363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb

Analysis

max time kernel
100s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bitcheats_cleaner (1).exe
Size

2.5MB
MD5

24999353450c234c36cc2e0a74f75051
SHA1

3b716b36775bc53bd67c0786ed040628cbc926f9
SHA256

363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb
SHA512

1c0dfac601da714ffc0a3dcd5f6b1fbe95c7238177cbf3ab9551b833f5a062c717ab69ff206a7c9dee677b52cec1cb81efd4e36dc6af5fc195ab07e4e453d143
SSDEEP

49152:rabHjq7IZiuzkKECE95eHmRSW97qWOEhSI7o1U26TYtkY+toY:rabOUiujECE95eGRB718zgY4

Score

9^/10

evasion spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bitcheats_cleaner (1).exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bitcheats_cleaner (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bitcheats_cleaner (1).exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	bitcheats_cleaner (1).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3108-0-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-3-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-4-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-2-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-5-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-6-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-198-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida
behavioral2/memory/3108-212-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bitcheats_cleaner (1).exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3108	bitcheats_cleaner (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe
3108	bitcheats_cleaner (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3108	bitcheats_cleaner (1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 1348	3108	bitcheats_cleaner (1).exe	86
PID 3108 wrote to memory of 1348	3108	bitcheats_cleaner (1).exe	86
PID 1348 wrote to memory of 2476	1348	msedge.exe	87
PID 1348 wrote to memory of 2476	1348	msedge.exe	87
PID 3108 wrote to memory of 3336	3108	bitcheats_cleaner (1).exe	89
PID 3108 wrote to memory of 3336	3108	bitcheats_cleaner (1).exe	89
PID 3108 wrote to memory of 536	3108	bitcheats_cleaner (1).exe	112
PID 3108 wrote to memory of 536	3108	bitcheats_cleaner (1).exe	112
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 4464	1348	msedge.exe	93
PID 1348 wrote to memory of 3584	1348	msedge.exe	94
PID 1348 wrote to memory of 3584	1348	msedge.exe	94
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95
PID 1348 wrote to memory of 1420	1348	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner (1).exe
"C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bitcheats.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff899ff46f8,0x7ff899ff4708,0x7ff899ff4718
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1825265732385523312,6459425180977548976,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1825265732385523312,6459425180977548976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1825265732385523312,6459425180977548976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1825265732385523312,6459425180977548976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1825265732385523312,6459425180977548976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\
  2⤵
  PID:3336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History\
  2⤵
  PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\
  2⤵
  PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\
  2⤵
  PID:3752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Temp\
  2⤵
  PID:4588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\
  2⤵
  PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Temp\
  2⤵
  PID:644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
  2⤵
  PID:724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService_fn.exe
  2⤵
  PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe\gpa.bin
  2⤵
  PID:32
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451b49097cdafa85ec0f45214d6b0df9e8d.bin
  2⤵
  PID:3148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451e900a9bc20b57cd2f45214d6b0df9e8d.bin
  2⤵
  PID:260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64\Version 2.1 AMD-APP (3380.6).Ellesmere.cache
  2⤵
  PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.idx
  2⤵
  PID:3944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.lock
  2⤵
  PID:3652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.val
  2⤵
  PID:2352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\f_00010e
  2⤵
  PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000036.log
  2⤵
  PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000038.ldb
  2⤵
  PID:3520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG.old
  2⤵
  PID:4304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_12856.log
  2⤵
  PID:3180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\171cac9.tmp
  2⤵
  PID:1608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient\Manifest.ini
  2⤵
  PID:2504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor\Manifest.ini
  2⤵
  PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics\8E1D46DBC38F4A789939D781E1B91520
  2⤵
  PID:1076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor\Engine.ini
  2⤵
  PID:968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs\CrashReportClient.log
  2⤵
  PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329\ClientSettings.Sav
  2⤵
  PID:4476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\ClientSettings.Sav
  2⤵
  PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8\CrashReportClient.ini
  2⤵
  PID:3140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
  2⤵
  PID:1324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
  2⤵
  PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
  2⤵
  PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteLauncher.log
  2⤵
  PID:812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap\TempFileURLMappings.urlmap
  2⤵
  PID:3460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\DownloadCache.json
  2⤵
  PID:3536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\08B44835D9E8B3BEDFB49C3650F634FF11B74454.jpeg
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\1773DBBF630BAD44B34734176DD5D03F2E6F4D78.png
  2⤵
  PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\86F7F05520A581636CEBF3AD1BD5C4383AE77494.png
  2⤵
  PID:3944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\88271B0993D67835C1C89BF7D1B9A1E5ED989F06.jpg
  2⤵
  PID:724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B666DE51F8E930A8A99CB03C4454727680759203.jpg
  2⤵
  PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B6D962B44AD39D2129B4A96DB8C24DFF6A98D213.jpeg
  2⤵
  PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\D04ECBD1A835D9714A6F6D279077C15B2FCEDBEF.jpeg
  2⤵
  PID:3124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\EA7CDAA7AF5B1335517D581803C34BB2394218D1.png
