤵
      PID:17596
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:1592
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:4520
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:7060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:6952
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:1836
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:9076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:10260
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:18972
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AB 10737418240
        5⤵
        
        PID:10268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:11564
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AC 10737418240
        5⤵
        
        PID:11572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:13264
      - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        6⤵
        
        PID:10684
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AD 10737418240
        5⤵
        
        PID:13300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12928
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AE 10737418240
        5⤵
        
        PID:10684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
        5⤵
        
        PID:12580
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AF 10737418240
        5⤵
        
        PID:14660
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:7604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:5184
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:14024
    - - C:\Windows\system32\fsutil.exe
        
        fsutil file createNew AA 10737418240
        5⤵
        
        PID:13676
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:9976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8080
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:11772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:16772
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:18240
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:3364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:5564
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:7332
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:4824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:9936
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:17436
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:8900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10996
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:9572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:14992
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:15800
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:15000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:17000
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AE 10737418240
      4⤵
      PID:17008
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:3364
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:9204
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:14864
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2388
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8728
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:9340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:15188
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:15500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:19360
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AH 10737418240
    3⤵
    PID:7248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:9104
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:13952
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AI 10737418240
    3⤵
    PID:9568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:12180
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AJ 10737418240
    3⤵
    PID:10540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6208
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AK 10737418240
    3⤵
    PID:16528
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AF 10737418240
  2⤵
  PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:5112
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:2188
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:1176
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:5588
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:8912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:10296
    - - C:\Windows\system32\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
        5⤵
        
        PID:11092
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:10308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:12200
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AC 10737418240
      4⤵
      PID:12496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:8560
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AD 10737418240
      4⤵
      PID:13520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:18708
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:2416
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:7416
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:16356
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6564
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:12852
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6164
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:8436
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:16312
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:8456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:9708
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:16596
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:9716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8416
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:10256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12348
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AH 10737418240
    3⤵
    PID:14064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:15508
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AI 10737418240
    3⤵
    PID:16244
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AG 10737418240
  2⤵
  PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:4696
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:4924
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5176
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:9084
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:10712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      Executes a command shell one-liner
      PID:16856
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:17744
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7124
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:11812
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8644
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:14944
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:8632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8000
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:13944
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:16360
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:11332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12376
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:14044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:17028
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:18536
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AH 10737418240
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:3984
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:5184
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:6292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:828
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:10344
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:12848
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:8044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:9364
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:15928
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:10416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    - Executes a command shell one-liner
    PID:12560
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:14072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:16804
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:17712
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AI 10737418240
  2⤵
  PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:3296
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:5044
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6248
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:9928
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6700
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:12056
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:11104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
      4⤵
      PID:13564
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AB 10737418240
      4⤵
      PID:12568
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:7304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8156
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:11412
  - - C:\Windows\system32\fsutil.exe
      fsutil file createNew AA 10737418240
      4⤵
      PID:16224
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:9604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8576
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:11452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:13484
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:10924
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:11448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:10920
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AG 10737418240
    3⤵
    PID:16736
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AJ 10737418240
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Executes a command shell one-liner
  PID:1488
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:5296
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:6568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:6768
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:13012
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:8092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:9112
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:12056
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:9124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:10248
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:14016
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:10852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:8240
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:9336
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AE 10737418240
    3⤵
    PID:9064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:13552
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AF 10737418240
    3⤵
    PID:16244
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AK 10737418240
  2⤵
  PID:780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:4564
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:6604
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:10424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:11032
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:7788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:14492
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AC 10737418240
    3⤵
    PID:14500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:15692
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AD 10737418240
    3⤵
    PID:15708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:14780
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AL 10737418240
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:7324
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:12784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:16108
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:14484
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AM 10737418240
  2⤵
  PID:5644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:4600
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:17136
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AN 10737418240
  2⤵
  PID:6188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:6772
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:10852
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AO 10737418240
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:7700
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:11064
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AP 10737418240
  2⤵
  PID:7708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  - Executes a command shell one-liner
  PID:8520
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:11612
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AA 10737418240
    3⤵
    PID:14392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
    3⤵
    PID:12416
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
      4⤵
      PID:18624
- - C:\Windows\system32\fsutil.exe
    fsutil file createNew AB 10737418240
    3⤵
    PID:12012
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AQ 10737418240
  2⤵
  PID:8528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:9556
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" /Y
    3⤵
    PID:18964
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AR 10737418240
  2⤵
  PID:9576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:11256
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AS 10737418240
  2⤵
  PID:10212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:6900
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AT 10737418240
  2⤵
  PID:11440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:13656
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AU 10737418240
  2⤵
  PID:10572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:4376
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AV 10737418240
  2⤵
  PID:13448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Double Bomb.bat"
  2⤵
  PID:17912
- C:\Windows\system32\fsutil.exe
  fsutil file createNew AW 10737418240
  2⤵
  PID:17920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Double Bomb.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Double Bomb.bat
Size 307B
SHA256 fccf6c69cbe378fc431fdd93f40ce868a3446ca764b1218bc824f63c01575348
MD5 faed250fa6db792b78f4255b7f8221db
SHA1 d5f893e9b09e8e7176e8ff3d582ca1080ca0e0e1
SHA512 0fa404db0f11e19f17d9b084fd183662ed4f1360a57a76e2cb701699603612bf62078c62ce5f4a81829263fc9ca99d3b557e6fb94af331ab1a323209106f2e2b
TLSH
T1BEE0721A50D000029AFB2223AF0E1A84F3CEC0C3B0438A74300C43DAAF5ABCEC04BC93
MD5 SHA1 SHA512 TLSH

Submit Download

memory/16528-526-0x00007FFFB7D80000-0x00007FFFB7F89000-memory.dmp

Download

memory/21376-525-0x00007FF7957E0000-0x00007FF79584C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads