363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb

Analysis

max time kernel
106s
max time network
93s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bitcheats_cleaner (1).exe
Size

2.5MB
MD5

24999353450c234c36cc2e0a74f75051
SHA1

3b716b36775bc53bd67c0786ed040628cbc926f9
SHA256

363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb
SHA512

1c0dfac601da714ffc0a3dcd5f6b1fbe95c7238177cbf3ab9551b833f5a062c717ab69ff206a7c9dee677b52cec1cb81efd4e36dc6af5fc195ab07e4e453d143
SSDEEP

49152:rabHjq7IZiuzkKECE95eHmRSW97qWOEhSI7o1U26TYtkY+toY:rabOUiujECE95eGRB718zgY4

Score

9^/10

evasion execution persistence privilege_escalation spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bitcheats_cleaner (1).exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2096	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bitcheats_cleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bitcheats_cleaner (1).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2140-0-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-3-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-2-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-4-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-5-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-6-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-9-0x000000013F260000-0x000000013F984000-memory.dmp	themida
behavioral1/memory/2140-18-0x000000013F260000-0x000000013F984000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bitcheats_cleaner (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2140	bitcheats_cleaner (1).exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\SERVIC~3.0\0C0A\_ServiceModelOperationPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\040C\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\UGTHRSVC\0407\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\TERMSE~1\tslabels.h	Process not Found
File opened for modification	C:\Windows\INF\ESENT\0000\esentprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~2\0000\_Networkingperfcounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0411\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\UGTHRSVC\040C\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\netrast.inf	cmd.exe
File opened for modification	C:\Windows\INF\rdyboost\0409\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\WSEARC~1\0C0A\idxcntrs.ini	Process not Found
File opened for modification	C:\Windows\INF\NETCLR~2\0407\_Networkingperfcounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~2\_dataperfcounters_shared12_neutral.ini	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\0000\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\ESENT\0409\esentprf.ini	Process not Found
File opened for modification	C:\Windows\INF\UGTHRSVC\0407\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0407\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\BITS\0000\bitsctrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~2\0409\_Networkingperfcounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netavpnt.inf	cmd.exe
File opened for modification	C:\Windows\INF\WSEARC~1\0000\idxcntrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\TERMSE~1\0407\tslabels.ini	Process not Found
File opened for modification	C:\Windows\INF\SERVIC~1.0\0410\_ServiceModelEndpointPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0411\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~2\_Networkingperfcounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETFRA~1\0000\corperfmonsymbols_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0409\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\it-IT\netavpnt.inf_loc	cmd.exe
File opened for modification	C:\Windows\INF\en-US\netavpnt.inf_loc	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0411\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netavpna.inf	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0407\PerfCounters_D.ini	Process not Found
File opened for modification	C:\Windows\INF\NETFRA~1\0000\corperfmonsymbols_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\ESENT\0410\esentprf.ini	cmd.exe
File opened for modification	C:\Windows\INF\netvwifimp.inf	cmd.exe
File opened for modification	C:\Windows\INF\netpacer.inf	Process not Found
File opened for modification	C:\Windows\INF\usbhub\0C0A\usbperf.ini	Process not Found
File opened for modification	C:\Windows\INF\rdyboost\0409\ReadyBoostPerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\netavpnt.inf	cmd.exe
File opened for modification	C:\Windows\INF\netsstpt.inf	cmd.exe
File opened for modification	C:\Windows\INF\WINDOW~1.0\0C0A\PerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~1.0\0409\_ServiceModelEndpointPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\UGATHE~1\0411\gsrvctr.ini	Process not Found
File opened for modification	C:\Windows\INF\MSDTCB~1.0\040C\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0409\_TransactionBridgePerfCounters_D.ini	Process not Found
File opened for modification	C:\Windows\INF\usbhub\0411\usbperf.ini	Process not Found
File opened for modification	C:\Windows\INF\usbhub\0407\usbperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\netbrdgs.inf	cmd.exe
File opened for modification	C:\Windows\INF\netrass.inf	cmd.exe
File opened for modification	C:\Windows\INF\fr-FR\netavpnt.inf_loc	cmd.exe
File opened for modification	C:\Windows\INF\REMOTE~1\0C0A\rasctrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\netbrdgm.inf	cmd.exe
File opened for modification	C:\Windows\INF\UGTHRSVC\gthrctr.h	cmd.exe
File opened for modification	C:\Windows\INF\WSEARC~1\040C\idxcntrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETDAT~1\0C0A\_DataOracleClientPerfCounters_shared12_neutral_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETFRA~1\0409\corperfmonsymbols_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\de-DE\netavpnt.inf_loc	cmd.exe
File opened for modification	C:\Windows\INF\UGATHE~1\0C0A\gsrvctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~1\0000\_DataPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netpacer.inf	cmd.exe
File opened for modification	C:\Windows\INF\WSEARC~1\0410\idxcntrs.ini	Process not Found
File opened for modification	C:\Windows\INF\NETCLR~2\0411\_Networkingperfcounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~2\0410\_Networkingperfcounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\NETCLR~2\_Networkingperfcounters.ini	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2336	Process not Found
2024	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	Process not Found

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1580	ipconfig.exe
2056	ipconfig.exe
1612	ipconfig.exe
1168	Process not Found

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10b43afd7fcfda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000007d09cf275360f2adf8c6708f2b621451cb7ab1b5dc217f47453775a5e646d37b000000000e8000000002000020000000beaa16e14955e12c472bfef03efa8a2aa8030ee1e0c4639af0eed71ab2f6cea5900000004498245ccea9085c753b3928058f694a6cbdfc8b08a4ed60c3b42bf30153aea699a2ef61f49cc71cc6ddf68cb0cb63c37ca7547728a32fee31688ee945f7d21bd4b9a038b93d0bf96b3874880159269752cd1f9580110924133307c3c3647c1228851d9f507b567e7e877c2c8cc9b1f73e6df69c9908dcfe87899b3c27f440c051d30947e51b9e9202ecc1edfbeed29040000000847b914c49c3961395294348499bf6c0ef63a0683b74436af22601054bf565fa056b678f1808e79f317baf913c606dd6bd91378830103ce1119678547e89212c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17246651-3B73-11EF-BA28-C2931B856BB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426416987"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000068b5180eaf2a6c319aa928c3df641df9785c7fac9214e9d58b53767fec26fcf000000000e8000000002000020000000007a2ba5ceae1750a5be08c05f9e0c3bc8bdca94e34420ecba730e4079c9437f2000000091b0209937e8f49d1e6f42968e97f1382b2f726294d4183342e145ec41bb5a0140000000932eeda6d598463b2e41a7fdf57a3ad983e93c7c58ad55e5e80b6864fb71d21cd4f247fa331cbfcc9490846d9924a85890290ce44761a0c98c516de2709d176e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
484	reg.exe
668	reg.exe
1040	reg.exe
1108	reg.exe
2228	reg.exe
692	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe
2140	bitcheats_cleaner (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	bitcheats_cleaner (1).exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2668	Process not Found
Token: SeSecurityPrivilege	2668	Process not Found
Token: SeTakeOwnershipPrivilege	2668	Process not Found
Token: SeLoadDriverPrivilege	2668	Process not Found
Token: SeSystemProfilePrivilege	2668	Process not Found
Token: SeSystemtimePrivilege	2668	Process not Found
Token: SeProfSingleProcessPrivilege	2668	Process not Found
Token: SeIncBasePriorityPrivilege	2668	Process not Found
Token: SeCreatePagefilePrivilege	2668	Process not Found
Token: SeBackupPrivilege	2668	Process not Found
Token: SeRestorePrivilege	2668	Process not Found
Token: SeShutdownPrivilege	2668	Process not Found
Token: SeDebugPrivilege	2668	Process not Found
Token: SeSystemEnvironmentPrivilege	2668	Process not Found
Token: SeRemoteShutdownPrivilege	2668	Process not Found
Token: SeUndockPrivilege	2668	Process not Found
Token: SeManageVolumePrivilege	2668	Process not Found
Token: 33	2668	Process not Found
Token: 34	2668	Process not Found
Token: 35	2668	Process not Found
Token: SeIncreaseQuotaPrivilege	2668	Process not Found
Token: SeSecurityPrivilege	2668	Process not Found
Token: SeTakeOwnershipPrivilege	2668	Process not Found
Token: SeLoadDriverPrivilege	2668	Process not Found
Token: SeSystemProfilePrivilege	2668	Process not Found
Token: SeSystemtimePrivilege	2668	Process not Found
Token: SeProfSingleProcessPrivilege	2668	Process not Found
Token: SeIncBasePriorityPrivilege	2668	Process not Found
Token: SeCreatePagefilePrivilege	2668	Process not Found
Token: SeBackupPrivilege	2668	Process not Found
Token: SeRestorePrivilege	2668	Process not Found
Token: SeShutdownPrivilege	2668	Process not Found
Token: SeDebugPrivilege	2668	Process not Found
Token: SeSystemEnvironmentPrivilege	2668	Process not Found
Token: SeRemoteShutdownPrivilege	2668	Process not Found
Token: SeUndockPrivilege	2668	Process not Found
Token: SeManageVolumePrivilege	2668	Process not Found
Token: 33	2668	Process not Found
Token: 34	2668	Process not Found
Token: 35	2668	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2964	2140	bitcheats_cleaner (1).exe	30
PID 2140 wrote to memory of 2964	2140	bitcheats_cleaner (1).exe	30
PID 2140 wrote to memory of 2964	2140	bitcheats_cleaner (1).exe	30
PID 2140 wrote to memory of 2992	2140	bitcheats_cleaner (1).exe	31
PID 2140 wrote to memory of 2992	2140	bitcheats_cleaner (1).exe	31
PID 2140 wrote to memory of 2992	2140	bitcheats_cleaner (1).exe	31
PID 2964 wrote to memory of 2636	2964	iexplore.exe	32
PID 2964 wrote to memory of 2636	2964	iexplore.exe	32
PID 2964 wrote to memory of 2636	2964	iexplore.exe	32
PID 2964 wrote to memory of 2636	2964	iexplore.exe	32
PID 2140 wrote to memory of 2692	2140	bitcheats_cleaner (1).exe	34
PID 2140 wrote to memory of 2692	2140	bitcheats_cleaner (1).exe	34
PID 2140 wrote to memory of 2692	2140	bitcheats_cleaner (1).exe	34
PID 2140 wrote to memory of 2476	2140	bitcheats_cleaner (1).exe	36
PID 2140 wrote to memory of 2476	2140	bitcheats_cleaner (1).exe	36
PID 2140 wrote to memory of 2476	2140	bitcheats_cleaner (1).exe	36
PID 2140 wrote to memory of 2428	2140	bitcheats_cleaner (1).exe	38
PID 2140 wrote to memory of 2428	2140	bitcheats_cleaner (1).exe	38
PID 2140 wrote to memory of 2428	2140	bitcheats_cleaner (1).exe	38
PID 2140 wrote to memory of 2600	2140	bitcheats_cleaner (1).exe	40
PID 2140 wrote to memory of 2600	2140	bitcheats_cleaner (1).exe	40
PID 2140 wrote to memory of 2600	2140	bitcheats_cleaner (1).exe	40
PID 2140 wrote to memory of 2256	2140	bitcheats_cleaner (1).exe	42
PID 2140 wrote to memory of 2256	2140	bitcheats_cleaner (1).exe	42
PID 2140 wrote to memory of 2256	2140	bitcheats_cleaner (1).exe	42
PID 2140 wrote to memory of 1244	2140	bitcheats_cleaner (1).exe	44
PID 2140 wrote to memory of 1244	2140	bitcheats_cleaner (1).exe	44
PID 2140 wrote to memory of 1244	2140	bitcheats_cleaner (1).exe	44
PID 2140 wrote to memory of 2112	2140	bitcheats_cleaner (1).exe	46
PID 2140 wrote to memory of 2112	2140	bitcheats_cleaner (1).exe	46
PID 2140 wrote to memory of 2112	2140	bitcheats_cleaner (1).exe	46
PID 2140 wrote to memory of 836	2140	bitcheats_cleaner (1).exe	48
PID 2140 wrote to memory of 836	2140	bitcheats_cleaner (1).exe	48
PID 2140 wrote to memory of 836	2140	bitcheats_cleaner (1).exe	48
PID 2140 wrote to memory of 2708	2140	bitcheats_cleaner (1).exe	50
PID 2140 wrote to memory of 2708	2140	bitcheats_cleaner (1).exe	50
PID 2140 wrote to memory of 2708	2140	bitcheats_cleaner (1).exe	50
PID 2140 wrote to memory of 2704	2140	bitcheats_cleaner (1).exe	52
PID 2140 wrote to memory of 2704	2140	bitcheats_cleaner (1).exe	52
PID 2140 wrote to memory of 2704	2140	bitcheats_cleaner (1).exe	52
PID 2140 wrote to memory of 1480	2140	bitcheats_cleaner (1).exe	54
PID 2140 wrote to memory of 1480	2140	bitcheats_cleaner (1).exe	54
PID 2140 wrote to memory of 1480	2140	bitcheats_cleaner (1).exe	54
PID 2140 wrote to memory of 316	2140	bitcheats_cleaner (1).exe	56
PID 2140 wrote to memory of 316	2140	bitcheats_cleaner (1).exe	56
PID 2140 wrote to memory of 316	2140	bitcheats_cleaner (1).exe	56
PID 2140 wrote to memory of 1508	2140	bitcheats_cleaner (1).exe	58
PID 2140 wrote to memory of 1508	2140	bitcheats_cleaner (1).exe	58
PID 2140 wrote to memory of 1508	2140	bitcheats_cleaner (1).exe	58
PID 2140 wrote to memory of 1908	2140	bitcheats_cleaner (1).exe	60
PID 2140 wrote to memory of 1908	2140	bitcheats_cleaner (1).exe	60
PID 2140 wrote to memory of 1908	2140	bitcheats_cleaner (1).exe	60
PID 2140 wrote to memory of 1000	2140	bitcheats_cleaner (1).exe	62
PID 2140 wrote to memory of 1000	2140	bitcheats_cleaner (1).exe	62
PID 2140 wrote to memory of 1000	2140	bitcheats_cleaner (1).exe	62
PID 2140 wrote to memory of 1332	2140	bitcheats_cleaner (1).exe	64
PID 2140 wrote to memory of 1332	2140	bitcheats_cleaner (1).exe	64
PID 2140 wrote to memory of 1332	2140	bitcheats_cleaner (1).exe	64
PID 2140 wrote to memory of 1356	2140	bitcheats_cleaner (1).exe	66
PID 2140 wrote to memory of 1356	2140	bitcheats_cleaner (1).exe	66
PID 2140 wrote to memory of 1356	2140	bitcheats_cleaner (1).exe	66
PID 2140 wrote to memory of 2032	2140	bitcheats_cleaner (1).exe	68
PID 2140 wrote to memory of 2032	2140	bitcheats_cleaner (1).exe	68
PID 2140 wrote to memory of 2032	2140	bitcheats_cleaner (1).exe	68

C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner (1).exe
"C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://bitcheats.net/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\
  2⤵
  PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History\
  2⤵
  PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\
  2⤵
  PID:2476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\
  2⤵
  PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Temp\
  2⤵
  PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\
  2⤵
  PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Temp\
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService_fn.exe
  2⤵
  PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe\gpa.bin
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451b49097cdafa85ec0f45214d6b0df9e8d.bin
  2⤵
  PID:2704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451e900a9bc20b57cd2f45214d6b0df9e8d.bin
  2⤵
  PID:1480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64\Version 2.1 AMD-APP (3380.6).Ellesmere.cache
  2⤵
  PID:316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.idx
  2⤵
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.lock
  2⤵
  PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.val
  2⤵
  PID:1000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\f_00010e
  2⤵
  PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000036.log
  2⤵
  PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000038.ldb
  2⤵
  PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG.old
  2⤵
  PID:1168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_12856.log
  2⤵
  PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\171cac9.tmp
  2⤵
  PID:2472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient\Manifest.ini
  2⤵
  PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor\Manifest.ini
  2⤵
  PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics\8E1D46DBC38F4A789939D781E1B91520
  2⤵
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor\Engine.ini
  2⤵
  PID:2208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs\CrashReportClient.log
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329\ClientSettings.Sav
  2⤵
  PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\ClientSettings.Sav
  2⤵
  PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8\CrashReportClient.ini
  2⤵
  PID:824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
  2⤵
  PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
  2⤵
  PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
  2⤵
  PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteLauncher.log
  2⤵
  PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap\TempFileURLMappings.urlmap
  2⤵
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\DownloadCache.json
  2⤵
  PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\08B44835D9E8B3BEDFB49C3650F634FF11B74454.jpeg
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\1773DBBF630BAD44B34734176DD5D03F2E6F4D78.png
  2⤵
  PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\86F7F05520A581636CEBF3AD1BD5C4383AE77494.png
  2⤵
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\88271B0993D67835C1C89BF7D1B9A1E5ED989F06.jpg
  2⤵
  PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B666DE51F8E930A8A99CB03C4454727680759203.jpg
  2⤵
  PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B6D962B44AD39D2129B4A96DB8C24DFF6A98D213.jpeg
  2⤵
  PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\D04ECBD1A835D9714A6F6D279077C15B2FCEDBEF.jpeg
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\EA7CDAA7AF5B1335517D581803C34BB2394218D1.png
  2⤵
  PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\ED43DE88DA78F8F4D6645415A7FC446EAE3BD5B8.jpeg
  2⤵
  PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0bef34491af34fc584b687e433656e90
  2⤵
  PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0ef043433c754e0588525283cacda0ab
  2⤵
  PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\1492c7f2588940848a4920cdff4e69d7
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\20334c6a270641c0835bed15d9cde4ea
  2⤵
  PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\3460cbe1c57d4a838ace32951a4d7171
  2⤵
  PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\6dea1559a81c4b18864782deeba57a83
  2⤵
  PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\7e2a66ce68554814b1bd0aa14351cd71
  2⤵
  PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\8b616e78d2674a3e92157d40df1d4cda
  2⤵
  PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\a22d837b6a2b46349421259c0a5411bf
  2⤵
  PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b4b8bebcb5e84d86b11ebb7bb989d88f
  2⤵
  PID:2504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b6c60402a72e4081a6a47c641371c19f
  2⤵
  PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b800b911053c4906a5bd399f46ae0055
  2⤵
  PID:2304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\be84cc30e34142d293ed27d15522b62c
  2⤵
  PID:612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c52c1f9246eb48ce9dade87be5a66f29
  2⤵
  PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c7dee411e20a44ab930f841e8d206b1b
  2⤵
  PID:2492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\f2f660d7855c45fdbb7922edda562a60
  2⤵
  PID:1452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\ManifestArchive.journal
  2⤵
  PID:316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup\BuildIdentity.txt
  2⤵
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw\Full.ini
  2⤵
  PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw.manifest
  2⤵
  PID:1000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf
  2⤵
  PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\CRASHREPORTCLIENT.EXE-C297728D.pf
  2⤵
  PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-CF3441CE.pf
  2⤵
  PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-42C11B98.pf
  2⤵
  PID:1168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-5EAA410A.pf
  2⤵
  PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITELAUNCHER.EXE-AF00A2B5.pf
  2⤵
  PID:2472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\RUNDLL32.EXE-F264FACF.pf
  2⤵
  PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
  2⤵
  PID:1728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
  2⤵
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
  2⤵
  PID:2208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
  2⤵
  PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
  2⤵
  PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
  2⤵
  PID:824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
  2⤵
  PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\e4988bfc0f4c4c6596237473da200329.dat
  2⤵
  PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
  2⤵
  PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
  2⤵
  PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_0
  2⤵
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_1
  2⤵
  PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_2
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_3
  2⤵
  PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\9f9fe5b8b6d30293_0
  2⤵
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\e7a03ae0f25a578a_0
  2⤵
  PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\index-dir\the-real-index
  2⤵
  PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG
  2⤵
  PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG.old
  2⤵
  PID:1444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
  2⤵
  PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\000003.log
  2⤵
  PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\LOG
  2⤵
  PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\LOG
  2⤵
  PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Network Persistent State
  2⤵
  PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager
  2⤵
  PID:2628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager-journal
  2⤵
  PID:1192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\000003.log
  2⤵
  PID:2784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\LOG
  2⤵
  PID:2332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\000003.log
  2⤵
  PID:2436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG
  2⤵
  PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\TransportSecurity
  2⤵
  PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye
  2⤵
  PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport
  2⤵
  PID:1400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe
  2⤵
  PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache
  2⤵
  PID:1204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84
  2⤵
  PID:1452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK
  2⤵
  PID:316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\
  2⤵
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved
  2⤵
  PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config
  2⤵
  PID:1000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient
  2⤵
  PID:1568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor
  2⤵
  PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common
  2⤵
  PID:2024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics
  2⤵
  PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:2900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved
  2⤵
  PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config
  2⤵
  PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor
  2⤵
  PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs
  2⤵
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame
  2⤵
  PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
  2⤵
  PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329
  2⤵
  PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config
  2⤵
  PID:1112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
  2⤵
  PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8
  2⤵
  PID:1884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
  2⤵
  PID:1144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
  2⤵
  PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
  2⤵
  PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
  2⤵
  PID:296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
  2⤵
  PID:112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp
  2⤵
  PID:2096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap
  2⤵
  PID:680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS
  2⤵
  PID:1976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files
  2⤵
  PID:632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2
  2⤵
  PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS
  2⤵
  PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles
  2⤵
  PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\CosmeticBundleSeparateCosmetics
  2⤵
  PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBR
  2⤵
  PID:2136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBROptional
  2⤵
  PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreative
  2⤵
  PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreativeOptional
  2⤵
  PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEnd
  2⤵
  PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEndOptional
  2⤵
  PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCapture
  2⤵
  PID:2652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCaptureOptional
  2⤵
  PID:2480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.all
  2⤵
  PID:2508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.allOptional
  2⤵
  PID:2972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.de
  2⤵
  PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.deOptional
  2⤵
  PID:624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419
  2⤵
  PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419Optional
  2⤵
  PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ES
  2⤵
  PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ESOptional
  2⤵
  PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.fr
  2⤵
  PID:1852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.frOptional
  2⤵
  PID:1448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.it
  2⤵
  PID:2368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.itOptional
  2⤵
  PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.pl
  2⤵
  PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.plOptional
  2⤵
  PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ru
  2⤵
  PID:2240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ruOptional
  2⤵
  PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CN
  2⤵
  PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CNOptional
  2⤵
  PID:1972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup
  2⤵
  PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\StartupOptional
  2⤵
  PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache
  2⤵
  PID:952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw
  2⤵
  PID:904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles
  2⤵
  PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\CosmeticBundleSeparateCosmetics
  2⤵
  PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBR
  2⤵
  PID:1676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBROptional
  2⤵
  PID:2060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreative
  2⤵
  PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreativeOptional
  2⤵
  PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEnd
  2⤵
  PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEndOptional
  2⤵
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCapture
  2⤵
  PID:1556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCaptureOptional
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.all
  2⤵
  PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.allOptional
  2⤵
  PID:748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.de
  2⤵
  PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.deOptional
  2⤵
  PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419
  2⤵
  PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419Optional
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ES
  2⤵
  PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ESOptional
  2⤵
  PID:788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.fr
  2⤵
  PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.frOptional
  2⤵
  PID:1472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.it
  2⤵
  PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.itOptional
  2⤵
  PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.pl
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.plOptional
  2⤵
  PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ru
  2⤵
  PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ruOptional
  2⤵
  PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CN
  2⤵
  PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CNOptional
  2⤵
  PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\StartupOptional
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
  2⤵
  PID:2052
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
    3⤵
    PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
  2⤵
  PID:2408
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
    3⤵
    PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
  2⤵
  PID:752
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
    3⤵
    PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
  2⤵
  PID:1452
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
    3⤵
    PID:988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.etl
  2⤵
  PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.log
  2⤵
  PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.temp
  2⤵
  PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.dmp
  2⤵
  PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.chk
  2⤵
  PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bup
  2⤵
  PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bac
  2⤵
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bak
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.old
  2⤵
  PID:1664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
  2⤵
  PID:352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\a1acda587b3e4c7b87df4eb11fece3c0.dat
  2⤵
  PID:1676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\a1acda587b3e4c7b87df4eb11fece3c0.dat
  2⤵
  PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000067
  2⤵
  PID:1884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Intel\ShaderCache\EpicGamesLauncher_1
  2⤵
  PID:1144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
  2⤵
  PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
  2⤵
  PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.epicgames.com_0.localstorage
  2⤵
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases
  2⤵
  PID:112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
  2⤵
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
  2⤵
  PID:2152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
  2⤵
  PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
  2⤵
  PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
  2⤵
  PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
  2⤵
  PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
  2⤵
  PID:1588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004d
  2⤵
  PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage
  2⤵
  PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004e
  2⤵
  PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004f
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000050
  2⤵
  PID:2204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000051