  2⤵
  PID:3520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\ED43DE88DA78F8F4D6645415A7FC446EAE3BD5B8.jpeg
  2⤵
  PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0bef34491af34fc584b687e433656e90
  2⤵
  PID:3728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0ef043433c754e0588525283cacda0ab
  2⤵
  PID:1412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\1492c7f2588940848a4920cdff4e69d7
  2⤵
  PID:4564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\20334c6a270641c0835bed15d9cde4ea
  2⤵
  PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\3460cbe1c57d4a838ace32951a4d7171
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\6dea1559a81c4b18864782deeba57a83
  2⤵
  PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\7e2a66ce68554814b1bd0aa14351cd71
  2⤵
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\8b616e78d2674a3e92157d40df1d4cda
  2⤵
  PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\a22d837b6a2b46349421259c0a5411bf
  2⤵
  PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b4b8bebcb5e84d86b11ebb7bb989d88f
  2⤵
  PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b6c60402a72e4081a6a47c641371c19f
  2⤵
  PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b800b911053c4906a5bd399f46ae0055
  2⤵
  PID:3544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\be84cc30e34142d293ed27d15522b62c
  2⤵
  PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c52c1f9246eb48ce9dade87be5a66f29
  2⤵
  PID:1016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c7dee411e20a44ab930f841e8d206b1b
  2⤵
  PID:3900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\f2f660d7855c45fdbb7922edda562a60
  2⤵
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\ManifestArchive.journal
  2⤵
  PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup\BuildIdentity.txt
  2⤵
  PID:3364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw\Full.ini
  2⤵
  PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw.manifest
  2⤵
  PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf
  2⤵
  PID:3096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\CRASHREPORTCLIENT.EXE-C297728D.pf
  2⤵
  PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-CF3441CE.pf
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-42C11B98.pf
  2⤵
  PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-5EAA410A.pf
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITELAUNCHER.EXE-AF00A2B5.pf
  2⤵
  PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\RUNDLL32.EXE-F264FACF.pf
  2⤵
  PID:5004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
  2⤵
  PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
  2⤵
  PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
  2⤵
  PID:4864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
  2⤵
  PID:1224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
  2⤵
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
  2⤵
  PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
  2⤵
  PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
  2⤵
  PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\e4988bfc0f4c4c6596237473da200329.dat
  2⤵
  PID:3148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
  2⤵
  PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
  2⤵
  PID:5116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_0
  2⤵
  PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_1
  2⤵
  PID:224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_2
  2⤵
  PID:3936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_3
  2⤵
  PID:4212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\9f9fe5b8b6d30293_0
  2⤵
  PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\e7a03ae0f25a578a_0
  2⤵
  PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\index-dir\the-real-index
  2⤵
  PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG
  2⤵
  PID:3096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG.old
  2⤵
  PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\000003.log
  2⤵
  PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\LOG
  2⤵
  PID:388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\LOG
  2⤵
  PID:3180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Network Persistent State
  2⤵
  PID:1404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager
  2⤵
  PID:4124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager-journal
  2⤵
  PID:1076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\000003.log
  2⤵
  PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\LOG
  2⤵
  PID:4420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\000003.log
  2⤵
  PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG
  2⤵
  PID:4932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\TransportSecurity
  2⤵
  PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye
  2⤵
  PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport
  2⤵
  PID:736
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe
  2⤵
  PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache
  2⤵
  PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64
  2⤵
  PID:312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84
  2⤵
  PID:4852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK
  2⤵
  PID:4756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\
  2⤵
  PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved
  2⤵
  PID:1752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config
  2⤵
  PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient
  2⤵
  PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor
  2⤵
  PID:3468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common
  2⤵
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics
  2⤵
  PID:1768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient
  2⤵
  PID:3208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved
  2⤵
  PID:3720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config
  2⤵
  PID:2956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor
  2⤵
  PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs
  2⤵
  PID:1900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame
  2⤵
  PID:3700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
  2⤵
  PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329
  2⤵
  PID:4936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config
  2⤵
  PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
  2⤵
  PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8
  2⤵
  PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
  2⤵
  PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
  2⤵
  PID:4084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
  2⤵
  PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
  2⤵
  PID:4168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
  2⤵
  PID:3200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp
  2⤵
  PID:2932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap
  2⤵
  PID:880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS
  2⤵
  PID:3644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files
  2⤵
  PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2
  2⤵
  PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS
  2⤵
  PID:3096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles
  2⤵
  PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\CosmeticBundleSeparateCosmetics
  2⤵
  PID:2336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBR
  2⤵
  PID:4164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBROptional
  2⤵
  PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreative
  2⤵
  PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreativeOptional
  2⤵
  PID:3336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEnd
  2⤵
  PID:2472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEndOptional
  2⤵
  PID:232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCapture
  2⤵
  PID:5096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCaptureOptional
  2⤵
  PID:3172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.all
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.allOptional
  2⤵
  PID:3928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.de
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.deOptional
  2⤵
  PID:2208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419
  2⤵
  PID:4144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419Optional
  2⤵
  PID:212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ES
  2⤵
  PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ESOptional
  2⤵
  PID:3536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.fr
  2⤵
  PID:2076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.frOptional
  2⤵
  PID:1164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.it
  2⤵
  PID:3936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.itOptional
  2⤵
  PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.pl
  2⤵
  PID:724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.plOptional
  2⤵
  PID:4748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ru
  2⤵
  PID:3504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ruOptional
  2⤵
  PID:4916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CN
  2⤵
  PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CNOptional
  2⤵
  PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup
  2⤵
  PID:3224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\StartupOptional
  2⤵
  PID:2260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache
  2⤵
  PID:2468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw
  2⤵
  PID:4432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles
  2⤵
  PID:220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\CosmeticBundleSeparateCosmetics
  2⤵
  PID:4864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBR
  2⤵
  PID:4324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBROptional
  2⤵
  PID:3904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreative
  2⤵
  PID:1720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreativeOptional
  2⤵
  PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEnd
  2⤵
  PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEndOptional
  2⤵
  PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCapture
  2⤵
  PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCaptureOptional
  2⤵
  PID:3092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.all
  2⤵
  PID:2584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.allOptional
  2⤵
  PID:224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.de
  2⤵
  PID:3076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.deOptional
  2⤵
  PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419
  2⤵
  PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419Optional
  2⤵
  PID:3328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ES
  2⤵
  PID:5048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ESOptional
  2⤵
  PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.fr
  2⤵
  PID:180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.frOptional
  2⤵
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.it
  2⤵
  PID:3752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.itOptional
  2⤵
  PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.pl
  2⤵
  PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.plOptional
  2⤵
  PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ru
  2⤵
  PID:4644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ruOptional
  2⤵
  PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CN
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CNOptional
  2⤵
  PID:2152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\StartupOptional
  2⤵
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
  2⤵
  PID:5040
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
    3⤵
    PID:2552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
  2⤵
  PID:2112
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
    3⤵
    PID:2676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
  2⤵
  PID:1004
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
    3⤵
    PID:3572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
  2⤵
  PID:212
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
    3⤵
    PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.etl
  2⤵
  PID:3092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.log
  2⤵
  PID:4624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.temp
  2⤵
  PID:4684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.dmp
  2⤵
  PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.chk
  2⤵
  PID:1408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bup
  2⤵
  PID:376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bac
  2⤵
  PID:2280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bak
  2⤵
  PID:3940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.old
  2⤵
  PID:3208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
  2⤵
  PID:844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
  2⤵
  PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\a1acda587b3e4c7b87df4eb11fece3c0.dat
  2⤵
  PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\a1acda587b3e4c7b87df4eb11fece3c0.dat
  2⤵
  PID:640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000067
  2⤵
  PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Intel\ShaderCache\EpicGamesLauncher_1
  2⤵
  PID:1948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
  2⤵
  PID:312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
  2⤵
  PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.epicgames.com_0.localstorage
  2⤵
  PID:2456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases
  2⤵
  PID:3396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage
  2⤵
  PID:5108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
  2⤵
  PID:4596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
  2⤵
  PID:692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
  2⤵
  PID:4280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
  2⤵
  PID:1216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
  2⤵
  PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
  2⤵
  PID:1832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
  2⤵
  PID:2392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
  2⤵
  PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004d
  2⤵
  PID:4264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage
  2⤵
  PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004e
  2⤵
  PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004f
  2⤵
  PID:3752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000050
  2⤵
  PID:3596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000051
  2⤵
  PID:3128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000052
  2⤵
  PID:404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000053
  2⤵
  PID:4644
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\
  2⤵
  PID:912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\47343f26116f49d1a460ad740dc2bbbb\ClientSettings.Sav
  2⤵
  PID:3340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
  2⤵
  PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye
  2⤵
  PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys
  2⤵
  PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\CommonFiles\BattlEye\BEDaisy.sys\
  2⤵
  PID:4936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat
  2⤵
  PID:1520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys
  2⤵
  PID:3188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Engine\Programs\CrashReportClient\Config\DefaultEngine.ini
  2⤵
  PID:2364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\VaultCache
  2⤵
  PID:440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32
  2⤵
  PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32\
  2⤵
  PID:3584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Base.ini
  2⤵
  PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseGame.ini
  2⤵
  PID:4620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseInput.ini
  2⤵
  PID:4636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\BaseWindowsLightmass.ini
  2⤵
  PID:3124
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\WindowsGame.ini
  2⤵
  PID:1688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Portal\Config\UserLightmass.ini
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Engine\Config\BaseHardware.ini
  2⤵
  PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\NotForLicensees\Windows\WindowsHardware.ini
  2⤵
  PID:4640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\UserScalability.ini
  2⤵
  PID:2800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\CMS
  2⤵
  PID:4888
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\EMS
  2⤵
  PID:3228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Config\NoRedist\Windows\ShippableWindowsGameUserSettings.ini
  2⤵
  PID:5056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
  2⤵
  PID:1644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\CurveEditorTools\AssetRegistry.bin
  2⤵
  PID:4988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CryptoKeys\AssetRegistry.bin
  2⤵
  PID:3948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CurveEditorTools\AssetRegistry.bin
  2⤵
  PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local
  2⤵
  PID:1300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files
  2⤵
  PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files:VersionCache
  2⤵
  PID:232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\SharedFiles:VersionCache
  2⤵
  PID:3688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\XSettings.Sav
  2⤵
  PID:2632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
  2⤵
  PID:968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS
  2⤵
  PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Epic\EpicGamesLauncher\Data\EMS\stage
  2⤵
  PID:760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
  2⤵
  PID:4588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
  2⤵
  PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\d945f059b8b54aa58202ed2989bebfc8
  2⤵
  PID:884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config
  2⤵
  PID:3492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
  2⤵
  PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-AED3596C4ADFAC4DB9E422A6546810D3
  2⤵
  PID:812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
  2⤵
  PID:1060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
  2⤵
  PID:4704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
  2⤵
  PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
  2⤵
  PID:4508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\
  2⤵
  PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame
  2⤵
  PID:3636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
  2⤵
  PID:4540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%Username%\AppData\Local\BattlEye
  2⤵
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\White.png
  2⤵
  PID:4600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:Program FilesEpic GamesFortniteFortniteGameBinariesWin64Shared Files
  2⤵
  PID:3732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Intermediate\Config\CoalescedSourceConfigs\PortalRegions.ini
  2⤵
  PID:3520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-72CCB9004D132462217ECE948BC03CBE\CrashReportClient.ini
  2⤵
  PID:4604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-E3661BE544621B07B291448442161091\CrashReportClient.ini
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
  2⤵
  PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
  2⤵
  PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Engine.ini
  2⤵
  PID:3448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
  2⤵
  PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
  2⤵
  PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
  2⤵
  PID:3704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
  2⤵
  PID:1816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
  2⤵
  PID:4900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\PortalRegions.ini
  2⤵
  PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\65f6b08d488442e694b1e23d152d971e.dat
  2⤵
  PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\b371f0ee15b74eba84bd23830461130c.dat
  2⤵
  PID:2804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_65f6b08d488442e694b1e23d152d971e.dat
  2⤵
  PID:4936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_b371f0ee15b74eba84bd23830461130c.dat
  2⤵
  PID:3532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
  2⤵
