363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb

Analysis

max time kernel
89s
max time network
36s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bitcheats_cleaner.exe
Size

2.5MB
MD5

24999353450c234c36cc2e0a74f75051
SHA1

3b716b36775bc53bd67c0786ed040628cbc926f9
SHA256

363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb
SHA512

1c0dfac601da714ffc0a3dcd5f6b1fbe95c7238177cbf3ab9551b833f5a062c717ab69ff206a7c9dee677b52cec1cb81efd4e36dc6af5fc195ab07e4e453d143
SSDEEP

49152:rabHjq7IZiuzkKECE95eHmRSW97qWOEhSI7o1U26TYtkY+toY:rabOUiujECE95eGRB718zgY4

Score

9^/10

evasion execution persistence privilege_escalation spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

bitcheats_cleaner.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bitcheats_cleaner.exe
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1548 netsh.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bitcheats_cleaner.exe

pid	process
1548	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bitcheats_cleaner.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bitcheats_cleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bitcheats_cleaner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2240-0-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-2-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-4-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-3-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-6-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-5-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-1059-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida
behavioral1/memory/2240-1074-0x000000013F5B0000-0x000000013FCD4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bitcheats_cleaner.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bitcheats_cleaner.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

bitcheats_cleaner.exe

pid process

2240 bitcheats_cleaner.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bitcheats_cleaner.exe

Drops file in Windows directory 64 IoCs

Processes:

cmd.execmd.execmd.execmd.exe

description	ioc	process
File opened for modification	C:\Windows\INF\ESENT\0410\esentprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\netrass.inf	cmd.exe
File opened for modification	C:\Windows\INF\UGTHRSVC\0C0A\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~2\_dataperfcounters_shared12_neutral.h
File opened for modification	C:\Windows\INF\WSEARC~1\0411\idxcntrs.ini
File opened for modification	C:\Windows\INF\BITS\0411\bitsctrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~3.0\0411\_ServiceModelOperationPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0411\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\0409\msdtcprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~2\_dataperfcounters_shared12_neutral.ini	cmd.exe
File opened for modification	C:\Windows\INF\TERMSE~1\040C\tslabels.ini	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0411\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\en-US\netavpnt.inf_loc
File opened for modification	C:\Windows\INF\REMOTE~1\rasctrnm.h
File opened for modification	C:\Windows\INF\TAPISRV\0407\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\usbhub\0C0A\usbperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\0000\_DataPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~1.0\0407\_ServiceModelEndpointPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\0C0A\_DataPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\es-ES\netavpna.inf_loc	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0410\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.h	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\0000\_DataPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~1\0000\_DataOracleClientPerfCounters_shared12_neutral_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netnb.inf	cmd.exe
File opened for modification	C:\Windows\INF\WSEARC~1\0C0A\idxcntrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\040C\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~2\0410\_dataperfcounters_shared12_neutral_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\0410\tapiperf.ini
File opened for modification	C:\Windows\INF\NETCLR~2\0C0A\_Networkingperfcounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netavpna.inf	cmd.exe
File opened for modification	C:\Windows\INF\rspndr.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\0409\msdtcprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~1\0407\_DataOracleClientPerfCounters_shared12_neutral_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\0C0A\msdtcprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\REMOTE~1\rasctrnm.h	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\0407\_DataPerfCounters_D.ini
File opened for modification	C:\Windows\INF\SERVIC~1.0\040C\_ServiceModelEndpointPerfCounters_D.ini
File opened for modification	C:\Windows\INF\TAPISRV\0409\tapiperf.ini
File opened for modification	C:\Windows\INF\rdyboost\0407\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\0410\_DataPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~2\0407\_dataperfcounters_shared12_neutral_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\0411\msdtcprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\UGTHRSVC\040C\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0C0A\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0411\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~1.0\0407\_ServiceModelEndpointPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netmscli.inf	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0407\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\_DataPerfCounters.ini
File opened for modification	C:\Windows\INF\NETFRA~1\0000\corperfmonsymbols_D.ini
File opened for modification	C:\Windows\INF\UGTHRSVC\0411\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0000\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0410\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\usbhub\0411\usbperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\TERMSE~1\0409\tslabels.ini	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\0C0A\tapiperf.ini
File opened for modification	C:\Windows\INF\netpgm.inf	cmd.exe
File opened for modification	C:\Windows\INF\netbrdgm.inf
File opened for modification	C:\Windows\INF\UGATHE~1\040C\gsrvctr.ini
File opened for modification	C:\Windows\INF\UGATHE~1\0000\gsrvctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0409\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\0000\msdtcprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\netnwifi.inf	cmd.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

pid process

384
2572
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
384
2572

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exe

pid process

1696 ipconfig.exe
2032 ipconfig.exe
1036 ipconfig.exe
2444

pid	process
1696	ipconfig.exe
2032	ipconfig.exe
1036	ipconfig.exe
2444

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10890eacebcada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5A92371-36DE-11EF-AB41-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e412f987cacf24fa6ced2e15bdf3df8000000000200000000001066000000010000200000006deb3dcb6f5ac8c264cbea714fa9456f1f7f34fd099da5b7702854ce7ee1f759000000000e8000000002000020000000e65a208fdd5bba56294e6a069d9a53c1ab46ef6c473f76e847415ab6d7c622f820000000bc05812abfdaa7cba75f78c7948ca328a6d93a6e040d386e30baef3ba3e88653400000009afd3938b4964d45d7d2fbe3013695f2d5dedafd7238d5e9d178340d698fb2f098dd49782ac73becadc4359a520a8b84ff608a42a08e704f39d59851d49bc3cf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e412f987cacf24fa6ced2e15bdf3df8000000000200000000001066000000010000200000005957e21be5b097404ce9dca356ab4eb8a8ca76030f01869df418a477f3b4b311000000000e8000000002000020000000fd243bd3df75488d3a6f345842d82d5538f5527c3a79d86c5ae0c1b35c5371e4900000008c506a0db8eee8386d9a404f1db54bc89577c685490d1f4ffeb27147d0cf7bfa95ee8981a792e6b117675b4080760af21857759cf6bcfa1d18129f22e065326b5c68bacf2d66745ca3cad8a3291d77ee7971c2fe09623a80e48db284e3ac746b1e726377023b4f89462a38b396f2bd1c71ae82e90a60b4f1bb344c6affe456cac95de7938e13d8cffbe28f5a4af0409d400000006bb06f92684499974f0373c6d9fe1d7498c167d76f87a5d71578d4d0013fc8f469787286a97da0cc4e06f853f387adf3f53dd2a8a0f2b240a9e73e7bf908fd73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

pid process

936 reg.exe
2252 reg.exe
1580 reg.exe
1324 reg.exe
2236 reg.exe
2172 reg.exe
Runs net.exe

pid	process
936	reg.exe
2252	reg.exe
1580	reg.exe
1324	reg.exe
2236	reg.exe
2172	reg.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

bitcheats_cleaner.exe

pid	process
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe
2240	bitcheats_cleaner.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bitcheats_cleaner.exe

pid process

2240 bitcheats_cleaner.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3024 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3024 iexplore.exe
3024 iexplore.exe
2548 IEXPLORE.EXE
2548 IEXPLORE.EXE
2548 IEXPLORE.EXE
2548 IEXPLORE.EXE

pid	process
3024	iexplore.exe

pid	process
3024	iexplore.exe
3024	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bitcheats_cleaner.exeiexplore.exe

description	pid	process	target process
PID 2240 wrote to memory of 3024	2240	bitcheats_cleaner.exe	iexplore.exe
PID 2240 wrote to memory of 3024	2240	bitcheats_cleaner.exe	iexplore.exe
PID 2240 wrote to memory of 3024	2240	bitcheats_cleaner.exe	iexplore.exe
PID 2240 wrote to memory of 2520	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2520	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2520	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2620	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2620	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2620	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2800	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2800	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2800	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2028	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2028	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2028	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2624	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2624	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2624	2240	bitcheats_cleaner.exe	cmd.exe
PID 3024 wrote to memory of 2548	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2548	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2548	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2548	3024	iexplore.exe	IEXPLORE.EXE
PID 2240 wrote to memory of 2372	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2372	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2372	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2432	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2432	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2432	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2444	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2444	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2444	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2080	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2080	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2080	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2688	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2688	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2688	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2728	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2728	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2728	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2768	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2768	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2768	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2672	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2672	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2672	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2156	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2156	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2156	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1616	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1616	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1616	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1864	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1864	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1864	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 820	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 820	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 820	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1464	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1464	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 1464	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2152	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2152	2240	bitcheats_cleaner.exe	cmd.exe
PID 2240 wrote to memory of 2152	2240	bitcheats_cleaner.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2240

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://bitcheats.net/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\
2⤵
PID:2520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History\
2⤵
PID:2620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\
2⤵
PID:2800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\
2⤵
PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Temp\
2⤵
PID:2624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\
2⤵
PID:2372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Temp\
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
2⤵
PID:2444

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService_fn.exe
2⤵
PID:2080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe\gpa.bin
2⤵
PID:2688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451b49097cdafa85ec0f45214d6b0df9e8d.bin
2⤵
PID:2728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451e900a9bc20b57cd2f45214d6b0df9e8d.bin
2⤵
PID:2768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64\Version 2.1 AMD-APP (3380.6).Ellesmere.cache
2⤵
PID:2672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.idx
2⤵
PID:2156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.lock
2⤵
PID:1616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.val
2⤵
PID:1864