  2⤵
  PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000052
  2⤵
  PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000053
  2⤵
  PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\
  2⤵
  PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\47343f26116f49d1a460ad740dc2bbbb\ClientSettings.Sav
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
  2⤵
  PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye
  2⤵
  PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys
  2⤵
  PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\CommonFiles\BattlEye\BEDaisy.sys\
  2⤵
  PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat
  2⤵
  PID:1012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys
  2⤵
  PID:1984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Engine\Programs\CrashReportClient\Config\DefaultEngine.ini
  2⤵
  PID:1448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\VaultCache
  2⤵
  PID:1228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32
  2⤵
  PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32\
  2⤵
  PID:2044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Base.ini
  2⤵
  PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseGame.ini
  2⤵
  PID:992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseInput.ini
  2⤵
  PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\BaseWindowsLightmass.ini
  2⤵
  PID:1168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\WindowsGame.ini
  2⤵
  PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Portal\Config\UserLightmass.ini
  2⤵
  PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Engine\Config\BaseHardware.ini
  2⤵
  PID:184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\NotForLicensees\Windows\WindowsHardware.ini
  2⤵
  PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\UserScalability.ini
  2⤵
  PID:2232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\CMS
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\EMS
  2⤵
  PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Config\NoRedist\Windows\ShippableWindowsGameUserSettings.ini
  2⤵
  PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\CurveEditorTools\AssetRegistry.bin
  2⤵
  PID:892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CryptoKeys\AssetRegistry.bin
  2⤵
  PID:864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CurveEditorTools\AssetRegistry.bin
  2⤵
  PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local
  2⤵
  PID:1084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files
  2⤵
  PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files:VersionCache
  2⤵
  PID:328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\SharedFiles:VersionCache
  2⤵
  PID:1876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\XSettings.Sav
  2⤵
  PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS
  2⤵
  PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Epic\EpicGamesLauncher\Data\EMS\stage
  2⤵
  PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:2984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
  2⤵
  PID:3024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\d945f059b8b54aa58202ed2989bebfc8
  2⤵
  PID:2176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config
  2⤵
  PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
  2⤵
  PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-AED3596C4ADFAC4DB9E422A6546810D3
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
  2⤵
  PID:2360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
  2⤵
  PID:2540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
  2⤵
  PID:2948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
  2⤵
  PID:1544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\
  2⤵
  PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame
  2⤵
  PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
  2⤵
  PID:2940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%Username%\AppData\Local\BattlEye
  2⤵
  PID:2336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\White.png
  2⤵
  PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:Program FilesEpic GamesFortniteFortniteGameBinariesWin64Shared Files
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Intermediate\Config\CoalescedSourceConfigs\PortalRegions.ini
  2⤵
  PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-72CCB9004D132462217ECE948BC03CBE\CrashReportClient.ini
  2⤵
  PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-E3661BE544621B07B291448442161091\CrashReportClient.ini
  2⤵
  PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
  2⤵
  PID:752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
  2⤵
  PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Engine.ini
  2⤵
  PID:1348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
  2⤵
  PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
  2⤵
  PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
  2⤵
  PID:1852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
  2⤵
  PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
  2⤵
  PID:2012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\PortalRegions.ini
  2⤵
  PID:1188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\65f6b08d488442e694b1e23d152d971e.dat
  2⤵
  PID:1016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\b371f0ee15b74eba84bd23830461130c.dat
  2⤵
  PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_65f6b08d488442e694b1e23d152d971e.dat
  2⤵
  PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_b371f0ee15b74eba84bd23830461130c.dat
  2⤵
  PID:2860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
  2⤵
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
  2⤵
  PID:1640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher_2.log
  2⤵
  PID:1740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_0
  2⤵
  PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_1
  2⤵
  PID:2728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_2
  2⤵
  PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_3
  2⤵
  PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
  2⤵
  PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000002
  2⤵
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000004
  2⤵
  PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000005
  2⤵
  PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000006
  2⤵
  PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000007
  2⤵
  PID:1788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000008
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000009
  2⤵
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000a
  2⤵
  PID:2152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000b
  2⤵
  PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000c
  2⤵
  PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000d
  2⤵
  PID:348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000e
  2⤵
  PID:3064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000f
  2⤵
  PID:1888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000010
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000011
  2⤵
  PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000012
  2⤵
  PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000013
  2⤵
  PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000014
  2⤵
  PID:2692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000015
  2⤵
  PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000016
  2⤵
  PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000017
  2⤵
  PID:2504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000018
  2⤵
  PID:2508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000019
  2⤵
  PID:2972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001a
  2⤵
  PID:624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001b
  2⤵
  PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001c
  2⤵
  PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001d
  2⤵
  PID:2492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001e
  2⤵
  PID:988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001f
  2⤵
  PID:1012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000020
  2⤵
  PID:1984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000021
  2⤵
  PID:1448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000022
  2⤵
  PID:1228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000023
  2⤵
  PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000024
  2⤵
  PID:2044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000025
  2⤵
  PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000026
  2⤵
  PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000027
  2⤵
  PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000028
  2⤵
  PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002b
  2⤵
  PID:2236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002c
  2⤵
  PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002d
  2⤵
  PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002e
  2⤵
  PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002f
  2⤵
  PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000030
  2⤵
  PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000031
  2⤵
  PID:340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000032
  2⤵
  PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000033
  2⤵
  PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000034
  2⤵
  PID:1144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000035
  2⤵
  PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000036
  2⤵
  PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000037
  2⤵
  PID:1556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000038
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000039
  2⤵
  PID:1512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003a
  2⤵
  PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003b
  2⤵
  PID:2936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003c
  2⤵
  PID:2516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003d
  2⤵
  PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003e
  2⤵
  PID:556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003f
  2⤵
  PID:2920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000040
  2⤵
  PID:788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000041
  2⤵
  PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000042
  2⤵
  PID:1472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000043
  2⤵
  PID:2588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000044
  2⤵
  PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000045
  2⤵
  PID:2460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046
  2⤵
  PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\index
  2⤵
  PID:2496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies
  2⤵
  PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies-journal
  2⤵
  PID:2484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
  2⤵
  PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db-journal
  2⤵
  PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_0
  2⤵
  PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_1
  2⤵
  PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_2
  2⤵
  PID:1464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_3
  2⤵
  PID:2492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\index
  2⤵
  PID:1452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\000003.log
  2⤵
  PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\CURRENT
  2⤵
  PID:2456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOCK
  2⤵
  PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG
  2⤵
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG.old
  2⤵
  PID:756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
  2⤵
  PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage
  2⤵
  PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage-journal
  2⤵
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
  2⤵
  PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage-journal
  2⤵
  PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager
  2⤵
  PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager-journal
  2⤵
  PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\fe0c4ca0c0cbe875_0
  2⤵
  PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\index
  2⤵
  PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\index-dir\the-real-index
  2⤵
  PID:2748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\779a3f11-745c-419e-bb8b-5b6f2e7e0547\index
  2⤵
  PID:824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\779a3f11-745c-419e-bb8b-5b6f2e7e0547\index-dir\the-real-index
  2⤵
  PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\4bbf414005652440_0
  2⤵
  PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\index
  2⤵
  PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\index-dir\the-real-index
  2⤵
  PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\0f02f0723dc027b2_0
  2⤵
  PID:1276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\8b79e197c1500c11_0
  2⤵
  PID:296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\a8a9373a71443d80_0
  2⤵
  PID:1488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\a8a9373a71443d80_1
  2⤵
  PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\be52f68b51029c9d_0
  2⤵
  PID:1976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\eda4eea3ffd63d3b_0
  2⤵
  PID:632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\eda4eea3ffd63d3b_1
  2⤵
  PID:2868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\index
  2⤵
  PID:1216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\index-dir\the-real-index
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\index.txt
  2⤵
  PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\000003.log
  2⤵
  PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\CURRENT
  2⤵
  PID:2136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOCK
  2⤵
  PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG
  2⤵
  PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG.old
  2⤵
  PID:1192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\MANIFEST-000001
  2⤵
  PID:2784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_0
  2⤵
  PID:2436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
  2⤵
  PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_0
  2⤵
  PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
  2⤵
  PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_0
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
  2⤵
  PID:1240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_0
  2⤵
  PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
  2⤵
  PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0
  2⤵
  PID:1480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
  2⤵
  PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_0
  2⤵
  PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
  2⤵
  PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_0
  2⤵
  PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
  2⤵
  PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\fa813c9ad67834ac_0
  2⤵
  PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index
  2⤵
  PID:2084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index
  2⤵
  PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Visited Links
  2⤵
  PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\65f6b08d488442e694b1e23d152d971e\ClientSettings.Sav
  2⤵
  PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-FA58D227408B75B949C1ECA1ABE0D4C7\CrashReportClient.ini
  2⤵
  PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
  2⤵
  PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\UnsavedReplay-2020.06.08-22.56.55.replay
  2⤵
  PID:484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
  2⤵
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
  2⤵
  PID:1640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\CacheAccess.json
  2⤵
  PID:1740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\data.dat
  2⤵
  PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\tokens.dat
  2⤵
  PID:1676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\cache\cache.dat
  2⤵
  PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\Public\Libraries\desktop.ini
  2⤵
  PID:1884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\ntuser.pol
  2⤵
  PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\Default\NTUSER.DAT
  2⤵
  PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
  2⤵
  PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\keyboard.pnf
  2⤵
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\netrasa.pnf
  2⤵
  PID:112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\netavpna.pnf
  2⤵
  PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\keyboard.inf_loc
  2⤵
  PID:748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\keyboard.inf_loc
  2⤵
  PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\keyboard.inf_loc
  2⤵
  PID:1924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\bthpan.inf_loc
  2⤵
  PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\bthpan.inf_loc
  2⤵
  PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\bthpan.inf_loc
  2⤵
  PID:2348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\netvwifimp.inf_loc
  2⤵
  PID:3064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\netvwifimp.inf_loc
  2⤵
  PID:1888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\netvwifimp.inf_loc
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\b57nd60a.inf_loc
  2⤵
  PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\b57nd60a.inf_loc
  2⤵
  PID:2548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\b57nd60a.inf_loc