  PID:2364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
  2⤵
  PID:1496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher_2.log
  2⤵
  PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_0
  2⤵
  PID:2584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_1
  2⤵
  PID:4744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_2
  2⤵
  PID:60
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_3
  2⤵
  PID:1044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
  2⤵
  PID:4880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000002
  2⤵
  PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000004
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000005
  2⤵
  PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000006
  2⤵
  PID:3272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000007
  2⤵
  PID:916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000008
  2⤵
  PID:2992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000009
  2⤵
  PID:4624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000a
  2⤵
  PID:4056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000b
  2⤵
  PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000c
  2⤵
  PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000d
  2⤵
  PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000e
  2⤵
  PID:328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000f
  2⤵
  PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000010
  2⤵
  PID:4544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000011
  2⤵
  PID:1612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000012
  2⤵
  PID:4388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000013
  2⤵
  PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000014
  2⤵
  PID:1308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000015
  2⤵
  PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000016
  2⤵
  PID:2040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000017
  2⤵
  PID:3668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000018
  2⤵
  PID:640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000019
  2⤵
  PID:2404
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001a
  2⤵
  PID:4424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001b
  2⤵
  PID:812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001c
  2⤵
  PID:1424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001d
  2⤵
  PID:3680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001e
  2⤵
  PID:3620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001f
  2⤵
  PID:3132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000020
  2⤵
  PID:60
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000021
  2⤵
  PID:548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000022
  2⤵
  PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000023
  2⤵
  PID:3536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000024
  2⤵
  PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000025
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000026
  2⤵
  PID:1932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000027
  2⤵
  PID:4292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000028
  2⤵
  PID:3652
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002b
  2⤵
  PID:4896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002c
  2⤵
  PID:4756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002d
  2⤵
  PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002e
  2⤵
  PID:4684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002f
  2⤵
  PID:4316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000030
  2⤵
  PID:3876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000031
  2⤵
  PID:4672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000032
  2⤵
  PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000033
  2⤵
  PID:4504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000034
  2⤵
  PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000035
  2⤵
  PID:912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000036
  2⤵
  PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000037
  2⤵
  PID:1308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000038
  2⤵
  PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000039
  2⤵
  PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003a
  2⤵
  PID:4516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003b
  2⤵
  PID:1812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003c
  2⤵
  PID:3372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003d
  2⤵
  PID:4332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003e
  2⤵
  PID:684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003f
  2⤵
  PID:4692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000040
  2⤵
  PID:3312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000041
  2⤵
  PID:1964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000042
  2⤵
  PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000043
  2⤵
  PID:452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000044
  2⤵
  PID:2156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000045
  2⤵
  PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046
  2⤵
  PID:2336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\index
  2⤵
  PID:532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies
  2⤵
  PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies-journal
  2⤵
  PID:3724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
  2⤵
  PID:3520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db-journal
  2⤵
  PID:2520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_0
  2⤵
  PID:5056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_1
  2⤵
  PID:4300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_2
  2⤵
  PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_3
  2⤵
  PID:1556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\index
  2⤵
  PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\000003.log
  2⤵
  PID:4520
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\CURRENT
  2⤵
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOCK
  2⤵
  PID:1108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG
  2⤵
  PID:4068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG.old
  2⤵
  PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
  2⤵
  PID:756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage
  2⤵
  PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage-journal
  2⤵
  PID:5064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
  2⤵
  PID:4928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage-journal
  2⤵
  PID:324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager
  2⤵
  PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager-journal
  2⤵
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
dbc88954df2597410c6fcf76a7bf2c94