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\f_00010e
2⤵
PID:820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000036.log
2⤵
PID:1464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000038.ldb
2⤵
PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG.old
2⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_12856.log
2⤵
PID:2360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\171cac9.tmp
2⤵
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient\Manifest.ini
2⤵
PID:2348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor\Manifest.ini
2⤵
PID:1624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics\8E1D46DBC38F4A789939D781E1B91520
2⤵
PID:1380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor\Engine.ini
2⤵
PID:1724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs\CrashReportClient.log
2⤵
PID:2040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329\ClientSettings.Sav
2⤵
PID:2144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\ClientSettings.Sav
2⤵
PID:1520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8\CrashReportClient.ini
2⤵
PID:2412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
2⤵
PID:1916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
2⤵
PID:1276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteLauncher.log
2⤵
PID:2176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap\TempFileURLMappings.urlmap
2⤵
PID:2204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\DownloadCache.json
2⤵
PID:924

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\08B44835D9E8B3BEDFB49C3650F634FF11B74454.jpeg
2⤵
PID:2780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\1773DBBF630BAD44B34734176DD5D03F2E6F4D78.png
2⤵
PID:1732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\86F7F05520A581636CEBF3AD1BD5C4383AE77494.png
2⤵
PID:2280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\88271B0993D67835C1C89BF7D1B9A1E5ED989F06.jpg
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B666DE51F8E930A8A99CB03C4454727680759203.jpg
2⤵
PID:2508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B6D962B44AD39D2129B4A96DB8C24DFF6A98D213.jpeg
2⤵
PID:2760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\D04ECBD1A835D9714A6F6D279077C15B2FCEDBEF.jpeg
2⤵
PID:2372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\EA7CDAA7AF5B1335517D581803C34BB2394218D1.png
2⤵
PID:2956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\ED43DE88DA78F8F4D6645415A7FC446EAE3BD5B8.jpeg
2⤵
PID:1920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0bef34491af34fc584b687e433656e90
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0ef043433c754e0588525283cacda0ab
2⤵
PID:1504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\1492c7f2588940848a4920cdff4e69d7
2⤵
PID:584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\20334c6a270641c0835bed15d9cde4ea
2⤵
PID:1940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\3460cbe1c57d4a838ace32951a4d7171
2⤵
PID:1632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\6dea1559a81c4b18864782deeba57a83
2⤵
PID:488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\7e2a66ce68554814b1bd0aa14351cd71
2⤵
PID:1964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\8b616e78d2674a3e92157d40df1d4cda
2⤵
PID:328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\a22d837b6a2b46349421259c0a5411bf
2⤵
PID:804

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b4b8bebcb5e84d86b11ebb7bb989d88f
2⤵
PID:1440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b6c60402a72e4081a6a47c641371c19f
2⤵
PID:904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b800b911053c4906a5bd399f46ae0055
2⤵
PID:2112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\be84cc30e34142d293ed27d15522b62c
2⤵
PID:2568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c52c1f9246eb48ce9dade87be5a66f29
2⤵
PID:2620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c7dee411e20a44ab930f841e8d206b1b
2⤵
PID:2508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\f2f660d7855c45fdbb7922edda562a60
2⤵
PID:2376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\ManifestArchive.journal
2⤵
PID:2116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup\BuildIdentity.txt
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw\Full.ini
2⤵
PID:1880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw.manifest
2⤵
PID:1532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf
2⤵
PID:780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\CRASHREPORTCLIENT.EXE-C297728D.pf
2⤵
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-CF3441CE.pf
2⤵
PID:1464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-42C11B98.pf
2⤵
PID:2184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-5EAA410A.pf
2⤵
PID:2236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITELAUNCHER.EXE-AF00A2B5.pf
2⤵
PID:2248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\RUNDLL32.EXE-F264FACF.pf
2⤵
PID:2992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
2⤵
PID:1200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
2⤵
PID:1988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
2⤵
PID:3016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
2⤵
PID:1524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
2⤵
PID:328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
2⤵
PID:1928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
2⤵
PID:1160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\e4988bfc0f4c4c6596237473da200329.dat
2⤵
PID:1012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
2⤵
PID:2908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
2⤵
PID:1692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_0
2⤵
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_1
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_2
2⤵
PID:1844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_3
2⤵
PID:2644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\9f9fe5b8b6d30293_0
2⤵
PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\e7a03ae0f25a578a_0
2⤵
PID:2612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\index-dir\the-real-index
2⤵
PID:1592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG
2⤵
PID:2528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG.old
2⤵
PID:2396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
2⤵
PID:1908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\000003.log
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\LOG
2⤵
PID:2728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\LOG
2⤵
PID:2764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Network Persistent State
2⤵
PID:2104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager
2⤵
PID:2156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager-journal
2⤵
PID:2696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\000003.log
2⤵
PID:1884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\LOG
2⤵
PID:1568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\000003.log
2⤵
PID:2852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\TransportSecurity
2⤵
PID:1996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye
2⤵
PID:2188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport
2⤵
PID:1900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe
2⤵
PID:2996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache
2⤵
PID:2208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64
2⤵
PID:1504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84
2⤵
PID:788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK
2⤵
PID:1428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\
2⤵
PID:1448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved
2⤵
PID:1260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config
2⤵
PID:2816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient
2⤵
PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor
2⤵
PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common
2⤵
PID:976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics
2⤵
PID:1964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:972

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config
2⤵
PID:3068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor
2⤵
PID:2836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs
2⤵
PID:2912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame
2⤵
PID:1444

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
2⤵
PID:2280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329
2⤵
PID:2196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config
2⤵
PID:1664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
2⤵
PID:2464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8
2⤵
PID:2532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
2⤵
PID:2628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
2⤵
PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
2⤵
PID:784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
2⤵
PID:2508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
2⤵
PID:2516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp
2⤵
PID:2452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap
2⤵
PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS
2⤵
PID:2752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files
2⤵
PID:2404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS
2⤵
PID:2260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\CosmeticBundleSeparateCosmetics
2⤵
PID:2904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBR
2⤵
PID:1616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBROptional
2⤵
PID:1532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreative
2⤵
PID:1144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreativeOptional
2⤵
PID:3064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEnd
2⤵
PID:868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEndOptional
2⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCapture
2⤵
PID:1464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCaptureOptional
2⤵
PID:2176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.all
2⤵
PID:2024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.allOptional
2⤵
PID:2236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.de
2⤵
PID:604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.deOptional
2⤵
PID:336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419
2⤵
PID:2944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419Optional
2⤵
PID:412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ES
2⤵
PID:3028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ESOptional
2⤵
PID:2228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.fr
2⤵
PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.frOptional
2⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.it
2⤵
PID:1964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.itOptional
2⤵
PID:752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.pl
2⤵
PID:1888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.plOptional
2⤵
PID:2124

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ru
2⤵
PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ruOptional
2⤵
PID:2216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CN
2⤵
PID:2068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CNOptional
2⤵
PID:1604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup
2⤵
PID:2488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\StartupOptional
2⤵
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw
2⤵
PID:1844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles
2⤵
PID:2644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\CosmeticBundleSeparateCosmetics
2⤵
PID:1280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBR
2⤵
PID:2684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBROptional
2⤵
PID:2608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreative
2⤵
PID:2400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreativeOptional
2⤵
PID:2388

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEnd
2⤵
PID:2928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEndOptional
2⤵
PID:1596

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCapture
2⤵
PID:1800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCaptureOptional
2⤵
PID:2708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.all
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.allOptional
2⤵
PID:2260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.de
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.deOptional
2⤵
PID:2904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419
2⤵
PID:1616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419Optional
2⤵
PID:820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ES
2⤵
PID:1584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ESOptional
2⤵
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.fr
2⤵
PID:2888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.frOptional
2⤵
PID:2168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.it
2⤵
PID:1464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.itOptional
2⤵
PID:1636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.pl
2⤵
PID:2268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.plOptional
2⤵
PID:1416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ru
2⤵
PID:1964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ruOptional
2⤵
PID:656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CN
2⤵
PID:2920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CNOptional
2⤵
PID:2796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\StartupOptional
2⤵
PID:2608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
2⤵
PID:2508

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
3⤵
PID:2528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
2⤵
PID:2736

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
3⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
2⤵
PID:2744

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
3⤵
PID:1144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
2⤵
PID:2892

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
3⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.etl
2⤵
PID:2188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.log
2⤵
PID:2688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.temp
2⤵
PID:820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.dmp
2⤵
PID:1376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.chk
2⤵
PID:2744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bup
2⤵
PID:2748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bac
2⤵
PID:268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bak
2⤵
PID:2204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.old
2⤵
PID:788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:1504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
2⤵
PID:584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\a1acda587b3e4c7b87df4eb11fece3c0.dat
2⤵
PID:296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\a1acda587b3e4c7b87df4eb11fece3c0.dat
2⤵
PID:844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000067
2⤵
PID:3016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Intel\ShaderCache\EpicGamesLauncher_1
2⤵
PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
2⤵
PID:2004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
2⤵
PID:1752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.epicgames.com_0.localstorage
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases
2⤵
PID:1496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage
2⤵
PID:568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
2⤵
PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
2⤵
PID:1660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
2⤵
PID:1744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
2⤵
PID:656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
2⤵
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
2⤵
PID:2284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
2⤵
PID:1844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004d
2⤵
PID:2320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage
2⤵
PID:2800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004e
2⤵
PID:2504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004f
2⤵
PID:784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000050
2⤵
PID:3056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000051
2⤵
PID:2436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000052
2⤵
PID:1560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000053
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\
2⤵
PID:2724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\47343f26116f49d1a460ad740dc2bbbb\ClientSettings.Sav
2⤵
PID:2040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
2⤵
PID:2388