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\data.dat
  2⤵
  PID:2332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\tokens.dat
  2⤵
  PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\cache\cache.dat
  2⤵
  PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\Public\Libraries\desktop.ini
  2⤵
  PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\ntuser.pol
  2⤵
  PID:1504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\Default\NTUSER.DAT
  2⤵
  PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
  2⤵
  PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\data.dat
  2⤵
  PID:1204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\tokens.dat
  2⤵
  PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\cache\cache.dat
  2⤵
  PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Users\Public\Libraries\desktop.ini
  2⤵
  PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\ntuser.pol
  2⤵
  PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Users\Default\NTUSER.DAT
  2⤵
  PID:940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
  2⤵
  PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\data.dat
  2⤵
  PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\tokens.dat
  2⤵
  PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\cache\cache.dat
  2⤵
  PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Users\Public\Libraries\desktop.ini
  2⤵
  PID:1152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\ntuser.pol
  2⤵
  PID:108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Users\Default\NTUSER.DAT
  2⤵
  PID:792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
  2⤵
  PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
  2⤵
  PID:2228
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
    3⤵
    - Modifies registry key
    PID:484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
  2⤵
  PID:1632
- - C:\Windows\system32\reg.exe
    reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
    3⤵
    - Modifies registry key
    PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\BEService /f
  2⤵
  PID:580
- - C:\Windows\system32\reg.exe
    reg delete HKLM\system\ControlSet001\Services\BEService /f
    3⤵
    - Modifies registry key
    PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh winsock reset
  2⤵
  PID:1112
- - C:\Windows\system32\netsh.exe
    netsh winsock reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh winsock reset catalog
  2⤵
  PID:1712
- - C:\Windows\system32\netsh.exe
    netsh winsock reset catalog
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh int ip reset
  2⤵
  PID:2832
- - C:\Windows\system32\netsh.exe
    netsh int ip reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall reset
  2⤵
  PID:1332
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh int reset all
  2⤵
  PID:112
- - C:\Windows\system32\netsh.exe
    netsh int reset all
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh int ipv4 reset
  2⤵
  PID:1976
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh int ipv6 reset
  2⤵
  PID:984
- - C:\Windows\system32\netsh.exe
    netsh int ipv6 reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2⤵
  PID:556
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /renew
  2⤵
  PID:2324
- - C:\Windows\system32\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:2056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /flushdns
  2⤵
  PID:2580
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:2628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\INF
  2⤵
  - Drops file in Windows directory
  PID:2476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
  2⤵
  PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\Public\Documents
  2⤵
  PID:2652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
  2⤵
  PID:2480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\temp
  2⤵
  PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:1492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
  2⤵
  PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:1152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:1776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Temp
  2⤵
  PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
  2⤵
  PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
  2⤵
  PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History
  2⤵
  PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\Intel
  2⤵
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
  2⤵
  PID:1276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
  2⤵
  PID:1556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:3052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\INF
  2⤵
  PID:748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
  2⤵
  PID:2120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\Public\Documents
  2⤵
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
  2⤵
  PID:2688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:1672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\temp
  2⤵
  PID:2136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:3064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:2628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:1192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
  2⤵
  PID:2436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:1240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:1480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:1516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:1852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Temp
  2⤵
  PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
  2⤵
  PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
  2⤵
  PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\History
  2⤵
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\Intel
  2⤵
  PID:2268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
  2⤵
  PID:2456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
  2⤵
  PID:2884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\INF
  2⤵
  PID:480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
  2⤵
  PID:1724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\Public\Documents
  2⤵
  PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\Prefetch
  2⤵
  PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:2264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\temp
  2⤵
  PID:1408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:1876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:1488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:2516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\Prefetch
  2⤵
  PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q E:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:2988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q E:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:2372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:1544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Temp
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
  2⤵
  PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
  2⤵
  PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\History
  2⤵
  PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\Intel
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
  2⤵
  PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
  2⤵
  PID:1396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\INF
  2⤵
  PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
  2⤵
  PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\Public\Documents
  2⤵
  PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\Prefetch
  2⤵
  PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:2788
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\temp
  2⤵
  PID:792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\Prefetch
  2⤵
  PID:1740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q F:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q F:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:1112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:2396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:1832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:1488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:2516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:3024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Temp
  2⤵
  PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
  2⤵
  PID:556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\History
  2⤵
  PID:2324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\Intel
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
  2⤵
  PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
  2⤵
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Temp
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /q /s %systemdrive%\$Recycle.Bin >nul 2>&1
  2⤵
  PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /q /s d:\$Recycle.Bin >nul 2>&1
  2⤵
  PID:2504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /q /s e:\$Recycle.Bin >nul 2>&1
  2⤵
  PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /q /s f:\$Recycle.Bin >nul 2>&1
  2⤵
  PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\servicing\InboxFodMetadataCache
  2⤵
  PID:2256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete
  2⤵
  PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\INF
  2⤵
  - Drops file in Windows directory
  PID:316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\%username%\Microsoft\XboxLive\NSALCache
  2⤵
  PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
  2⤵
  PID:1452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:1560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:1448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\temp
  2⤵
  PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Logs
  2⤵
  PID:1552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:2072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:1416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:2212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
  2⤵
  PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\USOShared\Logs
  2⤵
  PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:2064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:1632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:1040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:2728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:1076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:2960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:2224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:1144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir / s / q %systemdrive%\Users\%username%\AppData\Local\Temp
  2⤵
  PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:1716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\INF
  2⤵
  - Drops file in Windows directory
  PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\%username%\Microsoft\XboxLive
  2⤵
  PID:2868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\Public\Documents
  2⤵
  PID:848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
  2⤵
  PID:680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:1444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:1440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\temp
  2⤵
  PID:1468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:2476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:2332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
  2⤵
  PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:2888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\XboxLive\*.*
  2⤵
  PID:832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:2004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:2024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Temp
  2⤵
  PID:992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
  2⤵
  PID:2220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
  2⤵
  PID:1916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IEDownloadHistory
  2⤵
  PID:2668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatUaCache
  2⤵
  PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatCache
  2⤵
  PID:820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\DNTException
  2⤵
  PID:2232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE
  2⤵
  PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History
  2⤵
  PID:1768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History\Low
  2⤵
  PID:952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState
  2⤵
  PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0
  2⤵
  PID:1084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState
  2⤵
  PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3
  2⤵
  PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\Intel
  2⤵
  PID:2836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
  2⤵
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds Cache
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds Cache
  2⤵
  PID:296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngine
  2⤵
  PID:112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\UnrealEngineLauncher
  2⤵
  PID:632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD
  2⤵
  PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\INTEL
  2⤵
  PID:2620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\ntuser.ini
  2⤵
  PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache
  2⤵
  PID:2104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\system Volume Information\IndexerVolumeGuid
  2⤵
  PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\CLR_v4.0
  2⤵
  PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\CLR_v3.0
  2⤵
  PID:1888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Internet Explorer\Recovery
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds
  2⤵
  PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Windows\system32\restore\MachineGuid.txt
  2⤵
  PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\ProgramData\Microsoft\Windows\WER
  2⤵
  PID:1192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\Public\Libraries
  2⤵
  PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\MSOCache
  2⤵
  PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache
  2⤵
  PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  2⤵
  PID:1504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\ConnectedDevicesPlatform\L.%username%\ActivitiesCache.db-wal
  2⤵
  PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
  2⤵
  PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:1784
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\USOShared\Logs\User
  2⤵
  PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp
  2⤵
  PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\cache\qtshadercache
  2⤵
  PID:1868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\UsrClass.dat.log2
  2⤵
  PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\VkCache
  2⤵
  PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\CN\NewsFeed
  2⤵
  PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE\RHKRUA8J
  2⤵
  PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs
  2⤵
  PID:1564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Temp
  2⤵
  PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp
  2⤵
  PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:1916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
  2⤵
  PID:2668
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
    3⤵
    - Modifies registry key
    PID:1108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
  2⤵
  PID:988
- - C:\Windows\system32\reg.exe
    reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
    3⤵
    - Modifies registry key
    PID:2228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\BEService /f
  2⤵
  PID:1632
- - C:\Windows\system32\reg.exe
    reg delete HKLM\system\ControlSet001\Services\BEService /f
    3⤵
    - Modifies registry key
    PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
  2⤵
  PID:580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\INF
  2⤵
  - Drops file in Windows directory
  PID:908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
  2⤵
  PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\Public\Documents
  2⤵
  PID:2124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
  2⤵
  PID:408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\D3DSCache
  2⤵
  PID:3048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\temp
  2⤵
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
  2⤵
  PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\SoftwareDistribution\DataStore\Logs
  2⤵
  PID:1276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\Microsoft\Windows\WER\Temp
  2⤵
  PID:2096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\AMD\DxCache
  2⤵
  PID:1512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation
  2⤵
  PID:748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
  2⤵
  PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
  2⤵
  PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
  2⤵
  PID:2108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
  2⤵
  PID:3008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
  2⤵
  PID:3044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
  2⤵
  PID:2056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\EasyAntiCheat
  2⤵
  PID:2540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
  2⤵
  PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
  2⤵
  PID:1544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
  2⤵
  PID:1628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Temp
  2⤵
  PID:2444

