7533c3d88c4ff72273d982f53faf9cfa04a7ca51dae4c481512663514872d21d

Analysis

max time kernel
34s
max time network
37s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-11-2024 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PotatoGraphics.exe
Size

64.1MB
MD5

f73b7791baeb98ce6c6f6b7f82e1792d
SHA1

3b1620b7a105b3ffa6c248f020cbee1119211952
SHA256

7533c3d88c4ff72273d982f53faf9cfa04a7ca51dae4c481512663514872d21d
SHA512

dc4cdca7ece2beb159bb1ed316e61b4334931307351ca3799593c47dc706164454e874aa23ffcbd2c8787ab7d2456068c3bc054800d6d727bec8ad700a4d321c
SSDEEP

1572864:8Wl164XEQCrwvXoTXkcpDNNEfxPJc9XIr1lAZ1POJC6X/1B+i3j:8y640cAQ656xPJc9k1lfhWiT

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

PotatoGraphics.exe

pid process

5096 PotatoGraphics.exe
5096 PotatoGraphics.exe
5096 PotatoGraphics.exe
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

pid	process
5096	PotatoGraphics.exe
5096	PotatoGraphics.exe
5096	PotatoGraphics.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PotatoGraphics.exe

description pid process

Token: SeDebugPrivilege 5096 PotatoGraphics.exe

description	pid	process
Token: SeDebugPrivilege	5096	PotatoGraphics.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PotatoGraphics.exe