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye
2⤵
PID:2764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys
2⤵
PID:1200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\CommonFiles\BattlEye\BEDaisy.sys\
2⤵
PID:1868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat
2⤵
PID:824

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys
2⤵
PID:404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Engine\Programs\CrashReportClient\Config\DefaultEngine.ini
2⤵
PID:2960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\VaultCache
2⤵
PID:1256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32
2⤵
PID:1368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32\
2⤵
PID:1572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Base.ini
2⤵
PID:280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseGame.ini
2⤵
PID:156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseInput.ini
2⤵
PID:1532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\BaseWindowsLightmass.ini
2⤵
PID:2180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\WindowsGame.ini
2⤵
PID:1432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Portal\Config\UserLightmass.ini
2⤵
PID:2260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Engine\Config\BaseHardware.ini
2⤵
PID:2164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\NotForLicensees\Windows\WindowsHardware.ini
2⤵
PID:188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\UserScalability.ini
2⤵
PID:2184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\CMS
2⤵
PID:2600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\EMS
2⤵
PID:1036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Config\NoRedist\Windows\ShippableWindowsGameUserSettings.ini
2⤵
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\CurveEditorTools\AssetRegistry.bin
2⤵
PID:2204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CryptoKeys\AssetRegistry.bin
2⤵
PID:856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CurveEditorTools\AssetRegistry.bin
2⤵
PID:1504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local
2⤵
PID:1940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files
2⤵
PID:2268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files:VersionCache
2⤵
PID:3028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\SharedFiles:VersionCache
2⤵
PID:292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\XSettings.Sav
2⤵
PID:1524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:2828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS
2⤵
PID:1300

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Epic\EpicGamesLauncher\Data\EMS\stage
2⤵
PID:1640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
2⤵
PID:1740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\d945f059b8b54aa58202ed2989bebfc8
2⤵
PID:1224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config
2⤵
PID:1872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
2⤵
PID:2912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-AED3596C4ADFAC4DB9E422A6546810D3
2⤵
PID:1936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
2⤵
PID:2280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
2⤵
PID:272

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
2⤵
PID:2568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
2⤵
PID:2644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\
2⤵
PID:2704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame
2⤵
PID:2620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
2⤵
PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%Username%\AppData\Local\BattlEye
2⤵
PID:2608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\White.png
2⤵
PID:2372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:Program FilesEpic GamesFortniteFortniteGameBinariesWin64Shared Files
2⤵
PID:2452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Intermediate\Config\CoalescedSourceConfigs\PortalRegions.ini
2⤵
PID:2392

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-72CCB9004D132462217ECE948BC03CBE\CrashReportClient.ini
2⤵
PID:2752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-E3661BE544621B07B291448442161091\CrashReportClient.ini
2⤵
PID:2252

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
2⤵
PID:3044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
2⤵
PID:2552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Engine.ini
2⤵
PID:1648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
2⤵
PID:1528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
2⤵
PID:2076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
2⤵
PID:2256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
2⤵
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
2⤵
PID:2420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\PortalRegions.ini
2⤵
PID:3020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\65f6b08d488442e694b1e23d152d971e.dat
2⤵
PID:2720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\b371f0ee15b74eba84bd23830461130c.dat
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_65f6b08d488442e694b1e23d152d971e.dat
2⤵
PID:1652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_b371f0ee15b74eba84bd23830461130c.dat
2⤵
PID:1904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
2⤵
PID:1568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
2⤵
PID:864

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher_2.log
2⤵
PID:1376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_0
2⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_1
2⤵
PID:1696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_2
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_3
2⤵
PID:2584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
2⤵
PID:2732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000002
2⤵
PID:2360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000004
2⤵
PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000005
2⤵
PID:1260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000006
2⤵
PID:300

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000007
2⤵
PID:2872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000008
2⤵
PID:2944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000009
2⤵
PID:1632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000a
2⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000b
2⤵
PID:1416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000c
2⤵
PID:1752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000d
2⤵
PID:2780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000e
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000f
2⤵
PID:240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000010
2⤵
PID:380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000011
2⤵
PID:1440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000012
2⤵
PID:1556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000013
2⤵
PID:2144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000014
2⤵
PID:2832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000015
2⤵
PID:2560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000016
2⤵
PID:2812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000017
2⤵
PID:2464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000018
2⤵
PID:1280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000019
2⤵
PID:2684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001a
2⤵
PID:2504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001b
2⤵
PID:2500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001c
2⤵
PID:2408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001d
2⤵
PID:2928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001e
2⤵
PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001f
2⤵
PID:2412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000020
2⤵
PID:2924

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000021
2⤵
PID:904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000022
2⤵
PID:2760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000023
2⤵
PID:1648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000024
2⤵
PID:1528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000025
2⤵
PID:2076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000026
2⤵
PID:2256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000027
2⤵
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000028
2⤵
PID:2420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002b
2⤵
PID:3020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002c
2⤵
PID:2720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002d
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002e
2⤵
PID:1652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002f
2⤵
PID:1904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000030
2⤵
PID:1568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000031
2⤵
PID:864

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000032
2⤵
PID:1376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000033
2⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000034
2⤵
PID:1696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000035
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000036
2⤵
PID:2584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000037
2⤵
PID:2732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000038
2⤵
PID:2360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000039
2⤵
PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003a
2⤵
PID:1260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003b
2⤵
PID:300

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003c
2⤵
PID:2872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003d
2⤵
PID:2944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003e
2⤵
PID:1632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003f
2⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000040
2⤵
PID:1416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000041
2⤵
PID:1752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000042
2⤵
PID:2916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000043
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000044
2⤵
PID:240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000045
2⤵
PID:380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046
2⤵
PID:1440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\index
2⤵
PID:2836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies
2⤵
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies-journal
2⤵
PID:2832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db-journal
2⤵
PID:2812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_0
2⤵
PID:2464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_1
2⤵
PID:1280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_2
2⤵
PID:2684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_3
2⤵
PID:2504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\index
2⤵
PID:2500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\000003.log
2⤵
PID:2408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\CURRENT
2⤵
PID:2928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOCK
2⤵
PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG
2⤵
PID:2412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG.old
2⤵
PID:2924

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
2⤵
PID:904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage
2⤵
PID:2760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage-journal
2⤵
PID:1932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
2⤵
PID:2104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage-journal
2⤵
PID:2696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager
2⤵
PID:1612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager-journal
2⤵
PID:2776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\fe0c4ca0c0cbe875_0
2⤵
PID:1364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\index
2⤵
PID:2440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\index-dir\the-real-index
2⤵
PID:1516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\779a3f11-745c-419e-bb8b-5b6f2e7e0547\index
2⤵
PID:2544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\779a3f11-745c-419e-bb8b-5b6f2e7e0547\index-dir\the-real-index
2⤵
PID:1952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\4bbf414005652440_0
2⤵
PID:780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\index
2⤵
PID:320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\index-dir\the-real-index
2⤵
PID:2336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\0f02f0723dc027b2_0
2⤵
PID:2888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\8b79e197c1500c11_0
2⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\a8a9373a71443d80_0
2⤵
PID:2176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\a8a9373a71443d80_1
2⤵
PID:2384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\be52f68b51029c9d_0
2⤵
PID:2676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\eda4eea3ffd63d3b_0
2⤵
PID:1036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\eda4eea3ffd63d3b_1
2⤵
PID:2236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\index
2⤵
PID:1448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\index-dir\the-real-index
2⤵
PID:2816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\index.txt
2⤵
PID:296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\000003.log
2⤵
PID:1712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\CURRENT
2⤵
PID:3016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOCK
2⤵
PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG
2⤵
PID:712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG.old
2⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\MANIFEST-000001
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_0
2⤵
PID:1640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_0
2⤵
PID:3068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
2⤵
PID:2908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_0
2⤵
PID:1440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
2⤵
PID:1936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_0
2⤵
PID:2196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
2⤵
PID:1664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0
2⤵
PID:2716

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
2⤵
PID:2036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_0
2⤵
PID:2464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
2⤵
PID:2612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_0
2⤵
PID:2984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
2⤵
PID:784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\fa813c9ad67834ac_0
2⤵
PID:2396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index
2⤵
PID:2556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Visited Links
2⤵
PID:2724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\65f6b08d488442e694b1e23d152d971e\ClientSettings.Sav
2⤵
PID:2136