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1713700215-2112434450-102950196-843545828159999586499856157512444795111183799680"
1⤵
PID:2172

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "278983818213067418311561414261429566466144653431-776506905-759865316444596692"
1⤵
PID:1588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-69406664612474294884703388471301514338176178431947267264166807158491154576"
1⤵
PID:2156

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1347441196-1209772791089752315485214601083730094-1973123619567288219-620322661"
1⤵
PID:2204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "596871346208670057311554960472135337962-916651003-993265106518318838-80277275"
1⤵
PID:992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-455388355142956269552890206117598416384736343645698066241184604552-1487610866"
1⤵
PID:1188

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "821074493-1908700081515132779783230149575132103584399341843121201221090264"
1⤵
PID:1016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "953817701-162887127816974449461613083759278152575-8511284561416845911405537239"
1⤵
PID:2016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4798468461174280732217561829365622388-1025057199-537802837303191527210904591"
1⤵
PID:2728

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1098361336-1532008845-963811682063528454-1349948411512367541618002825-1105627827"
1⤵
PID:408

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-799441550-11859535707171392721150579583-1576704398-15779256284658555971022128495"
1⤵
PID:3068

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "351115254-1895491931-1542199802587174180-17979085101276702566-5997755071770741493"
1⤵
PID:1064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1527944550-275158519135725511620606041479751382291815536323-1109097905678371458"
1⤵
PID:2152

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-957914397160746601-13223896721719304824-2021299871027921437-179853717733584391"
1⤵
PID:2108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-784571067-58600700-83875906420472245011343480349130751592019508880951050748708"
1⤵
PID:2292

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1609706193-537983850-1285351205-148847743663268125514468053461546129829778350267"
1⤵
PID:2692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1030842392656134521-117361041-7085637232282359211551700440491492044-151539601"
1⤵
PID:2428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-150896606-950971654-373443625-1112612939-1935347410-893290095-2599022201457497970"
1⤵
PID:2940

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "887166156818109365-166574592696786886515775036251088356068-803507605-1184424438"
1⤵
PID:2716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1319665629-283650756-7719733371825016360-1574935687865910231-1836191541-193452476"
1⤵
PID:1576

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "172058166412535200301185336619-16078762481103096933-388315351962154398-539381564"
1⤵
PID:1348

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1132310721-6383365187457427391623330330-388014460-7047292104068289103075309"
1⤵
PID:1448

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-476218511-381787433-147623131611033449291368385486-165536895-1983219106398629476"
1⤵
PID:2792

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1935447974-20102531271766756082-1645921181-1616496377769190800-1895194053-803340790"
1⤵
PID:1524

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11551361387487394701955980394-2059146835-380863984-1666218057-1042658007314796503"
1⤵
PID:1440

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1638839066-1357968021-1644423668-594765867-1220469470-2053626687-400860338567719779"
1⤵
PID:2360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-209259481463437317-20092142557517020111166427798-1089872746-1355144023550215338"
1⤵
PID:2540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1517433640-12805792091980774630402728265-20838054631084443407-11621040181287647328"
1⤵
PID:2948

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "182884527719095826154655210287911751321924211220-530209204-1797039446-455640507"
1⤵
PID:2488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "817545825-1151875255-1987835798-89353656-1561273158-17485919097016546891204513752"
1⤵
PID:2340

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-49950041311497229761219705459-11166891682088869299-709855061-611767267-1218282600"
1⤵
PID:2888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-416143882-3471437711357520961-1833994604-130816354116906328896609990221941128872"
1⤵
PID:1244

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-79483592-104930045890998789909545768737857596-101420074412796141-902202060"
1⤵
PID:1988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "979271079-1110639483-1824618871-153686100105177476328512494-1521701494485035107"
1⤵
PID:2532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1120840449-2063454529381104262-1485194662-557435388616004247-128676769293744298"
1⤵
PID:864

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1587686144-183206139-5528838941496484583-1499952904-1151381900-1130832006-1042650347"
1⤵
PID:2772

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2001160484179349598614998408842026833396-4232104481607921651-652511261-216612600"
1⤵
PID:2660

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1243606558-50479961414813806961805967011-624590658-2045171564-1783203641105874643"
1⤵
PID:2992

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1628220299-750594580-1192062292-183110588-944239868516730320483344691768091372"
1⤵
PID:2332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-927145153-1760657155875604869-21371437521402991031910726042-1820269122331160321"
1⤵
PID:1504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-48591058-552888850-551865293-190526856-3810416071977009690-764934315-523446126"
1⤵
PID:1204

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2043385298113135131-1206882090933685588-2039780613877090788602274932-141915524"
1⤵
PID:1656

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "650356798-2097459323-407641004-15287892401480526690-119905439210002577391838502939"
1⤵
PID:940

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "15322788411070452812187298722915772380301522657299-686837659775975516-565463141"
1⤵
PID:756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-15358529-1267824639-4391048711717333312739920091-4307306107756602041713425220"
1⤵
PID:2012

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1030521516-364015144-1203140717-1025741653-1989075438-603553079-444515792-483841490"
1⤵
PID:2064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-865177824205326938910097868469976387861752260571-1368268041-137912598-1639578122"
1⤵
PID:2228

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "630611406424281123-8503174591202145127233195216-148500073582324865-869108136"
1⤵
PID:1740

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-562552421-30765547320589809771964692752157162048717635631682030890603-593368642"
1⤵
PID:352

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1751258783928704656-8741519559872799437804161319488541511156193517-1640265"
1⤵
PID:2124

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "889117733840662944-550998750-9649959371884187505205791473210064968241973043658"
1⤵
PID:2404

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "833484298129267749694548964087369082611474922672841807862110360896242045062"
1⤵
PID:1144

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5399253451058615387-865820594278504192-1286078435-1612378460957209939-593962110"
1⤵
PID:324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14920318922101911177-1545401239-7399975491350705463-904669977-1673646162581319880"
1⤵
PID:2932

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14330469962004015759-1527459005963805284-1384169822-5751417474536059931329976893"
1⤵
PID:2984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "40629486-44961986219944102291705705423147359125-13353082637678860951203270970"
1⤵
PID:3024

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1368066822-468358738-1468370713-1441955005917517859-1153735010-967908714-1803227096"
1⤵
PID:3008

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "527674595-828932304548011355-3323896751290417401-1046338768-19755273531608114508"
1⤵
PID:3044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16527424544340506939852073921929655346179359587-264774424-11486785-1317368386"
1⤵
PID:2056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "11662972108858791391520284259779460320497303982-135235781816637960722051644616"
1⤵
PID:2768

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1005404776-113986539610848682771740998881-17708767758528966155061809831866678105"
1⤵
PID:1960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1722164611689850665-406505143963034769-89421456794734019-466836306-1538764992"
1⤵
PID:2460

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "232864330-14230045036831271561223196440-544201308-1764297753-1105734081-1550058635"
1⤵
PID:2544

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1319032430-1344147631427093047-3443926801894638354280614388776549120-716265947"
1⤵
PID:2496

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2063695493-680433445324748001-681246487-1953313438-652679944-49184787-1634441463"
1⤵
PID:2552

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1495053429-1311299864-644450907-877053927-7552855041803198827-1395951335980431534"
1⤵
PID:2484

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1458342329-1432276459415323527-15533338961655044837171420588-1000162664660871695"
1⤵
PID:2256

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-152014325-204109261913687931341420450909-50305910685993080-1087278861397604870"
1⤵
PID:2912

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1083547207143325600114057853521442085641581704130744162896-1172154021-978087679"
1⤵
PID:2732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6223319861306526651-1420097214906443621268206352685394775-6214937542098488108"
1⤵
PID:1464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "223420332555085393-334421142614092397-1022286812-7792887931294567724-1928266135"
1⤵
PID:2764