description	pid	process	target process
PID 5096 wrote to memory of 1332	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1332	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1332	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4404	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4404	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4404	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1396	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1396	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1396	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1964	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1964	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1964	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4264	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4264	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4264	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4496	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4496	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4496	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4760	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4760	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4760	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2804	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2804	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2804	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3808	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3808	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3808	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2956	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2956	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2956	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 552	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 552	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 552	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3108	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3108	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3108	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2276	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2276	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2276	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4388	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4388	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 4388	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3600	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3600	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3600	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3760	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3760	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 3760	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1088	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1088	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1088	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2836	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2836	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2836	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 664	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 664	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 664	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1356	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1356	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 1356	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2156	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2156	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 2156	5096	PotatoGraphics.exe	cmd.exe
PID 5096 wrote to memory of 5084	5096	PotatoGraphics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\PotatoGraphics.exe
"C:\Users\Admin\AppData\Local\Temp\PotatoGraphics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk10ondemand-WindowsClient.utoc" /F /Q
  2⤵
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk10ondemand-WindowsClient_s1.ucas" /F /Q
  2⤵
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk10ondemand-WindowsClient.pak" /F /Q
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk10ondemand-WindowsClient.sig" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk10ondemand-WindowsClient.ucas" /F /Q
  2⤵
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\ThirdParty\Discord"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\ThirdParty\SpeechGraphics"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\ar_sa.cfg" /F /Q
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\cs_cz.cfg" /F /Q
  2⤵
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\de_de.cfg" /F /Q
  2⤵
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\es_ar.cfg" /F /Q
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\es_es.cfg" /F /Q
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\fr_fr.cfg" /F /Q
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\it_it.cfg" /F /Q
  2⤵
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\ja_ja.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\ko_kr.cfg" /F /Q
  2⤵
  PID:3760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\nl_nl.cfg" /F /Q
  2⤵
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\pl_pl.cfg" /F /Q
  2⤵
  PID:2836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\pt_br.cfg" /F /Q
  2⤵
  PID:664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\zh_cn.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\th_th.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\tr_tr.cfg" /F /Q
  2⤵
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization\zh_tw.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\ar_sa.cfg" /F /Q
  2⤵
  PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\cs_cz.cfg" /F /Q
  2⤵
  PID:1224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\de_de.cfg" /F /Q
  2⤵
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\es_ar.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\es_es.cfg" /F /Q
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\fr_fr.cfg" /F /Q
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\it_it.cfg" /F /Q
  2⤵
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\ja_ja.cfg" /F /Q
  2⤵
  PID:1096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\ko_kr.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\nl_nl.cfg" /F /Q
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\pl_pl.cfg" /F /Q
  2⤵
  PID:956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\pt_br.cfg" /F /Q
  2⤵
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\zh_cn.cfg" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\th_th.cfg" /F /Q
  2⤵
  PID:1540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\tr_tr.cfg" /F /Q
  2⤵
  PID:1792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Localization\zh_tw.cfg" /F /Q
  2⤵
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\SplashScreen.png" /F /Q
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat_Kamu\Launcher\SplashScreen.png" /F /Q
  2⤵
  PID:1376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\cs.ini" /F /Q
  2⤵
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\de.ini" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\es.ini" /F /Q
  2⤵
  PID:784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\fr.ini" /F /Q
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\it.ini" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\ja.ini" /F /Q
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\ko.ini" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\nl.ini" /F /Q
  2⤵
  PID:464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\pl.ini" /F /Q
  2⤵
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\pt.ini" /F /Q
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\tr.ini" /F /Q
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\zh.ini" /F /Q
  2⤵
  PID:912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Text\zh-TW.ini" /F /Q
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Install_BattlEye.bat" /F /Q
  2⤵
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Uninstall_BattlEye.bat" /F /Q
  2⤵
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\EULA.txt" /F /Q
  2⤵
  PID:1236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Licenses.txt" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\BattlEye\Privacy"
  2⤵
  PID:3684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Localization"
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\ThirdParty\Nvidia\NGX"
  2⤵
  PID:452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\Launcher\SplashScreen.png" /F /Q
  2⤵
  PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\chrome_100_percent.pak" /F /Q
  2⤵
  PID:3904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\chrome_200_percent.pak" /F /Q
  2⤵
  PID:2292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\v8_context_snapshot.bin" /F /Q
  2⤵
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\EasyAntiCheat_x86.dll" /F /Q
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\am.pak" /F /Q
  2⤵
  PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\bg.pak" /F /Q
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\bn.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ca.pak" /F /Q
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\cs.pak" /F /Q
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\da.pak" /F /Q
  2⤵
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\de.pak" /F /Q
  2⤵
  PID:448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\el.pak" /F /Q
  2⤵
  PID:4564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\es.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\es-419.pak" /F /Q
  2⤵
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\et.pak" /F /Q
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\fa.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\fi.pak" /F /Q
  2⤵
  PID:3276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\fil.pak" /F /Q
  2⤵
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\fr.pak" /F /Q
  2⤵
  PID:228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\gu.pak" /F /Q
  2⤵
  PID:460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\he.pak" /F /Q
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\hi.pak" /F /Q
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\hr.pak" /F /Q
  2⤵
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\hu.pak" /F /Q
  2⤵
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\id.pak" /F /Q
  2⤵
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\it.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ja.pak" /F /Q
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\kn.pak" /F /Q
  2⤵
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ko.pak" /F /Q
  2⤵
  PID:1236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\lt.pak" /F /Q
  2⤵
  PID:1224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\lv.pak" /F /Q
  2⤵
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ml.pak" /F /Q
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\mr.pak" /F /Q
  2⤵
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ms.pak" /F /Q
  2⤵
  PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\nb.pak" /F /Q
  2⤵
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\nl.pak" /F /Q
  2⤵
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\pl.pak" /F /Q
  2⤵
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\pt-BR.pak" /F /Q
  2⤵
  PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\pt-PT.pak" /F /Q
  2⤵
  PID:3844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ro.pak" /F /Q
  2⤵
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\sk.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\sl.pak" /F /Q
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\sr.pak" /F /Q
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\sv.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\sw.pak" /F /Q
  2⤵
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ta.pak" /F /Q
  2⤵
  PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\te.pak" /F /Q
  2⤵
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\th.pak" /F /Q
  2⤵
  PID:1880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\tr.pak" /F /Q
  2⤵
  PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\uk.pak" /F /Q
  2⤵
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\vi.pak" /F /Q
  2⤵
  PID:3112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\zh-CN.pak" /F /Q
  2⤵
  PID:464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\zh-TW.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\Resources\locales\ar.pak" /F /Q
  2⤵
  PID:664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\PackagedReplays"
  2⤵
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Legal"
  2⤵
  PID:3340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Movies"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Splash"
  2⤵
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\DbgHelp"
  2⤵
  PID:1844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\NVIDIA"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\Engine\Plugins\Amazon"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C rd /s /q "C:\Program Files\Epic Games\Fortnite\Cloud"
  2⤵
  PID:1204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\ThirdParty\CEF3\Win64\snapshot_blob.bin" /F /Q
  2⤵
  PID:3832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakChunkEarly-WindowsClient.sig" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakChunkEarly-WindowsClient.ucas" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakChunkEarly-WindowsClient.utoc" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakChunkEarly-WindowsClient.pak" /F /Q
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1012optional-WindowsClient.pak" /F /Q
  2⤵
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1010optional-WindowsClient.utoc" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1010optional-WindowsClient.pak" /F /Q
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1010optional-WindowsClient.sig" /F /Q
  2⤵
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1010optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1012optional-WindowsClient.sig" /F /Q
  2⤵
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1012optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1012optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1007optional-WindowsClient.pak" /F /Q
  2⤵
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1007optional-WindowsClient.sig" /F /Q
  2⤵
  PID:448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1007optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1007optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1000optional-WindowsClient.pak" /F /Q
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1000optional-WindowsClient.sig" /F /Q
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1000optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1000optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:3168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1002optional-WindowsClient.pak" /F /Q
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1002optional-WindowsClient.sig" /F /Q
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1002optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1002optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1003optional-WindowsClient.pak" /F /Q
  2⤵
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1003optional-WindowsClient.sig" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1003optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1003optional-WindowsClient.utoc" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1004optional-WindowsClient.pak" /F /Q
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1004optional-WindowsClient.sig" /F /Q
  2⤵
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1004optional-WindowsClient.ucas" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1004optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1005optional-WindowsClient.pak" /F /Q
  2⤵
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1005optional-WindowsClient.sig" /F /Q
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1005optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1005optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1006optional-WindowsClient.pak" /F /Q
  2⤵
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1006optional-WindowsClient.sig" /F /Q
  2⤵
  PID:4044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1006optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1006optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1008optional-WindowsClient.pak" /F /Q
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1008optional-WindowsClient.sig" /F /Q
  2⤵
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1008optional-WindowsClient.ucas" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1008optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1009optional-WindowsClient.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1009optional-WindowsClient.sig" /F /Q
  2⤵
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1009optional-WindowsClient.ucas" /F /Q
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1009optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_Curroptional-WindowsClient.pak" /F /Q
  2⤵
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_Curroptional-WindowsClient.sig" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_Curroptional-WindowsClient.ucas" /F /Q
  2⤵
  PID:3532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_Curroptional-WindowsClient.utoc" /F /Q
  2⤵
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_ExtRefoptional-WindowsClient.pak" /F /Q
  2⤵
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_ExtRefoptional-WindowsClient.sig" /F /Q
  2⤵
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_ExtRefoptional-WindowsClient.ucas" /F /Q
  2⤵
  PID:216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunkscb_ExtRefoptional-WindowsClient.utoc" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1001optional-WindowsClient.utoc" /F /Q
  2⤵
  PID:5068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1001optional-WindowsClient.ucas" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1001optional-WindowsClient.sig" /F /Q
  2⤵