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-FA58D227408B75B949C1ECA1ABE0D4C7\CrashReportClient.ini
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
2⤵
PID:2692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\UnsavedReplay-2020.06.08-22.56.55.replay
2⤵
PID:2764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
2⤵
PID:1868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
2⤵
PID:1528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\CacheAccess.json
2⤵
PID:2428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:2256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:2420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\Public\Libraries\desktop.ini
2⤵
PID:3020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\ntuser.pol
2⤵
PID:2720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\Default\NTUSER.DAT
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:1652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\keyboard.pnf
2⤵
PID:1904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\netrasa.pnf
2⤵
PID:1568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\netavpna.pnf
2⤵
PID:2260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\keyboard.inf_loc
2⤵
PID:1376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\keyboard.inf_loc
2⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\keyboard.inf_loc
2⤵
PID:1696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\bthpan.inf_loc
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\bthpan.inf_loc
2⤵
PID:2584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\bthpan.inf_loc
2⤵
PID:612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\netvwifimp.inf_loc
2⤵
PID:2360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\netvwifimp.inf_loc
2⤵
PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\netvwifimp.inf_loc
2⤵
PID:1260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\b57nd60a.inf_loc
2⤵
PID:300

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\b57nd60a.inf_loc
2⤵
PID:976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\b57nd60a.inf_loc
2⤵
PID:2944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:1724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\Public\Libraries\desktop.ini
2⤵
PID:1752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\ntuser.pol
2⤵
PID:2916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\Default\NTUSER.DAT
2⤵
PID:2100

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:1160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:2836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Users\Public\Libraries\desktop.ini
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\ntuser.pol
2⤵
PID:2832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Users\Default\NTUSER.DAT
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:2812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:2056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:2604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:2932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Users\Public\Libraries\desktop.ini
2⤵
PID:2504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\ntuser.pol
2⤵
PID:2896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Users\Default\NTUSER.DAT
2⤵
PID:2408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:2928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
2⤵
PID:2588

C:\Windows\system32\reg.exe
reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
3⤵
- Modifies registry key
PID:2252

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
2⤵
PID:2508

C:\Windows\system32\reg.exe
reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
3⤵
- Modifies registry key
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\BEService /f
2⤵
PID:2388

C:\Windows\system32\reg.exe
reg delete HKLM\system\ControlSet001\Services\BEService /f
3⤵
- Modifies registry key
PID:1324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh winsock reset
2⤵
PID:2672

C:\Windows\system32\netsh.exe
netsh winsock reset
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh winsock reset catalog
2⤵
PID:1528

C:\Windows\system32\netsh.exe
netsh winsock reset catalog
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int ip reset
2⤵
PID:2884

C:\Windows\system32\netsh.exe
netsh int ip reset
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh advfirewall reset
2⤵
PID:1572

C:\Windows\system32\netsh.exe
netsh advfirewall reset
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int reset all
2⤵
PID:2188

C:\Windows\system32\netsh.exe
netsh int reset all
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int ipv4 reset
2⤵
PID:780

C:\Windows\system32\netsh.exe
netsh int ipv4 reset
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int ipv6 reset
2⤵
PID:2260

C:\Windows\system32\netsh.exe
netsh int ipv6 reset
3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
PID:2356

C:\Windows\system32\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:1696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
PID:2700

C:\Windows\system32\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /flushdns
2⤵
PID:2584

C:\Windows\system32\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:1036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\INF
2⤵
- Drops file in Windows directory
PID:2328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\Public\Documents
2⤵
PID:2872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
2⤵
PID:1420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:1632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:1964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\temp
2⤵
PID:1416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:1196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:1224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
2⤵
PID:1960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:2144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:2224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:2704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:1280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:2684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:2608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:1560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:2756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:2392

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:1732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:2724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Temp
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:2768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\Intel
2⤵
PID:2760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:2364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:1920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\INF
2⤵
PID:1588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:1320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\Public\Documents
2⤵
PID:2440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
2⤵
PID:1876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:1616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\temp
2⤵
PID:780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:2548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:2184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
2⤵
PID:612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:1636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:1940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:1988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:1524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:2828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:1740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:804

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Temp
2⤵
PID:1872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:1604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:2280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\Intel
2⤵
PID:2576

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:2568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:2644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:2484

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:2620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\INF
2⤵
PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:2436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\Public\Documents
2⤵
PID:2396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\Prefetch
2⤵
PID:2408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:2132

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\temp
2⤵
PID:2736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:2376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:2692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:1868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\Prefetch
2⤵
PID:2428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q E:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:2256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q E:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:1120

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:1572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:1652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:2544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:864

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:2272

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:2096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:2032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Temp
2⤵
PID:2732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:2360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\Intel
2⤵
PID:1260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:2872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:1492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\INF
2⤵
PID:924

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\Public\Documents
2⤵
PID:1756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\Prefetch
2⤵
PID:1196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:1640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:1452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\temp
2⤵
PID:1444

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:2300

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\Prefetch
2⤵
PID:1540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q F:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:2628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q F:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:2500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:2664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:1800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:3044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:1200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:1880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:1676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Temp
2⤵
PID:1056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:2104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:2364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\Intel
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:1920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:2668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Temp
2⤵
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s %systemdrive%\$Recycle.Bin >nul 2>&1
2⤵
PID:2904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s d:\$Recycle.Bin >nul 2>&1
2⤵
PID:1916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s e:\$Recycle.Bin >nul 2>&1
2⤵
PID:2448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s f:\$Recycle.Bin >nul 2>&1
2⤵
PID:1584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\servicing\InboxFodMetadataCache
2⤵
PID:2160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:2164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1424

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete
2⤵
PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\INF
2⤵
- Drops file in Windows directory
PID:1696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:2184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:2384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\temp
2⤵
PID:1636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Logs
2⤵
PID:584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:1420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:1724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\USOShared\Logs
2⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:2780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:2916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:1224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:1160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:2836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:1540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:2532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir / s / q %systemdrive%\Users\%username%\AppData\Local\Temp
2⤵
PID:2984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:2456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\INF
2⤵
- Drops file in Windows directory
PID:2500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\%username%\Microsoft\XboxLive
2⤵
PID:2664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\Public\Documents
2⤵
PID:288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:1800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:2404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:3044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\temp
2⤵
PID:1200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:1880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:1836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:2364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:1920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\XboxLive\*.*
2⤵
PID:2668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:1572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:1916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:2448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:1584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:2160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1424

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:1696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:2184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Temp
2⤵
PID:2384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IEDownloadHistory
2⤵
PID:1636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatUaCache
2⤵
PID:584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatCache
2⤵
PID:844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\DNTException
2⤵
PID:1028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE
2⤵
PID:1420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:1724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History\Low
2⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState
2⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0
2⤵
PID:2780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState
2⤵
PID:2916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3
2⤵
PID:2332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\Intel
2⤵
PID:1224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:2068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:1160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:2836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngine
2⤵
PID:2832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngineLauncher
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD
2⤵
PID:1540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\INTEL
2⤵
PID:632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\ntuser.ini
2⤵
PID:2532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache
2⤵
PID:3056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\system Volume Information\IndexerVolumeGuid
2⤵
PID:2120

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\CLR_v4.0
2⤵
PID:2756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\CLR_v3.0
2⤵
PID:2528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Internet Explorer\Recovery
2⤵
PID:1732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds
2⤵
PID:2736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Windows\system32\restore\MachineGuid.txt
2⤵
PID:2376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\ProgramData\Microsoft\Windows\WER
2⤵
PID:580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\Public\Libraries
2⤵
PID:2660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\MSOCache
2⤵
PID:2764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:2212

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache
2⤵
PID:2876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
2⤵
PID:2740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\ConnectedDevicesPlatform\L.%username%\ActivitiesCache.db-wal
2⤵
PID:2380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:2016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:2720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\USOShared\Logs\User
2⤵
PID:3020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:2168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp
2⤵
PID:2636

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\cache\qtshadercache
2⤵
PID:2544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\UsrClass.dat.log2
2⤵
PID:2180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\VkCache
2⤵
PID:2272

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\CN\NewsFeed
2⤵
PID:2156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE\RHKRUA8J
2⤵
PID:1996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs
2⤵
PID:1376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Temp
2⤵
PID:2476

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp
2⤵
PID:2616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:3024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
2⤵
PID:2536

C:\Windows\system32\reg.exe
reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
3⤵
- Modifies registry key
PID:2236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
2⤵
PID:2192

C:\Windows\system32\reg.exe
reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
3⤵
- Modifies registry key
PID:2172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\BEService /f
2⤵
PID:1260

C:\Windows\system32\reg.exe
reg delete HKLM\system\ControlSet001\Services\BEService /f
3⤵
- Modifies registry key
PID:936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:2228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\INF
2⤵
- Drops file in Windows directory
PID:976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:3016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\Public\Documents
2⤵
PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
2⤵
PID:752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:1984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\temp
2⤵
PID:568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:2100

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:1440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:272

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:1844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2444

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:1280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:2556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:2504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:2896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:1596

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:472

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Temp
2⤵
PID:2136

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:2040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:2552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\Intel
2⤵
PID:2424

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:1868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:2076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:1672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\INF
2⤵
PID:2652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:2220

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\Public\Documents
2⤵
PID:2776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
2⤵
PID:540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:2840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\temp
2⤵
PID:2188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:2880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:2888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:3032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:1884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:2580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:1036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-948125896-1532802483588045281-621968743-652831222-4568420121854825649459635381"
1⤵
PID:2360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-245633796-12330014591730806876-1427182733-1660245122206593186320165117851357846485"
1⤵
PID:1916

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-400891099203347282379966058219701305371937634786-2131145379-1445940338-745557124"
1⤵
PID:1620

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-8387260498040069591895169631-806625538-396881554-12670746731461475928-1203371145"
1⤵
PID:1380

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "16250899871594901097-1488373262-21368312221451696513-1369680739-726582640295236246"
1⤵
PID:924