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-359699348-2106176003-1942738236-2078639160-906608797-372689199-1004845675753279399"
1⤵
PID:1452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1706707161-919777278-1100153-6409550591922509650-145441564-1350204559-354394407"
1⤵
PID:1520

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-6926890820429073613596063121476907060202039608513630280881116507132-116816670"
1⤵
PID:2328

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13956542341711285708-1209903184138042061016924650171636520961664855584-272946050"
1⤵
PID:1496

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1855140827378426365-1097061466209432073-2033109680-1533097730-10852988541861512897"
1⤵
PID:2044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-450973712191589349-459154722-8587006881158477307-652527137330867965-1127833145"
1⤵
PID:2336

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1034851098-12175909522014289471-103976122-161679920319535879136115604321014786961"
1⤵
PID:1168

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13796587211859918418127663650-1529867644-327486085-539059154-2138975789-1763316289"
1⤵
PID:2860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1527368926-16992918127824539-1079078269-1716710919-11481384952046170356-370778377"
1⤵
PID:692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19383848061101876801-1895628049-11000728021210317348-12798833512312364931080973178"
1⤵
PID:1776

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "15499294531190196488-1710217930-1898017622-17089707101732187143574815771-1303416204"
1⤵
PID:340

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20899340711549232906-1643847162-128415031-9462876086894815541969064552836229422"
1⤵
PID:2160

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1338377372-400671263-1856689073-98881218-1154236998-1460560721-2082579715-1020698979"
1⤵
PID:3048

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-622804081533158826-1827653164870164838869601877-364930197-15448749541528414882"
1⤵
PID:2836

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9732230171944245020673287559-1051592366-275167162-1732529223-1734537079-180032437"
1⤵
PID:2816

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-474210277369283645143071083-17285815701817155972-867840421-11922641411643638737"
1⤵
PID:1276

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3895180751918545745-380178676-1007675796727802741696054515736966041063075321"
1⤵
PID:2096

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19174006351261418934-1077448403-1739106179-548360499-230917397-17043194741967749815"
1⤵
PID:1788

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-154149824353525096327966482-205782286221435588841780628008-1081213697-1207149806"
1⤵
PID:2152

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1259386102-285696909-768299162-2419445685913348197735482471975340199-699835040"
1⤵
PID:848

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "118666811820210962631893451217-1046780025-307734101-120647084565113207462850409"
1⤵
PID:2688

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1059783301209589238125980298-18203155451782713205-18339679531158035737-1191610359"
1⤵
PID:2944

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "413680504-513006338213437260-5032922571679749850-328598477-1642195452-668066194"
1⤵
PID:2348

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "319338013664526402954242870777327415569010328-1083196270506236950-1107509278"
1⤵
PID:3064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2044076012927991313-1140988483-63534346-12506690211513404259-15367407081658770011"
1⤵
PID:1472

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-709505793-343325528253587835-103729616824726776-12421633131403418984-2076579439"
1⤵
PID:2436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4465945541760271678255086247-2007020400-1145886773-1386760891174754729-1052083130"
1⤵
PID:2892

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-799204352-1620578470-85613912-255695055-6947005251270160570-858461826748279029"
1⤵
PID:840

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1628780730-1856099653-13568672515830846215434101781125644101-5151858671118223096"
1⤵
PID:2112

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2137192637279105351848096359-531186227785312923-9619156837793020741047534055"
1⤵
PID:2712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10775071364445525971799383917207077867-4176993981715461462-2020727676477171676"
1⤵
PID:1516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "64398922641914600616547844731491153781-215467791-754267935-19521369931703929065"
1⤵
PID:1428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-656536338-1764292897943815603-1232577591-13417143471713062268-19574579711772564019"
1⤵
PID:1436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13491175581141524712-10216209501535639819-23543214-1345513098-14218931021102367125"
1⤵
PID:1540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "27975969166423133119883468502115624452-437099102-1176038415-1520485681337360144"
1⤵
PID:1596

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6799496081610484013527375964-715788598138763388477812071197888607-1091953979"
1⤵
PID:1152

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "717372018-3512342961424396412-1299697757-2089213789190835820520136267762035286840"
1⤵
PID:844

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-72878509-1304242939-15111223052046866205529900133422013782-907575632-356031253"
1⤵
PID:2236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1838867391185214496-1716281861382488270-1584163180-36754098891955146-1436739548"
1⤵
PID:1620

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-918345631539949592-570382643-929267145-372035588918010092-8561821251359169033"
1⤵
PID:908

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1585871692-1851090775344740363-1121161848-779314438-4036290951483736365-741699297"
1⤵
PID:2288

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-72444820650784236-20567704601067642955709793110-182853025117277459341957553579"
1⤵
PID:2756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "492372666-1886477145-7277448407610327851266016290-1198328462-476323798-900827391"
1⤵
PID:296

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-183189681675253666-171494209-184210296988790635211922596771368015456-1201367930"
1⤵
PID:2772

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "70629719323624102218501977-1938164253-226096160-1045864946-589743505-1535893830"
1⤵
PID:1288

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1598739641761840591192753534210865449431516864744-1757360396-8916504061439662574"
1⤵
PID:2936

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2070683829-10059407151081671361405415433-1134476071129865300-11556498751377973382"
1⤵
PID:1216

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1929040172-10222859982189238041224887047219281047-1479243553-1763303905685124812"
1⤵
PID:1580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1293023882-16747925491126746839-285652346-1977421386-667072474-102488795-777445295"
1⤵
PID:2136

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8252423-148094376310625399952021499857-402456286-4437085091117319722-1489448062"
1⤵
PID:3064

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1933402359169715937615495716225007272441767886963387491393-1275360763-868125609"
1⤵
PID:2628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-385729690-1874221746-9776493972091469436500849759-3284375151812104626-1821009428"
1⤵
PID:1192

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1071099307-4996186358501332877779306301173287977-1391153419964405449-1282704068"
1⤵
PID:2680

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "74656392-781719061-690858206-1225429278-15088181-102480631-14705961971721809655"
1⤵
PID:2652

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1064801930-21078285673099381191964095063-769753732-188560847127602799-1242003088"
1⤵
PID:2480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20409512631439881075-2105274785130155997910969565031736676341-10209390981254933798"
1⤵
PID:2896

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-49947115-20093742771889108369-53231195816058151132034572658-2000565309-232526758"
1⤵
PID:840

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-108327912815753181511477905438-719456771-1066165473-555998231-19875383041387130461"
1⤵
PID:2112

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1011053943-1628141325-731976781-10807595-142660093016284942101579238719-212092005"
1⤵
PID:1240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1561296831-284139897-1957085463-1370014610-1210281166-436977916-1756142164-1252037474"
1⤵
PID:2712

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1428480288-1907109467-209823678262657971628743391735604067133902305833228409"
1⤵
PID:1572

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "336899151696095136-147790818867389982313306505701191487914-18486357401331376138"
1⤵
PID:1428

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-172351728414135635331586688720-53136559219481456531817811629-1242699009183447072"
1⤵
PID:1436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1965633806-3813332242113356461-41894222014677311511817425259828343323-1591711924"
1⤵
PID:1540

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "36766168-13168057361844810882521937083-758242284-52702915810746674571656909357"
1⤵
PID:2776

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "53226888949920825-18177857111637739583905028480-99049787-341442398660860964"
1⤵
PID:1852

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1421549612-1131237716167733626-1372717970269178791862980625-1182056054-1942877950"
1⤵
PID:2268

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-261553276-11771364371940543893-1116280670-968965023-1377815138355396064-118769619"
1⤵
PID:2904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-196788122-1630635863-1443199708-957618016-4246316981364841017-890755931-173579011"
1⤵
PID:1944

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "800046172-4767263721588722362-243300602751994055-8545862111811608011880525390"
1⤵
PID:668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-872958023-1657382890-2136800180-2131212344-1788241935-3617440981721666897-667858811"
1⤵
PID:824

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1699575626883985139-17501698351156387945-3115072072140845084-2054531322-420290038"
1⤵
PID:1112

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1766231185-24125916917448439371739560551-198657370-1946047388-1430871442135923014"
1⤵
PID:2396

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1153886794-1203205812-98456240-2974034971194645649-201488633504689841-1743839469"
1⤵
PID:1832

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1651381335-11805854711975839038-2046183875-20428716916933085061304839262-119978960"
1⤵
PID:2832

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16067020822100295679-110094245-279702041-2093545485-1247049623-3676735902062012266"
1⤵
PID:1780

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-187310854814747950501830868061-16018162411935868279-841182473484153052530882463"
1⤵
PID:1332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-679678263-2137084547-4254522792001061769-1938480661-2040004554-328605215-53569598"
1⤵
PID:3000