  PID:772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Content\Paks\pakchunk1001optional-WindowsClient.pak" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-errorhandling-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\vcruntime140_1.dll" /F /Q
  2⤵
  PID:4452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\vcruntime140.dll" /F /Q
  2⤵
  PID:4072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-runtime-l1-1-0.dll" /F /Q
  2⤵
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-debug-l1-1-0.dll" /F /Q
  2⤵
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-console-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-console-l1-2-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-datetime-l1-1-0.dll" /F /Q
  2⤵
  PID:452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-file-l1-1-0.dll" /F /Q
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-file-l1-2-0.dll" /F /Q
  2⤵
  PID:1132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-file-l2-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-handle-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-heap-l1-1-0.dll" /F /Q
  2⤵
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-interlocked-l1-1-0.dll" /F /Q
  2⤵
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-libraryloader-l1-1-0.dll" /F /Q
  2⤵
  PID:4040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-localization-l1-2-0.dll" /F /Q
  2⤵
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-memory-l1-1-0.dll" /F /Q
  2⤵
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-namedpipe-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-processenvironment-l1-1-0.dll" /F /Q
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-processthreads-l1-1-0.dll" /F /Q
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-processthreads-l1-1-1.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-profile-l1-1-0.dll" /F /Q
  2⤵
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-rtlsupport-l1-1-0.dll" /F /Q
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-string-l1-1-0.dll" /F /Q
  2⤵
  PID:1880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-synch-l1-1-0.dll" /F /Q
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-synch-l1-2-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-sysinfo-l1-1-0.dll" /F /Q
  2⤵
  PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-timezone-l1-1-0.dll" /F /Q
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-core-util-l1-1-0.dll" /F /Q
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-conio-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-convert-l1-1-0.dll" /F /Q
  2⤵
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-environment-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-filesystem-l1-1-0.dll" /F /Q
  2⤵
  PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-heap-l1-1-0.dll" /F /Q
  2⤵
  PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-locale-l1-1-0.dll" /F /Q
  2⤵
  PID:3552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-math-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-multibyte-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-private-l1-1-0.dll" /F /Q
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-process-l1-1-0.dll" /F /Q
  2⤵
  PID:2908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-stdio-l1-1-0.dll" /F /Q
  2⤵
  PID:3632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-string-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-time-l1-1-0.dll" /F /Q
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\api-ms-win-crt-utility-l1-1-0.dll" /F /Q
  2⤵
  PID:2140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_atomic-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_chrono-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_iostreams-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_program_options-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_python39-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_regex-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  PID:4004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_system-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\boost_thread-vc142-mt-x64-1_70.dll" /F /Q
  2⤵
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\concrt140.dll" /F /Q
  2⤵
  PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\dbghelp.dll" /F /Q
  2⤵
  PID:1376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\msvcp140.dll" /F /Q
  2⤵
  PID:3752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\msvcp140_1.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\msvcp140_2.dll" /F /Q
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\msvcp140_codecvt_ids.dll" /F /Q
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\ucrtbase.dll" /F /Q
  2⤵
  PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\vccorlib140.dll" /F /Q
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-console-l1-1-0.dll" /F /Q
  2⤵
  PID:216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-console-l1-2-0.dll" /F /Q
  2⤵
  PID:724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-datetime-l1-1-0.dll" /F /Q
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-debug-l1-1-0.dll" /F /Q
  2⤵
  PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-errorhandling-l1-1-0.dll" /F /Q
  2⤵
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-file-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-file-l1-2-0.dll" /F /Q
  2⤵
  PID:728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-file-l2-1-0.dll" /F /Q
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-handle-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-heap-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-interlocked-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-libraryloader-l1-1-0.dll" /F /Q
  2⤵
  PID:3684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-localization-l1-2-0.dll" /F /Q
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-memory-l1-1-0.dll" /F /Q
  2⤵
  PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-namedpipe-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-processenvironment-l1-1-0.dll" /F /Q
  2⤵
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-processthreads-l1-1-0.dll" /F /Q
  2⤵
  PID:572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-processthreads-l1-1-1.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-profile-l1-1-0.dll" /F /Q
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-rtlsupport-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-string-l1-1-0.dll" /F /Q
  2⤵
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-synch-l1-1-0.dll" /F /Q
  2⤵
  PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-synch-l1-2-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-sysinfo-l1-1-0.dll" /F /Q
  2⤵
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-timezone-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-core-util-l1-1-0.dll" /F /Q
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-conio-l1-1-0.dll" /F /Q
  2⤵
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-convert-l1-1-0.dll" /F /Q
  2⤵
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-environment-l1-1-0.dll" /F /Q
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-filesystem-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-heap-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-locale-l1-1-0.dll" /F /Q
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-math-l1-1-0.dll" /F /Q
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-multibyte-l1-1-0.dll" /F /Q
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-private-l1-1-0.dll" /F /Q
  2⤵
  PID:1208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-process-l1-1-0.dll" /F /Q
  2⤵
  PID:2968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-runtime-l1-1-0.dll" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-stdio-l1-1-0.dll" /F /Q
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-string-l1-1-0.dll" /F /Q
  2⤵
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-time-l1-1-0.dll" /F /Q
  2⤵
  PID:3552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\api-ms-win-crt-utility-l1-1-0.dll" /F /Q
  2⤵
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\concrt140.dll" /F /Q
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\CrashReportClient.exe" /F /Q
  2⤵
  PID:440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\EpicWebHelper.exe" /F /Q
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\msvcp140.dll" /F /Q
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\msvcp140_1.dll" /F /Q
  2⤵
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\msvcp140_2.dll" /F /Q
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\msvcp140_codecvt_ids.dll" /F /Q
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\tbb.dll" /F /Q
  2⤵
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\ucrtbase.dll" /F /Q
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Binaries\Win64\UninstallHelper-Win64-Shipping.exe" /F /Q
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C DEL "C:\Program Files\Epic Games\Fortnite\Engine\Content\Slate\Cursor\invisible.cur" /F /Q
  2⤵
  PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C echo off
  2⤵
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.net\PotatoGraphics\Lb2pJELVcGjgmnt4_HNvjGF21swNaXE=\D3DCompiler_47_cor3.dll