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-231018054-6188751361106995022755491869-24147751168715731-1349823619-1013215229"
1⤵
PID:2116

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1021786781236106769-7394629211319992534171034728192821338899816093936037280"
1⤵
PID:2956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2028271366-1674842912-161609947-1945843117-1099513562057924921283802537706580362"
1⤵
PID:2204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-443001900-1244802243-13241675001017819191-889190176-2020455171246262202-732817938"
1⤵
PID:584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1086832521-1296317660905037486-1644986095-1642003243-379476559750140051-998742509"
1⤵
PID:1200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "187412590-17838641165798750479253780451137251160-1222853439-487119374-1370559416"
1⤵
PID:1988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20335966611436108726-12731964058313713116448230712559368341935478963-762618729"
1⤵
PID:1524

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2007021281796530817597639442-20402162651477791871-806312880831909162-126728453"
1⤵
PID:992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1284782077-187091010116944833774727163997699191074512602947054688791645659013"
1⤵
PID:328

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1436992054-97510668582384848-1814746196724652182-6671194862007999327-695586466"
1⤵
PID:1928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "68076835-803004444-10818083801533132103-2252169561794171410-987954607-1302763310"
1⤵
PID:2612

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-610334491169568058934275573-1594130069-1049612124-1531743442-14582694901987165124"
1⤵
PID:1592

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1129135188-7220761411215421354-1560678192-1394145362-676655291782254447212021607"
1⤵
PID:2528

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-176752488-1419753595395423038-2011226661-18279836612741249241166737884-1864954068"
1⤵
PID:2396

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1351895935637610113-1683535612-1337195988-1800853199-68587232492422984285049391"
1⤵
PID:1908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1402655327904429799184811827910474328101291280849-62614007-1712822173784678827"
1⤵
PID:2432

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11029164507446782401802074904-1512238842-20972958172021222302-15198622081663873068"
1⤵
PID:2728

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1783163197-949130432-736736665-189066209411883182941574912249-763696563599774384"
1⤵
PID:1884

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "317312131-2562649681053241648-21242581791263124744-1327373010-1013258577-1915520033"
1⤵
PID:1568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1052228954-982117256-1462725201836278041172078611019742254331993128659-1142545786"
1⤵
PID:2852

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1936492341691432237228092783-1535805407-1920505420-1615281362-6634748661689164214"
1⤵
PID:1468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2731609161549012674328050897-1947718561-993710118-11623034952073951475-1595923552"
1⤵
PID:1996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11226770531202139937-5471543864160649281829016704068613-12728327084619578"
1⤵
PID:2996

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-4104761318008008661771013899681909139-617446202-1114928869-87126707383062109"
1⤵
PID:2208

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1507421740241411568-1133332250-1711150586-125796986-1203812887-809471683-1683935858"
1⤵
PID:1504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1644301395-8020865431476043265-3123237122019228197146456845-636921832093726851"
1⤵
PID:788

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12800826052123118452-46952498126139800-1764664630-18004895421280591150-510151013"
1⤵
PID:1428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1615231485-87981466790384224-19967483211440191293-108392468-122917374760352935"
1⤵
PID:1012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "41729521-430562213-19896537741120498124151372873-2133991185-11579081951102447080"
1⤵
PID:2020

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-17493037322110088661997794539-21295188447112964499128184981402724158-265320731"
1⤵
PID:2280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11564278138918693841077952775-1054483428112552482-863405319444612281578976232"
1⤵
PID:2196

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1139587508784043764-57490304948959968612586073541612492305474233492364062454"
1⤵
PID:1664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "602814582-53387146810324970720911313642054335007-552984520-1939497690-1586243092"
1⤵
PID:2464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1907581018485427451-188473222-16271709782123935207228440574487255762564859229"
1⤵
PID:2532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "21278063511402505346-9391838951212418897-786556662-1812337109-420450137-195346095"
1⤵
PID:2628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2015456524921180733-134360840784519480-10036723882852816461956299809879492516"
1⤵
PID:2028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1501060651-136968156447611874817018975581469093835180493576214281132341268143358"
1⤵
PID:784

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10090545491936192818-1846764050-664904521846408701-1984677849-304445433988731105"
1⤵
PID:2516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9735834611137917875638501572211661204731433007111199972461838462274-586539343"
1⤵
PID:2452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-485586729-6430822981381313824-1535138376-400355505-216839000-485621484-1004868700"
1⤵
PID:2588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-125581933-284854963349270088427300351-20424666291033977557-1458568755-1755285776"
1⤵
PID:2752

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1505628371392635822-1730540682533820986-1583012328125693241260990652-1159264797"
1⤵
PID:2764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-882522434-766294803-927317511-52647788859692868-866643668-1422458884538061041"
1⤵
PID:2104

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18739706671121574355122048288811175861319574768481863767269-11350865371306856853"
1⤵
PID:2156

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1650382323-1896557967-1341838711-1065660853-133382556379140116311256201181923024401"
1⤵
PID:2696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1648060996-1026317287-11695176661826827850747822046-3915156271349791840-55174764"
1⤵
PID:1900

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1152486918-2274364167140684690166853-7433732507773817381336272805-4265391"
1⤵
PID:2836

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "514043614691689750844711968928333690153243701316903862861320691421-724049869"
1⤵
PID:2488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1318850032115024217215935103751391116554-5886867932106128926329741232843057203"
1⤵
PID:568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2046042369-10208053481437199005-30043282817708558499525505487822471321786542828"
1⤵
PID:2800

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2381543576238553671792735493872645844-1628518733-1823408923127270909814245024"
1⤵
PID:404

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-344069459-154608329712008425652308028961987835328785498851975823169-984164288"
1⤵
PID:3028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "573307780-1087678532-261002820-715088465-17553423301456789212720154289-2076654333"
1⤵
PID:1608

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "171834788-2089075720566909552-17943092329657850761903573002-1882810892-1284857266"
1⤵
PID:1660

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "11968830674989811931237889980-7262554631219080289-445145598-491824241508271954"
1⤵
PID:2040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "356729007-17179851181673245431-11834504401350583601165707780513586367041633904333"
1⤵
PID:280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-908737682-14923743941058891441-1279306876-118046401710203716932351153-699888118"
1⤵
PID:2164

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-242348066-1247017898-1089452227338818326-1016778933-1453831852-1996708844-1977387274"
1⤵
PID:2436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-584003155-5990591652125105770833277493672934836-303587859866553385-464465578"
1⤵
PID:2452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-53162266-607096233-13986466771128390310485547920-12001484981136720322072929234"
1⤵
PID:2752

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-92531178010685335781765367211765067186401115849-11266938771661454470-248483206"
1⤵
PID:2764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-88707378-7020259311157798548-706194716-15778959408458705641871230665-645115194"
1⤵
PID:824

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "7998166020603023391599935207129267666551526649329433783618636-1177787555"
1⤵
PID:1256

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1793932210-149022728-17816034351023248512-670743733866172475123244667-169591800"
1⤵
PID:2236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19121679398660239837192547222069239073-42650479-3968385091701775503-1425362528"
1⤵
PID:1504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-44946360820763556620551067911525127001097796235903257148350660360-827621999"
1⤵
PID:2816

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2024651423-1411784296-10641120741863112572-1413621377-537839117-78470713-1239362213"
1⤵
PID:1712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "11656940752862979191124691410289895948-1290670268-20208957811390797866-780413400"
1⤵
PID:2004

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19563945451959439387281607522-13014608540807761718390730659292508542044245483"
1⤵
PID:2464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1371983763230530512-1460749477-183738072311617923711315551248-12043159291513586136"
1⤵
PID:2924

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-572734998150006011-2041120141305016377-949539161-12011587841832618691-2009325853"
1⤵
PID:1324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2076700992-1063847036-12981638435663183891999166242-1800592041952412426-844626350"
1⤵
PID:1528

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "642521421-50326531-83586591019268646752091198947-10713521716048602851418696834"
1⤵
PID:2776

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2260855312141315311468691521-712432001-136075164396788885625136495419808222"
1⤵
PID:1548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12796199671089741185-1493891689-834911016-1198938985120028809-19897634221043595753"
1⤵
PID:1228

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1933905728-682292008-381847549170955540889331174799151949-739397004849432216"
1⤵
PID:1904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-917384806-183677219320795534251175548844-1395568263-1995073014-750805831-404403241"
1⤵
PID:1376

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10685341652029341864-8614237441614843217952738885390275107-613966035404272652"
1⤵
PID:2260

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20680196561456457739724731601610390925-353181191-1937249001-6711574481120105655"
1⤵
PID:1468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-248779485-1498295931-209744160211016888952019225090-2554236751211210093171683326"
1⤵
PID:844

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "798222815-361416469-1571224838-1149496127-676846203-18469470622053893725165977263"
1⤵
PID:1752

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12455427641640458263431550194861664976-1812971151735173298-449802577-1336287452"
1⤵
PID:2648

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1461925381-661136030-6495787829207154021718312252-18908248772085650166850998448"
1⤵
PID:1744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14236968278062710752064632643320794762-1837716311-1725093969236640372556758087"
1⤵
PID:2912

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "917211187-9765823311365271753-1366390612-715129314-13410154561156169122-1281472406"
1⤵
PID:2284

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "189523575-1707961007-258024027464630703455049072-1516673847-7196359041170422902"
1⤵
PID:272