SHA1
1696342db994c4a0970bf2f70cd211012e43bdb4

SHA256
5fdf5673f8402c3b54304c3e1b02a1e0341bdf3c9bca3de6a9ad52cab97abff9

SHA512
5bf36f2dacf20f82baf2df2f5ac28565c0a9a139bf94e6d18862b5b0126cc2644127d0cdedeac5da113bfbc844e5b85184c5785fa2ad0f02d63d5584dbacd97d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3e7c48d2604691cd6fae6c3390e605fb

SHA1
3e3dc77c149daadbd717061fde139a4ecd7e9b68

SHA256
8aacb8270137d28aa06871c2c556ab3de0bba146dba9a0c81e634437bdb1cb7b

SHA512
2846d6a610b53ba0bd47a919d28615988bda1fd21c8205bf9bdbdc1ae647f4dc00a5b30b3992c94434eb842a791d51d3b9e9e7c26fee257b4051a23650ed7def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb79ad1b67bd9ed906981d2a71b9390b

SHA1
9936b3167f3d537a2845426fb5feebf01b8e7e52

SHA256
daaf69249c20ace99cfb08daa8c52e2353b9f2dc87e6b895c4d701aacb9f1a96

SHA512
024d97942a7a47315647e6f9a9d0b4bbcc3c6b908c17bf39ee30ab784b2ae7f8695bfe65acee36218883427a543d7749925ad9f51e2bfa21f7b008cbb3cf7837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a927d9ff9352b93315060e05ed3a333

SHA1
583f25bf9025bf0f20394fb3251920b6a943d3cc

SHA256
a6107908b073357758d787bcdd710664f04f3bedc0a85a6c72df647777460d63

SHA512
46056e33b62d50dfa20d5b63cf26a64435162a60df9599b1b3708059eee5a756fc57c890a341b654f30849f7f62d0e1d952ff0bb085b75c807195255732a2ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
294B

MD5
f4b58c290a689398286023e8d8389409

SHA1
fed98ab9c465757c4c44c38ee96ec7e030450c92

SHA256
2119ab4afbea1c8e307c33b2c78bddeee29ac8762b6b280bfe5a05779a1b2fa9

SHA512
df8ea832de1d8190036dc9957163c708099b06627f8b28a2b9bb6d30dd282d57a0e0c80e9dd88d62be3bc26b534a105dcdd489f957fdc85e321cad46625e2137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
160B

MD5
2e19a9040ed4a0c3ed82996607736b8f

SHA1
5a78ac2b74f385a12b019c420a681fd13e7b6013

SHA256
2eeb6d38d7aad1dc32e24d3ffd6438698c16a13efd1463d281c46b8af861a8ce

SHA512
86669994386b800888d4e3acb28ab36296594803824d78e095eb0c79642224f24aca5d2892596ac33b7a01b857367ed3a5e2c2fb3405f69a64eb8bf52c26753f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4546495eff5ca06aaca8ed74442e87f1

SHA1
d637b50d649d6c8176e55ac3c6d8d15623e14b09

SHA256
51bc118566e5f4a5bdbd88232fc819ad382f38545c8a0a663966d716f1c5978a

SHA512
c5d06c6bbacdbf832402b7b9a9aa9586b9aea21fa5013700f2cd657534c171afe52d4199edc8055eaf9c606d533b4e6d44f3f7582b0b247e0b042e9bc028172b

Download Submit
memory/3108-0-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-6-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-5-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-2-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-4-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-198-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-3-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download
memory/3108-1-0x00007FF8B7B70000-0x00007FF8B7B72000-memory.dmp

Filesize
8KB

Download
memory/3108-212-0x00007FF6A1B30000-0x00007FF6A2254000-memory.dmp

Filesize
7.1MB

Download