Filesize
3.9MB

MD5
d935c9f57aa56b90ae4da0a0bb280e0f

SHA1
d6364fb5e50ac93e37db5f49b85d28823ed89191

SHA256
f8c35b65524c60aa1765b13dc96a92a16d5570827b7fe6ccabfa9859d2a6ad60

SHA512
1bd535ecfe5611c2b43a9556efb41f0bff1ed64e480b069c30ab2fcf30c1a364542703fada877d91e626fd36e37b2fc4d8c053a2fca78a94d0b21ea66ea8b4c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\PotatoGraphics\Lb2pJELVcGjgmnt4_HNvjGF21swNaXE=\PresentationNative_cor3.dll

Filesize
922KB

MD5
189e8b2ed3a8cf16ca82462dc0f44319

SHA1
9bc34fe3fc9da99a5f0709085a330530ac2bdf79

SHA256
0037596b79b5a8fd580ef409620c3936fd514382de972af1df74a6143adcbb95

SHA512
316326630fec54e274eadf25ac344ee9d399239c82eaec2020aa49394d99e8b8b4abc1e5d47a19177dfa008cefb892aa9cd95c7436f450f2dc5e2d3abaf5eb6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\PotatoGraphics\Lb2pJELVcGjgmnt4_HNvjGF21swNaXE=\wpfgfx_cor3.dll

Filesize
1.7MB

MD5
f91a72687cde5aa77e3b852c5c9f01fd

SHA1
3372a108c7072591a86555acf0bcf9d020a28e58

SHA256
d17c4501298d3cdd05acd03a6c318f50f40a485fa616a3e14b27fde012b17efd

SHA512
8373f4af305d1eb2988b9343a0f5b69ceb97d05e5c9ddb715db638bd09e33b6a512bdfc951ddc331f4c7d605dfc3fcddd2d34bb9126c65702e53dc79fb5ea358

Download Submit
memory/5096-59-0x000000000AF70000-0x000000000AF90000-memory.dmp

Filesize
128KB

Download
memory/5096-54-0x000000000AF50000-0x000000000AF60000-memory.dmp

Filesize
64KB

Download
memory/5096-24-0x000000000AD00000-0x000000000AE40000-memory.dmp

Filesize
1.2MB

Download
memory/5096-34-0x0000000008880000-0x00000000088C0000-memory.dmp

Filesize
256KB

Download
memory/5096-30-0x0000000008880000-0x00000000088C0000-memory.dmp

Filesize
256KB

Download
memory/5096-29-0x0000000008840000-0x0000000008880000-memory.dmp

Filesize
256KB

Download
memory/5096-25-0x0000000008840000-0x0000000008880000-memory.dmp

Filesize
256KB

Download
memory/5096-20-0x000000000AD00000-0x000000000AE40000-memory.dmp

Filesize
1.2MB

Download
memory/5096-19-0x0000000008BA0000-0x0000000008DA0000-memory.dmp

Filesize
2.0MB

Download
memory/5096-39-0x000000000BB10000-0x000000000C2D0000-memory.dmp

Filesize
7.8MB

Download
memory/5096-44-0x0000000008F60000-0x0000000008FE0000-memory.dmp

Filesize
512KB

Download
memory/5096-5-0x00000000079A0000-0x00000000085A0000-memory.dmp

Filesize
12.0MB

Download
memory/5096-55-0x000000000AF70000-0x000000000AF90000-memory.dmp

Filesize
128KB

Download
memory/5096-15-0x0000000008BA0000-0x0000000008DA0000-memory.dmp

Filesize
2.0MB

Download
memory/5096-50-0x000000000AF50000-0x000000000AF60000-memory.dmp

Filesize
64KB

Download
memory/5096-49-0x000000000AF00000-0x000000000AF20000-memory.dmp

Filesize
128KB

Download
memory/5096-45-0x000000000AF00000-0x000000000AF20000-memory.dmp

Filesize
128KB

Download
memory/5096-40-0x0000000008F60000-0x0000000008FE0000-memory.dmp

Filesize
512KB

Download
memory/5096-35-0x000000000BB10000-0x000000000C2D0000-memory.dmp

Filesize
7.8MB

Download
memory/5096-64-0x000000000AFD0000-0x000000000AFF0000-memory.dmp

Filesize
128KB

Download
memory/5096-60-0x000000000AFD0000-0x000000000AFF0000-memory.dmp

Filesize
128KB

Download
memory/5096-65-0x000000000B0C0000-0x000000000B0E0000-memory.dmp

Filesize
128KB

Download
memory/5096-14-0x0000000009E80000-0x000000000AD00000-memory.dmp

Filesize
14.5MB

Download
memory/5096-10-0x0000000009E80000-0x000000000AD00000-memory.dmp

Filesize
14.5MB

Download
memory/5096-9-0x00000000079A0000-0x00000000085A0000-memory.dmp

Filesize
12.0MB

Download