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9304175201104203208106967742012673869620160551-1451272473-1200054697856539114"
1⤵
PID:1844

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3418154-194614771014772628205001000872874515-129471889013805586804489478"
1⤵
PID:2320

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1323088012196019101219873370901913671825-1640662384715461601404805579727388253"
1⤵
PID:3056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8933132611994344129-164292961612388770711323683749-14646154871688548591-1378663741"
1⤵
PID:2556

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1649058115-5223937261953203519-1989061064-1357075085-722966077-1843884991-1138504134"
1⤵
PID:2928

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16003132851096947862-819455454-13324076085721566211315001001540140646-2132981178"
1⤵
PID:2252

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1937738331-17152818031135140973-2078766743-259919736-1463551906-7331127071271334888"
1⤵
PID:2136

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1727803334-652923132-69093330-10950169321756254242211931148311516920922063803028"
1⤵
PID:2508

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "721474137-169136326318966975423161097-1011277043-794373349132231770-1422720617"
1⤵
PID:2388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1913771669-1319217084296134200-85143028339576424212826600162036141437-1643922824"
1⤵
PID:1368

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "480007622-2085719576651517080-1481857230-1153538041-385985858-809899595333246851"
1⤵
PID:2440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-43911333-158015336-574699001-1817310571404690558-1669093835-310415370-2136314474"
1⤵
PID:1876

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "677444691-6677256271883236651-15231392581933340097-637398790-18820106671979253232"
1⤵
PID:2180

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1902873899-1171742585536071113324390758120568978-1051180427-15488447461879113773"
1⤵
PID:320

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2012890678244334731-8490384799952575571962168416167859186-1995748965-1481326244"
1⤵
PID:780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1023736927-17297496211767705011-1932140251123881919790450188813700273591512475543"
1⤵
PID:2548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1824902238-188063397419777203931939094816589477886-11067930181907161282-1135743221"
1⤵
PID:1696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "18801783001348559956124998816-850157871-3879035791543022149-20806430321383104130"
1⤵
PID:2184

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1112572866-1298964028-169547306817370253322011895907-2873194091103356336-1755993161"
1⤵
PID:3012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "175642610-550190593265477691449530648-17439979869285201391614341778-1939927418"
1⤵
PID:2780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-21039146573743515281369554655-1442026025-1510361711690823243-603701132-1977712005"
1⤵
PID:1224

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19823070981930818687-822792061-923619819-405523504168465707816996672481399231422"
1⤵
PID:2832

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15048846206122504301979597944-1854538170-2004074692-1793697637-5379726281997655741"
1⤵
PID:2932

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "219894126876448239143801764-1505571031-19702560788861104748968484321097676927"
1⤵
PID:2372

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1118116476488464507401371609518042731-1726233433-1624078559-1897019436234348439"
1⤵
PID:2588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-65939017-44526510-1384916006-1723084439788597601202956580529027518-2059622795"
1⤵
PID:1364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20893825221604838268-12994316821511907211-1245565625-1196335693-805157810-210375370"
1⤵
PID:1952

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "242781813-990479270-1370117860-777797855-1102953602502082743-1984056155-562958944"
1⤵
PID:1568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2550905151697495890-21344297471140535609966311122192217699412735953971461483060"
1⤵
PID:2584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14083904611278302021289591808-1604632545153416685-8347703656216238471736926022"
1⤵
PID:296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1760412534-1353490819-9096989292051410620-13957884873956431752058786650-1935886907"
1⤵
PID:3016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "338630466-91075122-15691811421819439312-16967232681604326437-560678055416715377"
1⤵
PID:1708

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-17292713911085153019-179150428461034560-5182312901966261247-620328548-516847202"
1⤵
PID:240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "817700342031189442-936974560342104848-1289624640-10910016731410103131843090724"
1⤵
PID:2908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1118284472-980903249-1632463039-11625853361684860299-1306069017946694660-1773142200"
1⤵
PID:1440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2047192988771100492-360372438-12301444911002111328-247998442441174223-1721057719"
1⤵
PID:1936

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-601156144154379983-468629681208765902620189353031958873622626256900-1886433360"
1⤵
PID:2196

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1538833374-2091601584-1002902343-209560136253879011585845353-2030951094253053759"
1⤵
PID:1664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "717056364-130889597991977560-834455352-6659352541748543921-11753753911388571727"
1⤵
PID:2716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1579609204-198621301972243872-12911683011230874564-1898662755-859118601-369399757"
1⤵
PID:2812

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "197773760-192629686197266919621130589279742056191404374873659451760-509205535"
1⤵
PID:2504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20738114311023199115975027445-59577819294803258632303186-1735598213-788184031"
1⤵
PID:2896

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-169924920991716259628694008818381933801339161292-11331107751321652689-370848984"
1⤵
PID:1560

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "16334699520719621561822354716-1065350891334108672158508690413665640561881227111"
1⤵
PID:2432

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1066568939-1138832567-616069267-2459523392004381218721929519669795748-2047508082"
1⤵
PID:2588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16067975891051658582-174923336310679859581426238460-1982725146-1589095443-513883932"
1⤵
PID:1056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "464859673-1462208286-1604207476-1758020572-1448350830778060362-1148995703-240657367"
1⤵
PID:1368

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "17932245481206002456-809323088841086496-1691560647763945141-481715005-1294501856"
1⤵
PID:1588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "161024558-1622728611-2164942671387258533-8416342601371324277-455898647-1706944314"
1⤵
PID:1320

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1821425533-1990585418766208909-1049560274112163442744777316011180713131020584560"
1⤵
PID:1568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-439502503-18854765381701625003-1819144559-697909416-251684640-926490453-2104197663"
1⤵
PID:2584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1129632485181516519-51321679521773437954070030972841947587312767-1632255281"
1⤵
PID:452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1588770027-1834644101902715733-1696663878-430664901-5970671247187644111247816293"
1⤵
PID:268

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-765865778-12164777955178284441087919038844206593-2086600602-1163167332960164072"
1⤵
PID:2328

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "694292448-171815199186561841542827689-1991814016-1883315272-864368777-1950423550"
1⤵
PID:976

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19487056971522607879-14742583231561792587-348539885-5780001381480593397245899844"
1⤵
PID:2100

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-396771535-1420137708-763093288-444044434-767586796-1229672854837910853222077690"
1⤵
PID:240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1034708024-302776389904438206-611831537-131698515719041206271830132778-1194457129"
1⤵
PID:2812

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1052528581-17433447481861671016539419521340688059844642816289153233226423077"
1⤵
PID:2056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-406856080-120452587555985728-2046836710-700616318-7475937471477177481471420037"
1⤵
PID:2604

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1495884818-1777442766-88456732914286664101605312219468464190-1426274075-1811270892"
1⤵
PID:2984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-182964801509045143-47021459514937998031864673764213964318522955446958976669"
1⤵
PID:2396

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2121106817-1846465310-7965481361601712299-642208725164894451924305084-1113435509"
1⤵
PID:2408

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-222651116-1070139965-1965610625-1754884952-1168934105428573828-65815619-1030069345"
1⤵
PID:2132

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "651482847-1795378315-9635022041707509324-13443401051081732628-14495563861632777682"
1⤵
PID:2188

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "894079121-141137957593494993315520407222130446722-796551814-1671734429-399228023"
1⤵
PID:2888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1485664532790548710555268791-10145139992036250739895812635-1822624508-1194799887"
1⤵
PID:2656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16079051151364495717877882911310945661511639489-1220154473-490689163-2031615137"
1⤵
PID:2268

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9876857904611207088751588872008377924-1113536981-1997561939-18830505171986833978"
1⤵
PID:1988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "895399228612088843-759360549140448663145855606117451063941287333894-2063941473"
1⤵
PID:292

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "461936083-181346141614677519841760182588571930332-2134068832-2053653635-334220323"
1⤵
PID:1524

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-81940081268707823664243353-366090403966128079-158994725710426932491593209479"
1⤵
PID:2828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-42089315-18082593655991591072000311180-19429322161018797710-16519482751458834403"
1⤵
PID:1496

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1536915859533949659-2114594960-11842039164804821568213967701676021007-1449914757"
1⤵
PID:804

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "994026741-1062689738803639630108106142750808726048758981154852871-121662222"
1⤵
PID:1872

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1287184298-865683124-325880873-179973611110461828991486881544-704564837689706253"
1⤵
PID:2224

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "68313998345417641759172046544987233-1826400175-81121145-11833459161002237640"
1⤵
PID:2564

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12590112281625635097-1371994810-1138982020-183776482-97660270711485432491411711549"
1⤵
PID:2632

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2128720592-684723486-447011286-390308369-1590466057-12555335441127734646-1753163838"
1⤵
PID:2032

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "114217871-938050766-1563707744-10902209601826271056-183299062613439396551492321616"
1⤵
PID:1696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "9315974238800538121874841624-1206767757-173711731-1867046259-2012454402790725043"
1⤵
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6~1
Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
611d09a9ad8d4de7dbaa159266b22eb2

SHA1
8a636d87f0f9c3b88bf2ab72b668288ece5ec916

SHA256
74ebc9a2d9aed68879f32fdd6e5faae3240671ae5f2664e7604c7c335c189504

SHA512
b61d42c43b8184dec5c94a080190dbfb89b9f3ea06f5865a06e8da2c3649814ad42f4fb7461b55e3faa50eef165cbb1f83b41636dd7837c2d54cee4b1c683d8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45A~1
Filesize
472B