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "7898517257621682897452361012007096621009671813-824993501-1098396811-1160808533"
1⤵
PID:984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12100785321031076223-772176374-1621981657-1667096084-158038287364948613-1438757846"
1⤵
PID:556

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-7725117046425057974135668481795242280-2139327152-3092340-8223135021097156901"
1⤵
PID:2324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1075794367907070784-13595351121806953502-1293113146111679483-1954465010-376264592"
1⤵
PID:1612

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-306793926-1169622947-908272746-432885082-326039172298121401180210898-392260169"
1⤵
PID:536

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-128446992-1790108031774638921768517887-1027187619-15868549-336093683-2047740607"
1⤵
PID:2436

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1405662174105208349-17763345321277097566-13140858233168675539567013251664690880"
1⤵
PID:2892

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1899510845221994741899639875-194317269418891667861635650650-1664120666-2133783358"
1⤵
PID:1516

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-489441888-947189106-11795157941188608516-933037192-1052361912691581094400235346"
1⤵
PID:108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-754657071409470238-1909948028-9758579951994971767-13968101162146651942128505059"
1⤵
PID:2884

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1055652780-257072806735460964313657010132363834030233019510034979981775005887"
1⤵
PID:2016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3021408321836293579482714931-564701175-1775112521-2140923237-382713750-1356085518"
1⤵
PID:784

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-40738384-1065115344-521049837543075159-721203350-471340351432104266-1335771543"
1⤵
PID:1076

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12255667220075720711032786869-84770773-1210015455-9748035061118077082-1336915503"
1⤵
PID:2960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "182777844620197086211632936309-1652555338-1916892152-4870589428792407642024012802"
1⤵
PID:2224

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1496274538-7651050451776528604-482940934-1391046291-1335134061-2016432876-617416609"
1⤵
PID:2756

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1389626465-10347461176941531561834094648130825686815391848341972144312-1727926885"
1⤵
PID:2828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-857664442935220504720276468-382187123789916021818160292518579367-547869709"
1⤵
PID:1144

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19119087191257996314-2844590119691396302193342521856157790-6746145671549537124"
1⤵
PID:324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "13879211988888601162299942739963338611506979028-1157638685-880228901500568912"
1⤵
PID:2512

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-682085131-253057351895443638-19721696641865036551-1840782443-36075098267544097"
1⤵
PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1406410577-968388989-176799226-2126543227-140884618312276064655687165711201049930"
1⤵
PID:980

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11417016671625324304-1802534438-3933717001600175652593595601155146644886456763"
1⤵
PID:3024

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "98715169414949636888878770011539657389-211712552455801131016503795971108761293"
1⤵
PID:1468

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "4181182692011756032-147426097116114914484289435861682449728-1833358748-302659584"
1⤵
PID:2380

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "890532194-1453034835-33655857016880475081962461178-76798741517133510611421361531"
1⤵
PID:1544

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12637504993925493451716245745426383120554299785-1678987741-1609406212831053039"
1⤵
PID:1628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1357819176-2232777522617732141216731148-1832393754-1532923748309632321-956975858"
1⤵
PID:2444

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1696116605-1539933054-1253845857-806872945418360851-1804382451338109374208865208"
1⤵
PID:1244

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "147121122514013474-1011385799299028641-36461388-1659727857-409814620-1887664333"
1⤵
PID:108

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19880472459244595314696704581914592500-24218386582166824-1068451563-294594329"
1⤵
PID:668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1282619633-56939447-1004321623-134749659912887363981688091176-388345649376135695"
1⤵
PID:592

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-149781892-4769206469326621491742068691-270277770414545947-959621488-182609392"
1⤵
PID:1740

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1519059109-570781583-1014508925-890702037142482576134013261614031014342109129931"
1⤵
PID:2532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-241894269-16367992213321243891316108695305305256506464202560448712-116164855"
1⤵
PID:1084

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1261729015-829486650-527494720-702515939-678226198-12379815461519006723-551268463"
1⤵
PID:1332

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "105182456-139576154-1545844857-779568592-1468925604-645677318153024530-341761761"
1⤵
PID:2620

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-430410391459063633-501206810-968806895-195081551620958491111465322149163204115"
1⤵
PID:1668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1929530297-1009538975-2029752891-2837495131682836128-94774728-1797596393-1209620504"
1⤵
PID:2104

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-212613039514103968161356427432089612314-8355391801876564651-1170991400-1310451940"
1⤵
PID:2184

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-512318288-950685297-4729398327340759647142798-1261769772-1391591622-110401081"
1⤵
PID:2172

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-18548642211947875184-10287761511739875117123487856715223609111747653780-1316202284"
1⤵
PID:2324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-196443218-936013289-43725763817643864721238671728788127005-8381812941217837165"
1⤵
PID:1476

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "17110120702140403178-18269237575285851831312469083644387997-1883332222179904218"
1⤵
PID:2624

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-7208893071561640067161932161714382875979493569914096775071039934131-1085781854"
1⤵
PID:2672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1492924777-1195749762-1336701514-1742995921804975267-2398789311792223391084803053"
1⤵
PID:2180

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1628607267738878112174829288714133167071199059999-816482157-18572591351002740145"
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RECOVE~2.DAT

Filesize
5KB

MD5
83950d5e4d992cd9993c46ad04461e53

SHA1
b140cffeef2e29ef552dc267d81e5deda4b394b6

SHA256
68e4c99634964a89df4677d6a8573dfcf444afe7b8138e49f19964a3bac1b9aa

SHA512
7cb1194cbef39c197a9befea8ac54184df3951853a27ae112a1802d07d2462f7cb1006b9a21b63c15fbb0e85face00f133f1443a628b40d845404a6cc2c6c53a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{17246~1.DAT

Filesize
4KB

MD5
8287b63b26eab6df18cff79b0714c30b

SHA1
cf276a8c08164ddd1585ac6f1921dcff062ae3f5

SHA256
c378a7e4041af1d62610abf6c50b4a99172e0d6e8a92f3f62741f0a869e895f3

SHA512
5389924123b68796b7d0f24f4e7422ec735529dc821766caab11312125b56de1e6a568953dfaad647b6c4f7b745bd5cb8f7662f9b4c06ee34ebf2c9a95b7d9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{208AF~1.DAT

Filesize
3KB

MD5
dabe3d30247768b4c54947f429522dc7

SHA1
730db642abdc3c40f9c2dc64a3e96c81131f4dc5

SHA256
2e4c4290565d2553523a2a62326dd8c9232b9c1619735bac8e9ba7634497badd

SHA512
cf137f9cc9a6482108687644fd9baece7076f9854a9b7f1ce0809d20e254a213443b4a25d4ddc869d86cfcaffee439c5e0757accb318bb135f0b1d1e5ab757f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF0DEB95BCB81653F8.TMP

Filesize
16KB

MD5
dd2207cd0092e9e3c1c0e1a724c1a996

SHA1
2dbaccf66fe6c06af6f1ef3c25a0c237f39acf07

SHA256
11a51a49dbd186a978fe04f86eaa6a15d0dc3630921ad8777a5cf42ef1ebe81b

SHA512
c12c77533bd9eeb4a2db542367e07d18cb90da0670bdbfce26c5292325fd7f563d0d32efa85bca60ef0b346082e866d98de42de6e41bc32acd0e9c76f8fbd8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF0F9~1.TMP

Filesize
16KB

MD5
ad0eeeaa529839074bf7fec785ebd3ed

SHA1
322c8657505261f05a5755627cff3db88a3831f6

SHA256
ae1e3531445bf787280c40e6a9a9518f297eab3ef91454ccc06cc2daff33abf4

SHA512
77e111d5a682c9e4ed3824c18347dc2354e872ad8f7b7ee66f9b9b8d5ad7f0a0f96d9c781a44308c2d797f0dfced6146be2224774b0058ae03156fb5e6255df8

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF12B96BA66BFA5872.TMP

Filesize
16KB

MD5
2db0a3cb5cac85a6ecf3249fd37f0c07

SHA1
dcbebf8fc0b651906095cbaaf2e1d9cdb4c12cdc

SHA256
06122552513a04fd1cbb9a08347c94318e132516975257c26065a2d5f09ce5f4

SHA512
56ff1c46c82dbfb0a2412501f61228af44ef7bd46adfb09d0de29e25abcb0714463af1df4d8f0f2ce615d53d3941bc06b7852a0523c30ef99ca1512854488046

Download Submit
memory/2140-6-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-0-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-5-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-9-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-18-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-4-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-2-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-3-0x000000013F260000-0x000000013F984000-memory.dmp

Filesize
7.1MB

Download
memory/2140-1-0x0000000077060000-0x0000000077062000-memory.dmp

Filesize
8KB

Download