MD5
e6352fe4bdea282f2f0a1a5282bb5c32

SHA1
b3682b4f01987e086fbe49c17c4f815cc005f855

SHA256
d3b8198a69fccaea3806c21cdcf084d6a96152819ad06600ae0ba3175295a328

SHA512
3e5f60fce6abff003346b7a72ae3acb939af741ff5c8111ee9e5cf9a98f9886a576034dfb8a1e9d233a33c820854e6ed7fd7964162950c9e4df3c5972a3a92ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548~1
Filesize
471B

MD5
fd84c1a26b78850895b35b299c0fa27e

SHA1
3cc51bf386ba69bdf1616b72742aa52c1cf176ad

SHA256
9bbb6dacb7ff60dd8d6cf95eb8312cca8871f46b62e344b4bd641884c2f5b7b5

SHA512
04875ca239784b66f33b0c7f2dee33369a3f4e1eddb0cef7e0656710335a13a1348e933efeb0679a89367b39e87714aa880095dec107a2bc98bdeb979afc05dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF470~1
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1~1
Filesize
472B

MD5
d989d166cb70cd587adc13dc38ca7715

SHA1
ee72eb2899e1610d1903c97254e9bdaa07d9cd38

SHA256
3916444dc425edc8348873eac1d26ef3342accef35b3c9940f39cf3c428ece5e

SHA512
65523be974fd1450a6c1b22d924a2fc6de5f65be50503adc06e93e8b3eea8e382df1ae37f183e1cc961d9c19800cf1843aa07cc771b7fc6e95e9e7c5c6220df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize
170B

MD5
7dc065f4f7ffd637938b0292fc16f546

SHA1
1913d68e82e9e2bcf0e6467c1e7f96e75367ecb9

SHA256
76be4774ac75741ed44c34b03b1d40e2c40234b70a7b077a458ed0fa1a9ac813

SHA512
aa696be97044970f239911876553862a0e036d89fb5bc75edd5ec39ed016b4ea2b7496e3c2c2e52c0f84491a021978eb34ff9cf1579d3c4300fdc7c310b1f843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6~1
Filesize
170B

MD5
8443519e1caaa32ec860fb1812fa3660

SHA1
429a6098849f9f00cd10788182f44c09c109ad13

SHA256
a258e757019652a93cc97dfb34766976e0118c92687b4207ba6a9f395aae22bf

SHA512
fd9df1158b99ea31628b0f4a0cc16a20562b0cc8ba3f20c25dbbd04d75f346234640f2626723058e54770553e327b99d32dd4e75661f3686a9e05e4d3fedda2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
194a7254342d426f585b5b666f75bd98

SHA1
e6de845d4dc9afe9cc0ea522ddd45aa28785bfb4

SHA256
7053845e4aa6ff1c6f46631c9d949fde6dc707c636a85ba12b545cbdc4c13ad9

SHA512
78f72feeb77f7ef1199b6f34eef818d85408bcf4ff3b9ce862d5c949ed6a12a9b52156f1abd523a98aceeba0758460ce7a835377724a848f1faf7f66bb3db7aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
d77f074f8dee25dc97c66de1e92a4d50

SHA1
df2487cee9d719bcbce420c0665c3952c171be33

SHA256
6f7c2ebbef31842d57a394deabfc119306b36ab6bb0a7f149f76922eb784c862

SHA512
883d53877f38b50f0ba7e2e54b83cb4f000a440d3e999ed8b3f2a461953e929f9507e316c95d62d7c465ccf26aba4c3f87ee4ea89303d29674dea7b9e72c3b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45A~1
Filesize
406B

MD5
bfd6fd7f334be9fd021976d96e39ff56

SHA1
306169e7f593fca3a5bf6e1f04b86b869007764f

SHA256
49ccf1f428d81e8e6ab0012627b5a257e0cc0959882560a9d51399a0881a4ec3

SHA512
dbcf0e42a7095e0a9ae73b6108fdd5e212323541c312a24fb6b74a312e37667091ff3f598c0a67c4f0cf213e5d50d8dd4bec421df515767c9132dc5b4ea23d4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548~1
Filesize
410B

MD5
3a11c0aa785d0325878996df237b9419

SHA1
78999cd75025d3bcef2e2605a78b03f251d23002

SHA256
c1ed526c26e84813e8f8c152f54eacca4e2be0317e206f6339aaf949a5c23b15

SHA512
35d8ac96de34b525e9497dcf544e09fe893bcc79b4bcce503cb69b44c61e438e9bb832670a264c1e5ecde6c7e90d67dc9c9ce09daedf77bece5542aa33c3bdea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4ee2c9cd3d6e9d87581700399a56875b

SHA1
046f4e517abccccedb2654d433b20f9c6d617074

SHA256
4e8c03b5e86608aa3bb22551fd68650d612a5dcdec1bee417409aa0703db4a9f

SHA512
307395aec243afc16b328e7a4619f7d15a8ceaf092562619ac971206bfb812db6bf74863b15a798d8cd99f83e85dfc37a48917fc5dd0db58ac6e87dc2993a7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
40af462dd8eb55d398cadb032efa8949

SHA1
80ed9bbbf356f74cdffb10e2c207163ffb651ecb

SHA256
e8f40dacf24214a6484f464d9a998b87f1ded9199788fca8f7a3fdf078f93e12

SHA512
3f72b05e2f7664692773932ebb0a9a3fce6b0b1b89651a5d2e52718a7ea653f4641243f482e25be5b27831bd4aa044ced2cc98d98d2a519bb702915fd47c17a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
117d06baa2996a0ecc001a5530a49f55

SHA1
6c546f7ed2440567ede89c1baa543f91cf8738cb

SHA256
02b38d747e251c1129973cadd204c74a5b942720d9e873d17acb110749e79ece

SHA512
29dffa2729d8d3428ef14f37d70917acf4895431ba981818242ecc00ccfd07e5f1684c47851d1a577cd35e99cc4c48e5bcc123d5c9ea3695726acdcd48939568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
93cf84d6a8772abccc25ec44aa8fbe0e

SHA1
943080ce6560356a4966ce47bca232e599991669

SHA256
9c55345251701c7f6419a4b13637ed6c2099553da7a97a2c4ee7efbde5e8c4f7

SHA512
d756ca4efe99f3e0fe02f88a9601572924c69cf3ef19946ad4eae2cf6ddd692bd7c5bcf923edea84dfb1d24ca455ded58966f3828907603fc346ed8a00e75235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
222b639793479636675eb4b0a3053cd8

SHA1
2e07111b233fa613a3719a0a74d8107e8090057e

SHA256
ded013695edda746245e6c47bf529c96e919f718be38b90e16df37ddd197a9f1

SHA512
1aff66294ecca41cd9dc9865f10b9f0547911a7b5dcdb8f9eeb4c2a42d4f2de1ce1da8f0fffb9a668bba4a3565339b1f25f5b796f273336c70028ab3bbb36f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e0df7c400293e4b11a9372ec859f68a0

SHA1
0f70d3751894ab832cc676eea361a4afce9287a4

SHA256
34294742bfbbb1df9914b11a9502fcf0834371f8e5851213303051efcac9bffb

SHA512
7694c7d9440b1bd5b906f0c972106d7ec43079940f53d39de6c002b15f55b39f7a3a54201d2242dbca6b433f1d782d73cb57e6a3c49fc4130686ad1ea761ac27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
08e0530cccad8c51d1b683deec5cf947

SHA1
84916b6190f78076d40e9e038622ccc9f4159551

SHA256
9fd46a418871c939d6f925941c8ef02028ce3660f3023540391293d7a9bb0ca9

SHA512
4a0336b3cca5dd2a930055a8bb61fb3e35c798d74d5dc18a506bc307add15486b11f6f69c79c39182ce659789dc5ec904e79cf1ef27f6d90598ae2e27da32116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
782b44817b616bf35d3757d90d472295

SHA1
5840edb29e53e4991a8a2f1e8a3fc312e2a11d96

SHA256
617f8ebae45cedc0b52e23999b70ecc2504ee3cf1bf2e168ffcb2e838ef5f13b

SHA512
dbc2a16d11d46c8349e969a66e0a71c8367bd09a23b878a85cac1af9ee2b1ba83ab2088f147681039e927ba074d49991dc0579e66a47088478f1eb92782f838d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9bf9cd140b89acaf757d610098043096

SHA1
9a124b2240cf0e10274a2de5f491609590714b88

SHA256
34763f34da6680290b5f81d51621e10e916a0d263686f66387ab478af6dc191b

SHA512
9409271b0db8335785ba35923a8bf893e3f4475d73ce156ffc50a9f5219b073a0462ca58c3b49ddb1d7ce41d92fccc32816d8dd80e797835d6cf8cfc54c5a511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f699dfebada53bbb18580bd76a05e397

SHA1
e5011d61e8759280ee4b7dd3ddad4592e6be6d01

SHA256
b41e74c356584ed00b61fba7fc2023a3b23ad536ef9cbd4784e6010f64d115b7

SHA512
e1bd41df664aa299bb3a3bf7b9a239efb9750500e82c17759e82efca8d44cfa5ac5d0ba3edd7e44fb7f9cb8027f50a4793e451c9dd895d92f45cbdc803170aa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0e3bf64f2cda22fccbe1f0f308eae0b4

SHA1
b3590d9cb7aa2d8242c61bae45f58b96484a92b4

SHA256
958e3063b0db63c0230b09754942a0035b70ababeccb86066785e08c1d9b0df1

SHA512
93e5c4259c5235ff6ae616640e3415673b7adf5dfd53e4b0081aeaefc959f6b4e04676bf56f578391fc2a7e2b32783fbfcd9472fb2ec8b63484207ec450a13a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fea7a2a996dd94b0fd191ef15ae166d2

SHA1
d08baaf02bf704c9f2ff68c87e7a7fe04416b0c1

SHA256
957ac2deee9be6bcbaa05c73eb8891e7434480430f4f0a40fd19eb05d16d56b4

SHA512
fe05dbf8daac8d9112615ec2380a7144ee66395e8244ef01692e7f36fc78151616ba7aa7b0ec7235ac5c595cc24b39bee57b3b5b5836419dc45f7dab2fdfa41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c634ae60f76932640c1ab114fb009b08

SHA1
b5abe8b5184ff33cc52da8c63b73e278b9a1c8b5

SHA256
5e1ff2118178477e6e067f0f527211316e4d283d9fa7939170fec8c8f4041cb7

SHA512
75a9759e6fdebc3c2a650ece005b0c3b17b9ddc60854e1a411a412f77270a1a5b3c1adc9ae325108c4b5cc00f5de004ba5c5e8681532d9f4f01f88c046e14fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
bf6fdb8cce611e3c4b135176e709753a

SHA1
15d9549407a6be650076b5481612c8cd5d9223c7

SHA256
ba165ad5e9505dfed51b2033d78679687254382da99e00e99062b46f28c384cf

SHA512
69644a8340b90ac93fbab06a5b686cef68ffd011fd91605d7ee3e7d6186239ce87f839844ff34a781556853a654fabfd78dee870df6dc98345802a5912a403c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
af7a57f9f359d16c6c9b106dbfc3d855

SHA1
eff4edf8fdce7083203a0b82a26602df77a61a85

SHA256
5ac85118c5688dc63a55db8967e26f4473a4438e323736c8920691ed14c9dbad

SHA512
c3ff89135c2c30fe0687cca542a14465b0260d62165584dcdc90dd07ab6d690fde1a60848700710491e6a2cd5efef17e054fc79a13ce3e0502c1e62bd998abf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8937545a565a6f869544e70eac5da05b

SHA1
8073d882d6d3c1e71cbc97c1cf0d5eeca7ebe8a0

SHA256
adc544a9143e7347c836d84bd542979e186641f7fab6ac33f9e52afe9de3123e

SHA512
e0c5f2558c3a1448b3a3b85e1294429ac80dbdd3d277fae209d51536e981635d2397fa40d212c6f97bf6bb5e131b615e77ca0d44d748e1d11158d9cf28bb8bd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
de16f11169cfe6b4ba033f2cb9e52905

SHA1
83b81009ce14e9b4c39f7be630df354b2978c284

SHA256
ae89a73567ab53fd5064d9ffc5cdd98adae847a51d038823d825ea5fe38d7ed8

SHA512
fde8f5eb52af31fa7a0b081f0b8160bc9c4f93d25bde21f04b417aea0647dc7f4ba0b1b2346f2e46f31f78d73470056179e91285191e5d1cdca5a421a7554b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
18981132ae55f5fd5c764abb4215782a

SHA1
1b05b0cf2a270c2fd6564172f6a737d595af856b

SHA256
79d8e87a1e076d5f75b213672368971d7488021a5790810ee4b70c40e9ebc362

SHA512
5e99717b31a0e2ebf3b500e15a5014c3e4cc2236aa931d374c1711eeba6f05ac074b39a5604140ad6ec5b000dd0e934e36ec49b8be7fa2d5c389248483ada3a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
11bb41282cbc63a8b3011ae6e4b7b38e

SHA1
4158773f33f21f84663f4c4416cea9153f7ef616

SHA256
2ae0f245e98d30c9cd6f98c272c6036a1e613ddd1219e504c5f72ec562526004

SHA512
337eca070ba222e052dfbc7bf72aeaa3e5886289a4f6263ad66cd9ec3af59d5bfaca7502b0456063746d83296901d67d92cc061669037d39c7c9fa5ec4be1f8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\943080~1
Filesize
342B

MD5
3ec3a3a30beea7559f8aac0b208409ec

SHA1
e13a00e19dd213730406a24e272c670db103a5ca

SHA256
47786a952269647d6ea534abd02e6921077d03ecc6f19b443ccd9755595cbac0

SHA512
54c16a4bbfcea66fef956d452c6b8d1e385a41f8da5f889f1d8c0f161d630dab5daf3e49073a9394464a36bcd098d09a4b5bd3af7ed799a8781741fce11f65fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF470~1
Filesize
392B

MD5
19407b3d318d59ab20732532ade13e6b

SHA1
e75c6e1ef750214a30616955b424a5f8d65fc1ec

SHA256
4016b6e67a9ecba48e6d1abdb287455c0e84c33e1fbee0e612810c0589aca40e

SHA512
59dcfff45b1d1afd6d6cd5d0ff5e0bc7cf196fbcb4697ef2ae6dd2af462590e77dba5bc552defa922ec279a67c36a6dc7016149103d271de2052f148dce03da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1~1
Filesize
402B

MD5
471b404c3e4330a5d1cddaf1c652758c

SHA1
913bdd994b20f7e7fa2047c85f1617e686371c55

SHA256
bfb582d3ebb22e0ecea76ebef45806019a4be234354f7dc68b995382fea5e68a

SHA512
eacc4f5fa348ab3d722c6eb29878f60b079b789257be82b3c124d2bd385e54f900ed68c36b5f2be97edb0a9304254f546e4e3813ce3f1a587c7653b4c3202097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\LASTAC~1\RECOVE~1.DAT
Filesize
5KB

MD5
4071f211b644701d8b081f0b4091b5ce

SHA1
bd58fc749549ecf08485a94af33ae876dae271d7

SHA256
5339ae8c2116c02dc48f9b87bc89c253fb8210ce993c0dc1b28b1ba1b0707419

SHA512
2afe0958578f2c1839ec696c39248e4eb8dc31d37f18166d549a74d22a5d39445d6cba81322702420e72062642215feee91b74677bcd8b07204945dd528a84ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\LASTAC~1\{DD6DE~1.DAT
Filesize
4KB

MD5
0919b1bdbdb33a191fcfa3e8b3ae1129

SHA1
73f04802990cc73a2eeb30066fe787e966aa412b

SHA256
7319e1de55e5edad8d7744ef209a8c97e8a20f9da39216f21d70675f39ecd2b0

SHA512
79dca6bd573bfa7891f0073c6e5a732c6e194c2f51a974b2248efda651f24975a2bb3eea7e03ae7fd2c5a989497fabd02eebc0bed72a98da0c245cdf1e2d0d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\VisbyRoundCF-DemiBold-317879fb[1].woff
Filesize
36KB

MD5
9c28846c2b76bfa720f5535d28edcff5

SHA1
e777874cb15fe1827bcaaea74e2ee081dd65a423

SHA256
317879fb3542917376006438c919ac8367cb07ab69357310cdbe2f3c24471a8a

SHA512
dd2840182a4f4eb4dea16203f0011063145fb5e9268958248f019e64be095819bc99d3e39a9bf039b44f6c19aa64535df45ac35fb60cdd85ab84ade7afa4682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\BitCheats_logo[1].png
Filesize
74KB

MD5
505b0c2ddb254c6318a0b00a0b728c36

SHA1
fd75db8f370d236d1838bf1a4548423b3f46bc3e

SHA256
ad3ac18390aa15a075ae2f9e8d5e6e1d46fb37f9595c8dd3388d174ba2fcda69

SHA512
e8e1b8e1264304e11e60a33b74440eb5a903b3a097f611ea755723e79704c39d7152b0f0a62f4e611db8b14b4515f0c7a51aed5803792a3594d0bac585d70a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\MagmawaveCaps-Bold-db1b8956[1].woff
Filesize
9KB

MD5
fb90fe844af89afdb577940072e9b17c

SHA1
7e31b1bb382926407837e441f09828ca359f773e

SHA256
db1b8956ded9db97192311360774e69f993ecedbae1c91e01b3035f00640caae

SHA512
749db10d4da598f828fc6cbe182e27bdfedd354213c75ba4189d7cd476e06b31f6a513f0779d58674117232e5b29d5b064aafc9cb8af49abc5f41e788e41913e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab169E.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar179F.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF2E95D7ED2016F719.TMP
Filesize
16KB

MD5
83b7eb6488118b651e677235e11cfe39

SHA1
7187222658b6a4c2ee2b18599a74a90d09cb774b

SHA256
90d60b150ab20c05ad84cc48fbb18959f5aa127eb98f04f8fb1751c18c0c071a

SHA512
0d537cca04853cfd07162ca248c1c3b0387bbc71ea9858275e5a920272686ce928c4e17e4b81bfc3e3134457ba2a29aa55b7632871518d82a1976e2b3dc2be09

Download Submit
memory/2240-5-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-1074-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-6-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-3-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-4-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-2-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-1-0x0000000076DA0000-0x0000000076DA2000-memory.dmp

Filesize
8KB

Download
memory/2240-1059-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download
memory/2240-0-0x000000013F5B0000-0x000000013FCD4000-memory.dmp

Filesize
7.1MB

Download